Re: two vulns in uClibc-0.9.33.2

[Michal Zalewski <lcamtuf () coredump cx>]

> Does it make sense to assign CVEs to regex compilation? Very few toolkits
> handle this well, and even given how many regex toolkits use backtracking,
> even 'safe' regexes can lead to essentially unbounded execution time.

One use case are "sandbox" languages, such as JavaScript. JS engines
often use third-party regex libraries with attacker-controlled
regexes. They don't particularly about OOM / CPU exhaustion, but RCE
that allows a malicious program to escape containment would be bad
news.

Probably no JS engine using uclibc, though.

/mz