Thanks for the issue.

I don't think it's possible to add a timeout option (without bringing in external dependencies, which I won't do), so I'll probably address this in two ways:

1. Add a compile-time option to disable the functions that use loops (fac, ncr, npr, possibly others).
2. Document it in the readme.

Well, it would be possible to add a timeout, albeit not in a very nice way. You could make a tick function which calls time() and compares it to a start time, then bails if the elapsed time is greater than a timeout, then sprinkle in calls to tick() in strategic locations throughout the code. For example, you could call tick() at the top of te_eval and every nth iteration in the loop-based functions.

The balance between performance and accuracy would be super hard to get right, but it would be a useful feature.

The cause seems to be ncr(NAN, 1), which goes into pathologically slowly advancing loop for some reason.

Printing the values with %lu format just before the loop, I got:

un = 0
ur = 18446744073709551615

Seeing, that the project is now using c99, isnan should be available, so checking the nan should be reasonable mitigation on this issue. I opened a PR #82 adding those.

@codeplea it would be great to see this bug finally fixed via @juntuu 's #82 after 4+ years.

This will also help with @DavidKorczynski 's efforts for #114, since the GitHub fuzzing action jobs will otherwise spend a lot of time on timeouts.

Basic reproducer based on example.c, can be used under the project's zlib license:

#include <stdio.h>
#include <stdint.h>
#include <string.h>

#include "tinyexpr.h"

int main(int argc, char *argv[])
{
    const char *c = "ncr(ncr(2,7),1)";
    double r = te_interp(c, 0);
    printf("the execution of this calculation should be slow");
    return 0;
}

For completeness, here is the fuzzer harness code I used to find the issue:

#include <stdio.h>
#include <stdint.h>
#include <string.h>

#include "tinyexpr.h"

#define FUZZER_MAX_INPUT_LENGTH 512

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
  
    if(size > FUZZER_MAX_INPUT_LENGTH) {
      return 0;
    }

    char inputbuffer[FUZZER_MAX_INPUT_LENGTH + 1] = {0};
    memcpy(inputbuffer, data, size);
    // null-terminate
    inputbuffer[size] = 0;
    
    // call target
    double r = te_interp(inputbuffer, 0);
    
    return 0;
}

I also make this available under zlib license so it can be used in the project.

Compared with the fuzzer harness proposed in #114, it has a restricted max length through fixed stack buffer usage (-> less heap allocations), and doesn't pre-define expression variables. Otherwise it's fairly similar.