Qmail is less bad than most (and much less bad than Sendmail), but it's worth noting the author dismissed a known remote attack involving array lengths overflow

Qmail is less bad than most (and much less bad than Sendmail), but it's worth noting the author dismissed a known remote attack involving array lengths overflowing 32 bits. He's aware 64 bit machines exist yet assumes nobody would ever give his server enough RAM to allow exploiting this, which I find surprisingly reckless given his reputation. Most of us know several languages in which this bug would have been impossible (using either bignums or bound-checked arrays), yet here we are. http://archives.neohapsis.com/archives/fulldisclosure/2005-05/0101.html http://archives.neohapsis.com/archives/fulldisclosure/2005-0... http://cr.yp.to/qmail/guarantee.html http://cr.yp.to/qmail/guarantee.html