Re: [pcre-dev] Calling pcre_dfa_exec on expressions with bac…

Startseite
Nachricht löschen
Autor: Bogdan Harjoc
Datum:  
To: pcre-dev
Betreff: Re: [pcre-dev] Calling pcre_dfa_exec on expressions with backreferences
On Mon, Dec 12, 2011 at 9:19 PM, Philip Hazel <ph10@???> wrote:

> There is a pcre_fullinfo facility for finding the number of capturing
> parentheses in a pattern (check out PCRE_INFO_CAPTURECOUNT). If this
> number is zero, you can be sure there are no back references (because
> there's nothing that can be referenced).
>


Pcre_fullinfo does work, thank you. And PCRE_ERROR_DFA_UITEM is properly
returned as well.

I'm a bit surprised to learn the pcre_dfa_exec runs faster than
> pcre_exec on any patterns; usually it is the other way round.
> And as Zoltan says, using JIT is sure to be much faster than either of
> them.
>


Out of snort's 1031 http rules, only 15 run faster using pcre_exec.

I'm considering using sljit, but unfortunately it doesn't handle partial
matching yet.

Regards,
Bogdan