Go regexp too slow? I built coregex, a drop-in replacement. An audit found 16 bugs — here's what broke

说明与用途

Coregex 是 Go 语言 regexp 的替代品，审计后发现 16 个错误，包括错误匹配、Unicode 处理问题和 DoS 漏洞。修复后，差异率降至 0.75%，短字符串性能提升。

问题

Coregex, a drop-in replacement for Go's regexp, produced incorrect matches, performance regressions, and denial‑of‑service vulnerabilities after a code audit revealed 16 bugs.

结果

Coregex now correctly handles complex patterns, Unicode classes, and large inputs, with reduced divergence from the Go stdlib and improved performance on short strings.

工作流

• Commissioned independent code review and differential fuzz
• Identified 6% divergence and 16 bugs
• Analyzed each bug: branch‑dispatch, case‑insensitive Cyrillic, large‑input Unicode class, empty‑match UTF‑8 slicing, 15‑char DoS
• Implemented fixes: removed branch‑dispatch, used SimpleFold orbit, corrected reverse DFA fallback, fixed empty‑match advancement, removed Sub0 clone loop
• Re‑ran differential fuzz: divergence 0.75%
• Documented remaining issues and tracked them

证据

6% of random pattern/input pairs gave wrong answers.

来源

BranchDispatch optimization dispatched by first byte, then verified the match with a simple matcher that couldn't handle real AST shapes.

来源

Non-ASCII runes with case-insensitive flag were compiled as exact uppercase match.

来源

\pL+ on a 50KB file: MatchString returned true, but FindAllStringIndex returned zero or one match instead of thousands.

来源

After an empty match, the position advanced by one byte instead of one rune.

来源

15-character pattern caused >3 GB heap, >15 seconds, OOM kill.

来源