Re:15 years later: Remote Code Execution in qmail (CVE-2005-...
by kjs3 on Wednesday May 20, 2020 @08:19PM
(#23253569)
Yes, having run qmail for most of the 90s, I'm pretty familiar with what was contemporary. I was being hyperbolic. And yes, there's a lot of code out there with the same class of flaw.
My point is, the right answer isn't to say "that will never happen" and get surprised down the road, the right answer is to say "that shouldn't happen" and do something about it.
So, sure...don't wait till the header gets to 3.9GB. Absurd. But 100MB? 10? 1? I think I'd get antsy at 1MB. Especially since RFC2822 implies lines can be no longer than 998 characters. So...you know...someplace between 998B and 1MB would be reasonable to punt. Especially at the time the code was written.
My point is, the right answer isn't to say "that will never happen" and get surprised down the road, the right answer is to say "that shouldn't happen" and do something about it.
So, sure...don't wait till the header gets to 3.9GB. Absurd. But 100MB? 10? 1? I think I'd get antsy at 1MB. Especially since RFC2822 implies lines can be no longer than 998 characters. So...you know...someplace between 998B and 1MB would be reasonable to punt. Especially at the time the code was written.