3 files changed, 36 insertions, 10 deletions
diff --git a/posix/bug-regex31.c b/posix/bug-regex31.c
index 2d5d6695d4..974e8603b9 100644
--- a/posix/bug-regex31.c
+++ b/posix/bug-regex31.c
@@ -3,14 +3,34 @@
 #include <stdio.h>
 #include <sys/types.h>
 
-int main()
+int
+main (void)
 {
- regex_t regex;
- int rc;
-
   mtrace ();
 
- if ((rc = regcomp (&regex, "([0]", REG_EXTENDED)))
-   printf ("Error %d (expected)\n", rc);
- return 0;
+  int res = 0;
+  char *buf = NULL;
+  size_t len = 0;
+  while (! feof (stdin))
+    {
+      ssize_t n = getline (&buf, &len, stdin);
+      if (n <= 0)
+	break;
+      if (buf[n - 1] == '\n')
+	buf[n - 1] = '\0';
+
+      regex_t regex;
+      int rc = regcomp (&regex, buf, REG_EXTENDED);
+      if (rc != 0)
+	printf ("%s: Error %d (expected)\n", buf, rc);
+      else
+	{
+	  printf ("%s: succeeded !\n", buf);
+	  res = 1;
+	}
+    }
+
+  free (buf);
+
+  return 0;
 }
diff --git a/posix/bug-regex31.input b/posix/bug-regex31.input
new file mode 100644
index 0000000000..eea961ccf5
--- /dev/null
+++ b/posix/bug-regex31.input
@@ -0,0 +1,3 @@
+([0]
+([0]a
+([0]([0])
diff --git a/posix/regcomp.c b/posix/regcomp.c
index 9f5ca2cd0e..4ee7b90ace 100644
--- a/posix/regcomp.c
+++ b/posix/regcomp.c
@@ -2164,12 +2164,15 @@ parse_branch (re_string_t *regexp, regex_t *preg, re_token_t *token,
 	}
       if (tree != NULL && exp != NULL)
 	{
-	  tree = create_tree (dfa, tree, exp, CONCAT);
-	  if (tree == NULL)
+	  bin_tree_t *newtree = create_tree (dfa, tree, exp, CONCAT);
+	  if (newtree == NULL)
 	    {
+	      postorder (exp, free_tree, NULL);
+	      postorder (tree, free_tree, NULL);
 	      *err = REG_ESPACE;
 	      return NULL;
 	    }
+	  tree = newtree;
 	}
       else if (tree == NULL)
 	tree = exp;
@@ -2420,7 +2423,7 @@ parse_sub_exp (re_string_t *regexp, regex_t *preg, re_token_t *token,
       if (BE (*err == REG_NOERROR && token->type != OP_CLOSE_SUBEXP, 0))
 	{
 	  if (tree != NULL)
-	    free_tree (NULL, tree);
+	    postorder (tree, free_tree, NULL);
 	  *err = REG_EPAREN;
 	}
       if (BE (*err != REG_NOERROR, 0))