On 9/30/05, Ian Jackson <[EMAIL PROTECTED]> wrote: > I've had a look at the situation with 222324, and the request for a > --wide option: > > I agree that such an option would be a good thing and ought to be > provided. However, it is far from clear how to do it in a > clearly-correct way with the current codebase. > > The current code in netstat is a hopeless morass of C string-twiddling > and fixed-length buffers, and simply going through and adding new > cases to it - particularly, adding arrangements to avoid truncation - > seems very dangerous to me. > > It would be easier to rewrite most of that code than to review for > correctness an attempt like Olaf's patch. And that review is > essential because this is really difficult to get right and any > mistake is likely to produce a buffer overflow vulnerability.
If you compare our patches, you should see we're doing basically the same (except I'm taking care of more columns). I don't understand how you can claim that yours is safer to add than mine. I don't add any fixed size buffers and only simplify string twiddling. > Also, of course, any --wide option ought to guarantee never to > truncate anything, not just some particular cases. I'm not sure about that. You can't guarantee if you only have a fixed number of columns available and a basically unbound input size.
