ping @monnerat, would you mind taking a look? You fixed it up recently, maybe you have a good idea on how this can be improved...

would you mind taking a look?

I'm quite busy right now, but I'll do some profiling on it ASAP and report here.
I can already imagine this is probably caused by backtracking for the * processing (even if you have limited occurrences to 5). Code profiling will tell us more.

Your attached patch shows empty here... without patch, runtest.pl 1307 takes less than a second here. If not yet to be disclosed, you can send this patch to my perso e-mail :-)

curl -L https://github.com/curl/curl/files/1699088/0001-unit1307-add-test-that-takes-too-long-time-to-execut.patch.txt

... works for me!

... works for me!

Strange: can get it with curl, but FF does not show it :-(

Now that I can see it, I have a straightforward explanation: this is a pathological case!
There are 3 recursivity levels, always failing at the end of string. In addition, the current algorithm tries to match (recursively) the ?s with each string character; * regrouping is not performed because they are separated by the ?s.

I think I can develop a patch for this particular case, but we can think of other pathological cases, like
"*[A-Z]*[A-Z]*[[:blank:]]", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

IMHO, the only way to avoid them is to compile the pattern into a Deterministic Finite Automaton first, then apply this DFA to the string. The drawbacks are: bigger code, possible more time consumed in non-pathological cases and possible high memory needs depending on the pattern. By using such a DFA, backtracking is never needed. But maybe this is a bit "overthought" for such an insignifiant function ...?

I'll submit a PR with a fix for the "*?*?*" case.

a pathological case

That's certainly not an understatement. The result of the fuzzer throwing crazy input at our APIs.

I did not include your patch in a0984ea. I let you do it in case you want to refine it.

Thanks, yes you did right. I'll see if I can brush it up a little and commit it separately.