- Try to fix the leak Rasmus reported. It's pretty sucky code so I'm really

  not sure this fix is OK.I can't remember all of what we did there.

1 files changed, 8 insertions, 5 deletions

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 19b95849cd..a77e4668b4 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -256,22 +256,25 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
 					if (T->EA.str->type == IS_STRING
 						&& (T->EA.offset < T->EA.str->value.str.len)) {
 						zval tmp;
+						zval *final_value = value;
 
 						if (value->type!=IS_STRING) {
 							tmp = *value;
-							zval_copy_ctor(&tmp);
+							if (op2 && op2->op_type == IS_VAR) {
+								zval_copy_ctor(&tmp);
+							}
 							convert_to_string(&tmp);
-							value = &tmp;
+							final_value = &tmp;
 						}
 
-						T->EA.str->value.str.val[T->EA.offset] = value->value.str.val[0];
+						T->EA.str->value.str.val[T->EA.offset] = final_value->value.str.val[0];
 						if (op2
 							&& op2->op_type == IS_VAR
 							&& value==&Ts[op2->u.var].tmp_var) {
 							efree(value->value.str.val);
 						}
-						if (value == &tmp) {
-							zval_dtor(value);
+						if (final_value == &tmp) {
+							zval_dtor(final_value);
 						}
 						/*
 						 * the value of an assignment to a string offset is undefined