Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Abstraction layers, such as a parser generator, create dependencies, which are a headache. They create a level of opaqueness and complexity that hinders review and complicates debugging. And perhaps most importantly, they complicate integration.

For example, often times you have a catch-22: you need to buffer chunks before feeding it to the engine. But how do you buffer and delineate the chunks? You still have to hand-roll some kind of parser. And sometimes you need to maintain parallel state, requiring the ability to access ad hoc state transitions during the parse to transform the data to your internal data structure.

Something like YACC would never work in a kernel context, because YACC requires specific patterns of buffering and control flow that are impermissible or impossible in the kernel, or at least in the context of a device driver.

One noteworthy exception to common issues with state machine generators is Ragel. Ragel is restartable and can be fed a stream byte-by-byte, yielding and resuming the machine between each byte. It uses no dynamic memory, and the state for a DFA is a single, non-static integer. Everything else is handled by user-defined C code which you embed within the machine definition. Ragel introduces zero integration problems, technically speaking. It can work with any control flow and I/O model--push, pull; blocking, non-blocking; buffered, unbuffered; etc.

But even with Ragel it often makes sense to break up the machine into several smaller machines, especially for heavily recursive structures. (Ragel supports these, but it really drives up the complexity). And those smaller machines are often so simple that the cost+benefit of something like Ragel is diminished.

Remember, there'll never be a perfect, bug-free solution. You have to balance the presumptive reduction in bugs with the added difficulty of discovering and fixing what bugs might remain. You need eyeballs to fix bugs, and the more complex and layered the system, the fewer eyeballs there'll be.

Anyhow, if people are incapable (for whatever reason: time, experience, laziness) to implement concise, explicit state machines using switch statements, which are quite easy to do with practice, how successful would be a solution which requires learning and applying a large and significant new set of skills and practices, a la a complex abstraction like a generator.