Author: Bogdan Harjoc Date: To: pcre-dev Subject: Re: [pcre-dev] Calling pcre_dfa_exec on expressions with
backreferences
On Mon, Dec 12, 2011 at 9:19 PM, Philip Hazel <ph10@???> wrote:
> There is a pcre_fullinfo facility for finding the number of capturing
> parentheses in a pattern (check out PCRE_INFO_CAPTURECOUNT). If this
> number is zero, you can be sure there are no back references (because
> there's nothing that can be referenced).
>
Pcre_fullinfo does work, thank you. And PCRE_ERROR_DFA_UITEM is properly
returned as well.
I'm a bit surprised to learn the pcre_dfa_exec runs faster than > pcre_exec on any patterns; usually it is the other way round.
> And as Zoltan says, using JIT is sure to be much faster than either of
> them.
>
Out of snort's 1031 http rules, only 15 run faster using pcre_exec.
I'm considering using sljit, but unfortunately it doesn't handle partial
matching yet.
