This bug is an obvious pasto in parse_bracket_exp:

$ export LANG=C ; echo test123test | sed -e 's/[[:number:]]//g'
sed: -e expression #1, char 18: Memory exhausted

(of course it should have been [[:digit:]]).  build_charclass
returns REG_ECTYPE in that case.

Paolo

--- devel-sed-stable/lib/regcomp.c	2003-06-17 23:43:21.000000000 +0200
+++ devel-sed/lib/regcomp.c	2003-09-19 14:39:29.000000000 +0200
@@ -2904,13 +2904,13 @@
 		goto parse_bracket_exp_free_return;
 	      break;
 	    case CHAR_CLASS:
-	      ret = build_charclass (sbcset,
+	      *err = build_charclass (sbcset,
 #ifdef RE_ENABLE_I18N
 				     mbcset, &char_class_alloc,
 #endif /* RE_ENABLE_I18N */
 				     start_elem.opr.name, syntax);
-	      if (BE (ret != REG_NOERROR, 0))
-	       goto parse_bracket_exp_espace;
+	      if (BE (*err != REG_NOERROR, 0))
+	       goto parse_bracket_exp_free_return;
 	      break;
 	    default:
 	      assert (0);