diff --git a/include/regex b/include/regex
index 1c4cc1d..5a6c7fb 100644
--- a/include/regex
+++ b/include/regex
@@ -4314,7 +4314,8 @@
         else if ('1' <= *__first && *__first <= '9')
         {
             unsigned __v = *__first - '0';
-            for (++__first; '0' <= *__first && *__first <= '9'; ++__first)
+            for (++__first;
+                    __first != __last && '0' <= *__first && *__first <= '9'; ++__first)
                 __v = 10 * __v + *__first - '0';
             if (__v > mark_count())
                 __throw_regex_error<regex_constants::error_backref>();
diff --git a/test/std/re/re.regex/re.regex.construct/bad_backref.pass.cpp b/test/std/re/re.regex/re.regex.construct/bad_backref.pass.cpp
new file mode 100644
index 0000000..aca4d67
--- /dev/null
+++ b/test/std/re/re.regex/re.regex.construct/bad_backref.pass.cpp
@@ -0,0 +1,44 @@
+//===----------------------------------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is dual licensed under the MIT and the University of Illinois Open
+// Source Licenses. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+// UNSUPPORTED: libcpp-no-exceptions
+// <regex>
+
+// template <class charT, class traits = regex_traits<charT>> class basic_regex;
+
+// template <class ST, class SA>
+//    basic_regex(const basic_string<charT, ST, SA>& s);
+
+#include <regex>
+#include <cassert>
+#include "test_macros.h"
+
+static bool error_badbackref_thrown(const char *pat)
+{
+    bool result = false;
+    try {
+        std::regex re(pat);
+    } catch (const std::regex_error &ex) {
+        result = (ex.code() == std::regex_constants::error_backref);
+    }
+    return result;
+}
+
+int main()
+{
+    assert(error_badbackref_thrown("\\1abc"));      // no references
+    assert(error_badbackref_thrown("ab(c)\\2def")); // only one reference
+
+//  this should NOT throw, because we only should look at the '1'
+//  See https://llvm.org/bugs/show_bug.cgi?id=31387
+    {
+    const char *pat1 = "a(b)c\\1234";
+    std::regex re(pat1, pat1 + 7); // extra chars after the end.
+    }
+}