Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mrabarnett/mrab-regex
hg @ b283bb2
3
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Denial of Service: 1 prior fix. Scrutinize any change in this area.
regex_2/regex/_regex.c: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Corruption: Uninitialized state->req_pos leads to out-of-bounds reads/writes in findall/finditer, a classic memory-corruption primitive that can be exploited for RCE or info leak.
Race Condition: Non-atomic access to pattern storage caches (stack_storage, groups_storage, repeats_storage) during concurrent regex operations can corrupt memory. The fix uses atomic operations, indicating a fundamental concurrency design flaw.
Denial of Service: Recursive add_repeat_guards can cause stack overflow with crafted large patterns, leading to DoS. The fix converts recursion to iteration, showing that pattern-size-dependent recursion is a risk.