Regex: badly needs fuzzing

#1

Post by infogulch » Wed, Feb 08, 2017, 5:43 PM UTC

Regex: badly needs fuzzing
svn.boost.org

Re: Regex: badly needs fuzzing

#2

Post by pcwalton » Wed, Feb 08, 2017, 6:17 PM UTC

Another counterexample to the idea that modern C++ written by experts is free of memory safety issues.

Re: Regex: badly needs fuzzing

#3

Post by [deleted] » Wed, Feb 08, 2017, 6:19 PM UTC

pcwalton wrote: post #2

Another counterexample to the idea that modern C++ written by experts is free of memory safety issues.

[deleted]

Re: Regex: badly needs fuzzing

#4

Post by mememachine » Wed, Feb 08, 2017, 6:22 PM UTC

pcwalton wrote: post #2

Another counterexample to the idea that modern C++ written by experts is free of memory safety issues.

If the solution doesnt make it any easier to avoid memory issues (just forces you to avoid them,) its not an attractive solution

Re: Regex: badly needs fuzzing

#5

Post by gcp » Wed, Feb 08, 2017, 6:27 PM UTC

mememachine wrote: post #4

pcwalton wrote: post #2

Another counterexample to the idea that modern C++ written by experts is free of memory safety issues.

If the solution doesnt make it any easier to avoid memory issues (just forces you to avoid them,) its not an attractive solution

Given that we're talking about bugs, I don't think this is a valid argument. Being forced to avoid bugs is good, yes? Even if it's not necessarily less hard to make them in the first place (which is arguable, too!).

I mean, I spend most of my time coding searching for bugs, not avoiding them.

Re: Regex: badly needs fuzzing

#6

Post by nix0n » Wed, Feb 08, 2017, 6:27 PM UTC

Google's cache of this bug (loads quite slowly for some reason):

https://webcache.googleusercontent.com/search?q=cache:mVrrFL...

Re: Regex: badly needs fuzzing

#7

Post by CJefferson » Wed, Feb 08, 2017, 6:27 PM UTC

Any rust lovers out there: Could I ask you do a benchmark comparison and a fuzz comparison. I'd be genuinely interested in the result and if (as you might hope) the Rust::regex is as fast as boost:regex, and never crashes, that would persuade at least me to finally learn some Rust!

Re: Regex: badly needs fuzzing

#8

Post by pcwalton » Wed, Feb 08, 2017, 6:28 PM UTC

mememachine wrote: post #4

pcwalton wrote: post #2

Another counterexample to the idea that modern C++ written by experts is free of memory safety issues.

If the solution doesnt make it any easier to avoid memory issues (just forces you to avoid them,) its not an attractive solution

I disagree? It's better to not have memory safety problems than to have them!

Re: Regex: badly needs fuzzing

#9

Post by gcp » Wed, Feb 08, 2017, 6:30 PM UTC

CJefferson wrote: post #7

Any rust lovers out there: Could I ask you do a benchmark comparison and a fuzz comparison. I'd be genuinely interested in the result and if (as you might hope) the Rust::regex is as fast as boost:regex, and never crashes, that would persuade at least me to finally learn some Rust!

The Rust regex library is written by the same guy who wrote ripgrep. I'd be surprised if it didn't run circles around boost::regex.

Re: Regex: badly needs fuzzing

#10

Post by stuckagain » Wed, Feb 08, 2017, 6:31 PM UTC

CJefferson wrote: post #7

Any rust lovers out there: Could I ask you do a benchmark comparison and a fuzz comparison. I'd be genuinely interested in the result and if (as you might hope) the Rust::regex is as fast as boost:regex, and never crashes, that would persuade at least me to finally learn some Rust!

If you were interested in performance you probably would not have been using boost::regex to begin with. RE2 is often an order of magnitude faster. You might choose boost if you require backtracking, but that's crazy anyway due to exponential time.