Re: [Boost-users] [regex] Mitigating mischief and malice

Subject: Re: [Boost-users] [regex] Mitigating mischief and malice
From: John Maddock (boost.regex_at_[hidden])
Date: 2011-02-28 03:40:52

> Say you wanted to give web users a boost::regex interface to a set of
> data, knowing that some will try to use it for mischief and malice. I'm
> vaguely aware that one can write a regex to consume lots of CPU
> (denial-of-service attack), but also lots of stack and/or memory.

Boost.Regex has two protections against that:

* When BOOST_REGEX_NON_RECURSIVE is defined (the default for all current 
compilers) then memory usage is strictly limited.  This can be configured in 
boost/regex/user.hpp since the maximum amount of memory used is 
BOOST_REGEX_MAX_BLOCKS*BOOST_REGEX_BLOCKSIZE, which defaults to 4Mb in 
total.
* The total number of machine states visited (and hence CPU time consumed) 
is controlled by perl_matcher::estimate_max_state_count, the macro 
BOOST_REGEX_MAX_STATE_COUNT sets an upper limit on the number of states 
visited.

HTH, John.