diff --git a/ChangeLog b/ChangeLog
index a6ce1bd..367a987 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Thu Sep 15 15:08:21 CEST 2005 Daniel Veillard <daniel@veillard.com>
+
+	* xmlregexp.c: detect combinatory explosion and return with
+	  a runtime error in those case, c.f. #316338 though maybe we
+	  should not see such an explosion with that specific regexp,
+	  more checking needs to be done.
+
 Wed Sep 14 19:52:18 CEST 2005 Kasimier Buchcik <libxml2-cvs@cazic.net>
 
 	* include/libxml/schemasInternals.h: Added some comments for the
diff --git a/xmlregexp.c b/xmlregexp.c
index 45b917b..9d47921 100644
--- a/xmlregexp.c
+++ b/xmlregexp.c
@@ -42,6 +42,8 @@
 /* #define DEBUG_PUSH */
 /* #define DEBUG_COMPACTION */
 
+#define MAX_PUSH 100000
+
 #define ERROR(str)							\
     ctxt->error = XML_REGEXP_COMPILE_ERROR;				\
     xmlRegexpErrCompile(ctxt, str);
@@ -326,6 +328,7 @@
     xmlRegStatePtr errState;    /* the error state */
     xmlChar *errString;		/* the string raising the error */
     int *errCounts;		/* counters at the error state */
+    int nbPush;
 };
 
 #define REGEXP_ALL_COUNTER	0x123456
@@ -2336,6 +2339,12 @@
     xmlFARegDebugExec(exec);
     exec->transno--;
 #endif
+#ifdef MAX_PUSH
+    if (exec->nbPush > MAX_PUSH) {
+        return;
+    }
+    exec->nbPush++;
+#endif
 
     if (exec->maxRollbacks == 0) {
 	exec->maxRollbacks = 4;
@@ -2426,6 +2435,7 @@
 
     exec->inputString = content;
     exec->index = 0;
+    exec->nbPush = 0;
     exec->determinist = 1;
     exec->maxRollbacks = 0;
     exec->nbRollbacks = 0;
@@ -2632,8 +2642,11 @@
 	xmlFree(exec->counts);
     if (exec->status == 0)
 	return(1);
-    if (exec->status == -1)
+    if (exec->status == -1) {
+	if (exec->nbPush > MAX_PUSH)
+	    return(-1);
 	return(0);
+    }
     return(exec->status);
 }
 
@@ -2708,6 +2721,7 @@
     exec->inputStack = NULL;
     exec->errStateNo = -1;
     exec->errString = NULL;
+    exec->nbPush = 0;
     return(exec);
 }