[Patch, PR 61061] Add state limit for regex NFA

[Maksymilian A]

Hi Jonathan,

The default value for mentioned 'pre set level' isn't specified. I
think that we need new safe and extended RE type or user should
determine security level of complexity.

BR,
Maksymilian Arciemowicz
http://cxsecurity.com/


2014-07-17 11:38 GMT+02:00 Jonathan Wakely <jwakely@redhat.com>:
> On 17/07/14 10:34 +0100, Jonathan Wakely wrote:
>>
>> On 16/07/14 21:46 +0200, Maksymilian A wrote:
>>>
>>> Implementation based on vectors are good idea.  It seems to me that this
>>> does not solve all problems. I would like to ask about the
>>> regex_constants::error_type how it's implemented? From the safety point
>>> of
>>> view the most important are error_space, error_stack and
>>> error_complexity.
>>> In documentation I've found
>>>
>>> error_complexity - the complexity of an attempted match against a regular
>>> expression exceeded a pre-set level
>>>
>>> How its implemented and where is exactly defined 'pre-set level'? Thanks
>>
>>
>> error_complexity is not used in our current implementation.
>
>
> P.S. your original mail was rejected by the list because the GCC lists
> only accept plain text email, please do not send html or multipart
> emails to the GCC lists.