.@andreasdotorg Ragel's use of "==" is arguably bad, but the bug is in Cloudflare's use of its weird action language (missing "fhold").
-
-
-
This isn't about who's fault this is. It's about defense in depth.
-
wasn't assigning blame, but pointing out that a central issue is using Ragel's extra features to do fancy things.
-
This actually is an issue on top of another issue. No question.
End of conversation
New conversation -
-
-
@daveaitel The bug was apparently in misuse of the code generatorshttps://www.reddit.com/r/programming/comments/5vtv16/comment/de5ctmc?st=IZJY5ERL&sh=596ea38f … -
The code generator allowed misuse to be exploitable.
End of conversation
New conversation -
-
-
they moved to a newly written parser "cf-html" and the bug was introduced due to switching the parser https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ …
-
Read it again. The bug was always there. Introducing the new parser just meant it actually disclosed interesting data.
End of conversation
New conversation -
-
-
Not that clearcut with ragel. You put your C code, which can be unsafe, in Ragel blocks.https://github.com/PowerDNS/pdns/blob/master/pdns/dnslabeltext.rl …
-
In this specific case, no C code was involved, all just happened using Ragel primitives.
-
I see, thanks. However, Ragel still an odd mix of goto's and pointers. It is not a "safe language" it appears.
-
Not at all, no.
-
which is a shame, I was sort of hoping it was :-)
-
It's basically regex but with the ability to hook into the state machine. It's really weird and quite neat...
-
You don't have to use the C backend though, it knows how to generate other stuff. So it can be memory safe.
-
Still, it's really weird, and it's hard to come up with a good suggestion on when it's actually a good idea.
End of conversation
New conversation -
-
-
@daveaitel my understanding is the bug was something they wrote and was dutifully translated. -
It was something like "skip this token" in Ragelese. Documented you shouldn't do that, but why no bounds checks?
End of conversation
New conversation -
-
-
Would make a lovely case study for the workshop. Of course, it's not proven correct until it's proven correct :)
@maradydd -
Speaking of proven correct: my latest crush in terms of tools is F*. Highly recommended.
-
I'm currently experimenting with nom. Although I can't say I understand what goes on behind the scenes.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.