You're right, there is no check against FD_SETSIZE. IMO it's a bad idea not to enforce some kind of accepted connections limit. However, I'm pessimistic about the possibility of executing arbitrary code - even if you succeed to overwrite the return address, you must think of some other way to place ...

[ more ]