Sigh, another leak bites the dust. FREE_OP missing in case of a SEND_VAR.

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 48cd8502558bca3493e54f6bf1358aca614c04a6..e67dc0dabe9e47a06f5866c51f6de9e884e153e7 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1432,6 +1432,7 @@ overloaded_function_call_cont:
                                        varptr->refcount++;
                                        //zend_hash_next_index_insert_ptr(function_state.function_symbol_table, varptr, sizeof(zval *), NULL);
                                        zend_ptr_stack_push(&EG(argument_stack), varptr);
+                                       FREE_OP(&opline->op1, free_op1);  /* for string offsets */
                                }
                                break;
 send_by_ref: