diff --git a/src/builtin_string.cpp b/src/builtin_string.cpp
index a35903cbb..ab864e88d 100644
--- a/src/builtin_string.cpp
+++ b/src/builtin_string.cpp
@@ -792,8 +792,8 @@ public:
 
         uint32_t options = opts.all ? PCRE2_SUBSTITUTE_GLOBAL : 0;
         size_t arglen = wcslen(arg);
-        PCRE2_SIZE outlen = (arglen == 0) ? 16 : 2 * arglen;
-        wchar_t *output = (wchar_t *)malloc(sizeof(wchar_t) * outlen);
+        PCRE2_SIZE bufsize = (arglen == 0) ? 16 : 2 * arglen;
+        wchar_t *output = (wchar_t *)malloc(sizeof(wchar_t) * bufsize);
         if (output == 0)
         {
             DIE_MEM();
@@ -801,6 +801,7 @@ public:
         int pcre2_rc = 0;
         for (;;)
         {
+            PCRE2_SIZE outlen = bufsize;
             pcre2_rc = pcre2_substitute(
                             regex.code,
                             PCRE2_SPTR(arg),
@@ -816,10 +817,10 @@ public:
 
             if (pcre2_rc == PCRE2_ERROR_NOMEMORY)
             {
-                if (outlen < MAX_REPLACE_SIZE)
+                if (bufsize < MAX_REPLACE_SIZE)
                 {
-                    outlen = std::min(2 * outlen, MAX_REPLACE_SIZE);
-                    output = (wchar_t *)realloc(output, sizeof(wchar_t) * outlen);
+                    bufsize = std::min(2 * bufsize, MAX_REPLACE_SIZE);
+                    output = (wchar_t *)realloc(output, sizeof(wchar_t) * bufsize);
                     if (output == 0)
                     {
                         DIE_MEM();
diff --git a/tests/string.in b/tests/string.in
index 1c78e2b39..8afc97ff5 100644
--- a/tests/string.in
+++ b/tests/string.in
@@ -55,6 +55,8 @@ string replace -r '(\w+)\s+(\w+)' '$2 $1 $$' 'left right'
 
 string replace -r '\s*newline\s*' '\n' 'put a newline here'
 
+string replace -r -a '(\w)' '$1$1' ab
+
 # test some failure cases
 string match -r '[' 'a[sd' 2>/dev/null; or echo "invalid expression error"
 
diff --git a/tests/string.out b/tests/string.out
index 64b956e39..45ccb3692 100644
--- a/tests/string.out
+++ b/tests/string.out
@@ -41,6 +41,7 @@ spaces_to_underscores
 right left $
 put a
 here
+aabb
 invalid expression error
 invalid argument error
 missing argument returns 0