Lighttpd

There is at least one buffer overflow in src/spawn-fcgi.c, since if UNIX_PATH_MAX is not defined, it is set to 108, which may NOT be assumed! One should use sizeof() instead.

You should also check src/mod_fastcgi.c, src/mod_scgi.c and src/spawn-fcgi.c, I was not able to exploit the overflow in src/spawn-fcgi.c in any kind, but this is generaly a very bad practice and could lead to problems when using external management applications and/or lead to potential security problems in those modules; now or in the future. Maybe it already IS vulnerable on some platforms!

At least on OpenBSD/FreeBSD in sys/un.h:

/*
 * Definitions for UNIX IPC domain.
 */
struct sockaddr_un {
        unsigned char   sun_len;        /* sockaddr len including null */
        sa_family_t     sun_family;     /* AF_UNIX */
        char    sun_path[104];          /* path name (gag) */
};

-- jimmy