Free operand when encountering unmatched ')' in (?[])

I only need to free the operand (current), not the left-paren token
that turns out not to be a paren (lparen).

For lparen to leak, there would have to be two operands in a row on
the charclass parsing stack, which currently never happens.

(cherry picked from commit 4bc5d08976b7df23b63a56cc017a20ac5766fbbc)

2 files changed, 3 insertions, 1 deletions

diff --git a/regcomp.c b/regcomp.c
index cbfb19efad..befe078579 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -11901,6 +11901,7 @@ S_handle_regex_sets(pTHX_ RExC_state_t *pRExC_state, SV** return_invlist, I32 *f
                     || IS_OPERAND(lparen)
                     || SvUV(lparen) != '(')
                 {
+                    SvREFCNT_dec(current);
                     RExC_parse++;
                     vFAIL("Unexpected ')'");
                 }
diff --git a/t/op/svleak.t b/t/op/svleak.t
index 0fb6b240ed..c8e0354471 100644
--- a/t/op/svleak.t
+++ b/t/op/svleak.t
@@ -15,7 +15,7 @@ BEGIN {
 
 use Config;
 
-plan tests => 122;
+plan tests => 123;
 
 # run some code N times. If the number of SVs at the end of loop N is
 # greater than (N-1)*delta at the end of loop 1, we've got a leak
@@ -248,6 +248,7 @@ eleak(2,0,'no warnings; /(?[[a]|[b]])/');
 eleak(2,0,'no warnings; /(?[[a]^[b]])/');
 eleak(2,0,'no warnings; /(?[![a]])/');
 eleak(2,0,'no warnings; /(?[\p{Word}])/');
+eleak(2,0,'no warnings; /(?[[a]+)])/');
 
 # These can generate one ref count, but just  once.
 eleak(4,1,'chr(0x100) =~ /[[:punct:]]/');