Ring Around The Regex: Lessons learned from fuzzing regex libraries

A two-part blog series posted on secret.club . Part 1 concerns the regex crate from Rust, investigating how limitations of original harnesses prevented the discovery of bugs which were shallow under grammar testing. We then discuss how the replacement was also limited, and introduce the concept of the data reinterpretation problem. Part 2 concerns PCRE2 , likely the most widely-used regex library.…