Re: [pcre-dev] CVE-2008-2371

> 17. I have done a major re-factoring of the way pcre_compile() computes 
> the
>    amount of memory needed for a compiled pattern. Previously, there was 
> code
>    that made a preliminary scan of the pattern in order to do this. That 
> was
>    OK when PCRE was new, but as the facilities have expanded, it has 
> become
>    harder and harder to keep it in step with the real compile phase, and 
> there
>    have been a number of bugs (see for example, 4 above). I have now found 
> a
>    cunning way of running the real compile function in a "fake" mode that
>    enables it to compute how much memory it would need, while actually 
> only
>    ever using a few hundred bytes of working memory and without too many
>    tests of the mode. This should make future maintenance and development
>    easier. A side effect of this work is that the limit of 200 on the 
> nesting
>    depth of parentheses has been removed (though this was never a serious
>    limitation, I suspect). However, there is a downside: pcre_compile() 
> now
>    runs more slowly than before (30% or more, depending on the pattern). I
>    hope this isn't a big issue. There is no effect on runtime performance.