Re: limiting regex scanning

On Wed, 1 Dec 2004 12:45:47 -0600 (CST) John Jetmore <[email protected]> wrote:

> On Wed, 1 Dec 2004, Philip Chambers wrote:
> 
> > That means checking just the first few chracters of the base64 data.  If I use
> > 
> >   regex = ^UEsDB....[Q-Za-fw-z0-9\+/]
> > 
> > then all of each attachment will be scanned, with the corresponding CPU usage.
> 
> I don't know much about the guts of libpcre, but there aren't any 
> quantifiers in that RE, so why would the engine need to scan anything more 
> than the first 10 chars in the string?
> 
> The only possible thing might be that ^ matches at each \n, but looking at 
> the perlre man page that should only happen if the m modifier is 
> specified, which you haven't done.  If for some reason it behaves that way 
> by default in exim, try replacing ^ with \A, which should only ever match 
> at the beginning of the string.
> 
> --John

I don't know the details of libpcre either, nor the way that it is used in exiscan.  
I had been assuming that it would scan the whole attachment, trying the match at 
each \n.

I was not aware of the \A feature in regex.  Having looked into it it seems to be 
just what I need, so thanks very much for that. I have just tried it and initial 
tests look good. I will try some tests to see what the CPU usage looks like.

Phil.
---------------------------------------
Phil Chambers ([email protected])
University of Exeter