Description:
------------
There appears to be a fairly severe low-level memory leak in the PHP string parser that occurs when variables included inline with strings are expanded out to their values.

This seems to be causing large scale memory leakage on long scripts (ie: CLI type ones that run for a while) in various PEAR modules, and other countless third party programs.

Took me a while to narrow down what looked like a DB issue to this :)

I have replicated this in PHP 4.3.6 and 4.3.7 with both CLI and dynamic module SAPIs.

Configure info:
----------------------------
 './configure' '--with-mysql' '--with-pgsql' '--enable-track-vars' '--with-gd' '--with-jpeg-dir=/usr' '--with-png-dir=/usr' '--with-zlib=/usr' '--with-xmlrpc' '--with-xml' '--enable-exif' '--with-gettext' '--with-imap' '--enable-ftp' '--with-mcrypt' '--with-ldap' '--enable-sockets' '--enable-memory-limit' '--with-mcal=/usr' '--with-dom' '--with-curl' '--enable-force-cgi-redirect' '--with-expat-dir=/usr' '--with-freetype-dir=/usr' '--enable-simplexml'
----------------------------

As you can see by the code below (neatness somewhat ruined to fit in the 20 line limit), in every iteration of the loop (and subsequent call of the *leakMemory() functions), the $discardString should be constructed, then go out of scope and release the memory.

In the case where inline variable substitution is used, the memory appears to get eaten, and never given back. In the example, only 320 bytes are being used per iteration, but in a complex system, with many calls made (ie: PEAR::DB type stuff), I've seen up to 200KB or so used per call.

If someone could have a look at this, it would be really appreciated. It's causing me some pain at the moment :)

Thanks very much,

  Fenn.

Reproduce code:
---------------
$string1 = "string1"; $string2 = "string2";
function noLeakMemory() {
    global $string1, $string2;
    $discardString = "string1 " . $string1 . " string2 " . $string2;
}
function leakMemory() {
    global $string1, $string2;
    $discardString = "string1 $string1 string2 $string2";
}
for ($loop = 0; $loop < 10; $loop ++) {
    for ($innerLoop = 0; $innerLoop < 10; $innerLoop ++) {
        noLeakMemory();
    }
    print "Memory usage (no leak): " . memory_get_usage() . "\n";
}
for ($loop = 0; $loop < 10; $loop ++) {
    for ($innerLoop = 0; $innerLoop < 10; $innerLoop ++) {
        leakMemory();
    }
    print "Memory usage (leak): " . memory_get_usage() . "\n";
}


Expected result:
----------------
What should be output (approx):
------------------
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (leak): 33048
Memory usage (leak): 33048
Memory usage (leak): 33048
Memory usage (leak): 33048
Memory usage (leak): 33048
Memory usage (leak): 33048
Memory usage (leak): 33048
Memory usage (leak): 33048
Memory usage (leak): 33048
Memory usage (leak): 33048
------------------

Actual result:
--------------
Output for script looks like this for me:
------------------
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (no leak): 32728
Memory usage (leak): 33048
Memory usage (leak): 33368
Memory usage (leak): 33688
Memory usage (leak): 34008
Memory usage (leak): 34328
Memory usage (leak): 34648
Memory usage (leak): 34968
Memory usage (leak): 35288
Memory usage (leak): 35608
Memory usage (leak): 35928
------------------