Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Regex: badly needs fuzzing

svn.boost.org

Post reply on HN
Print view View original

71–80 of 180 posts

Re: Regex: badly needs fuzzing

#71

Post by blub »

eridius wrote: post #65
sidlls wrote: post #53

Earlier quoted context omitted.

Not sure what that has to do with anything. The parent is a very vocal Rust proponent and made a ridiculous comment which has been called out by myself and several others. It hasn't anything to do with any "small group of people" talking smack about C programmers. Although that's unfortunate, too.

I don't think it's ridiculous. It seems like almost every discussion about Rust vs C++ here has a few people saying that you don't need Rust's guarantees about memory safety if you're writing modern C++. And that oft-repeated comment is what pcwalton is referencing.

pcwalton is not framing the problem in a particularly useful way.

This is a question of risk management and his argument is basically that one should always reduce the risk of memory management errors to zero. Others say that they can tolerate some risk, as long as it's in acceptable margins, since it's expensive to totally eliminate it.

I don't think that lecturing everyone "No, you really want to have 0 risk, you fools" is a successful programming language advocacy strategy.

Re: Regex: badly needs fuzzing

#72

Post by jasode »

pcwalton wrote: post #2

Another counterexample to the idea that modern C++ written by experts is free of memory safety issues.

Maybe you're right that it's wrong to think that modern C++17 (unique_ptr, shared_ptr) written by experts is free of memory safety issues.

But in this specific case, it looks like old code from 2002[1]. No modern techniques such as std:unique_ptr. Just 1970s C style raw pointer manipulation. I suppose the contemporaneous compiler used by John Maddock would have been C++98?!?

[1] one example of a source file mentioned by the bug report: http://www.boost.org/doc/libs/1_63_0/boost/regex/v4/perl_mat...

Re: Regex: badly needs fuzzing

#73

Post by zintinio5 »

stuckagain wrote: post #10
CJefferson wrote: post #7

Any rust lovers out there: Could I ask you do a benchmark comparison and a fuzz comparison. I'd be genuinely interested in the result and if (as you might hope) the Rust::regex is as fast as boost:regex, and never crashes, that would persuade at least me to finally learn some Rust!

If you were interested in performance you probably would not have been using boost::regex to begin with. RE2 is often an order of magnitude faster. You might choose boost if you require backtracking, but that's crazy anyway due to exponential time.

From my understanding the main benefit of RE2 is not speed, but linearly scaling execution time with respect to the input size, along with bounded memory usage. For certain inputs, it may outperform other engines, but the converse may also be true. As with any feature that may be abused, backtracking may also be useful: for example, you may need to write a script to munge text. Since you're not exposing it to arbitrary user input, it's a reasonable feature.

Re: Regex: badly needs fuzzing

#74

Post by stuckagain »

Groxx wrote: post #64
jimrandomh wrote: post #14

Practical upshot: do not feed untrusted regexes into boost::regex.

Untrusted regexes to anything , where possible. There are fairly well-known ways to use those to run a DoS: https://en.wikipedia.org/wiki/ReDoS

I take it you don't use a web browser?

Re: Regex: badly needs fuzzing

#75

Post by sidlls »

eridius wrote: post #65
sidlls wrote: post #53

Earlier quoted context omitted.

Not sure what that has to do with anything. The parent is a very vocal Rust proponent and made a ridiculous comment which has been called out by myself and several others. It hasn't anything to do with any "small group of people" talking smack about C programmers. Although that's unfortunate, too.

I don't think it's ridiculous. It seems like almost every discussion about Rust vs C++ here has a few people saying that you don't need Rust's guarantees about memory safety if you're writing modern C++. And that oft-repeated comment is what pcwalton is referencing.

It is ridiculous. Both because he doesn't qualify his targets the way you have and for the reason others noted (it's not modern C++). It's a gratuitous and inflammatory insult.

Re: Regex: badly needs fuzzing

#76

Post by stuckagain »

zintinio5 wrote: post #73
stuckagain wrote: post #10

Earlier quoted context omitted.

If you were interested in performance you probably would not have been using boost::regex to begin with. RE2 is often an order of magnitude faster. You might choose boost if you require backtracking, but that's crazy anyway due to exponential time.

From my understanding the main benefit of RE2 is not speed, but linearly scaling execution time with respect to the input size, along with bounded memory usage. For certain inputs, it may outperform other engines, but the converse may also be true. As with any feature that may be abused, backtracking may also be useful: for example, you may need to write a script to munge text. Since you're not exposing it to arbitra…

RE2 is not dramatically faster than all other regex implementations, but it is dramatically faster than boost::regex, which is among the slowest I've ever tested.

Re: Regex: badly needs fuzzing

#77

Post by geofft »

ue_ wrote: post #56
stuckagain wrote: post #51

Earlier quoted context omitted.

There are features of some regular expressions for which the only known solution is backtracking. If you want those features then you "require backtracking".

Out of interest, what are some of these? I have a hard time believing that the implementors of the Perl regex engine chose to write it that way for no reason while the Thompson NFA figures are thrown about. I knew there must havevbeen something this 'implementation detail' was good for.

An easy example is matching palindromes. You simply can't match a palindrome by moving forward only; you have to go back and see if every letter matches. So, if you want to search for the longest palindrome in a string, you'll necessarily be doing a lot of backtracking.

There's no RE2-compatible regular expression for matching palindromes, but additional features as found in PCRE and similar "regex" engines can do it with backreferences or with look-around assertions. See http://stackoverflow.com/q/3746487 and http://stackoverflow.com/q/3664881 for two ways to write such a regex.

Re: Regex: badly needs fuzzing

#78

Post by civility »

dbaupp wrote: post #55
ambrop7 wrote: post #44

Earlier quoted context omitted.

If it has memory safety issues then it's not written by experts :)

So there's no such thing as a C++ expert? That statement is dangerously close to a No True Scotsman: IME even people who seem to fit any reasonable definition of expert (committee members, compiler developers) still make memory-safety mistakes.

> That statement is dangerously close to a No True Scotsman

It also had a smiley in it. I'm pretty sure you missed the joke and don't realize you're preaching to the choir.

Re: Regex: badly needs fuzzing

#79

Post by civility »

amalag wrote: post #12
mememachine wrote: post #4

Earlier quoted context omitted.

If the solution doesnt make it any easier to avoid memory issues (just forces you to avoid them,) its not an attractive solution

Avoiding bugs is a pretty effective way to not have bugs.

Turning off your computer is the only way to avoid bugs. All software has bugs.

Re: Regex: badly needs fuzzing

#80

Post by bradleyjg »

The larger question is why every conversation on here even tangentially related to C++, or Go, or almost any programming language for that matter, becomes about Rust.

Just because it isn't a commercial product doesn't mean shilling is okay.

Post reply on HN