Re: [Chicken-users] Last two snapshots (3.3.5 and 3.3.6) are broken

[felix winkelmann]

On Sat, Aug 2, 2008 at 3:24 AM, Ivan Raikov <address@hidden> wrote:
>
>   Your point about bundled pcre is well-taken, and in fact the Debian
> package is also built with USE_HOST_PCRE=1 for precisely that
> reason. Unfortunately, some older Debian distributions still use pcre
> 6.x, whose header file is missing some definitions used by the regex
> unit in Chicken, so it is not always possible to use host pcre. I am
> actually in favor of dropping the use of pcre altogether, and adopting
> Alex Shinn's irregex library in the Chicken core, because
> "Perl-compatible" regular expressions are full of godawful hacks, and
> because the pcre library itself is an overflow vulnerability waiting
> to happen [1]. That is usually the case with large, complex C
> libraries, and I think it is a bad idea in general to include
> third-party C code in core Chicken.
>

Generally I'm of the opinion not to use installed libraries to avoid
versioning problems. This is an endless source of trouble, as
todays UNIX systems (especially Linux) are a patchwork of libraries and it is
practically impossible to make any sort of assumption about what is
installed and whether it is compatible to our expectations. Now I do
see that in a well-maintained system that uses whatever package
system consistently (and provided that the installation is clean and
that the user doesn't upgrade like mad, as is practice on Gentoo
systems for example. Personally I do not upgrade an installed
system unless there is no other choice, but that's just how I
see this matter).

I agree that this big pile of foreign code in the souce tree stands
somewhat out and doesn't fit in too well. Actually, using irregex
is really an option, but both performance and stability has to
be evaluated thoroughly before committing to such a decision.


cheers,
felix