3 ms·
I was hoping for some alternative since the linked article mentions utf8proc as such: > Some libraries, like libutf8proc and libunistring, are incorrect by bas
by HexDecOctBin 4y ago
I was hoping for some alternative since the linked article mentions utf8proc as such:
> Some libraries, like libutf8proc and libunistring, are incorrect by basing their API on assumptions that haven't been true for years (e.g. offering stateless grapheme cluster segmentation even though the underlying algorithm is not stateless). As an additional factor, libutf8proc's UTF-8-decoder is unsafe, as it allows overlong encodings that can be easily used for exploits.
- rockwotj 4y agoThere is a stateful API too, and I'm surprised they mention it's decoder is unsafe, utf8proc is fuzzed by oss fuzz, which I assume would catch something like that.