- Should fix the pass by reference problem. This happened because we moved

 start from arg 1 now and not arg 0. There might be more places which need fixing
 like in the executor but the bug seems OK now.

Author: Andi Gutmans

Zend/zend_compile.c

@@ -657,15 +657,15 @@ void do_receive_arg(int op, znode *var, znode *offset, znode *initialization, un
 	if (pass_type==BYREF_FORCE && !CG(active_op_array)->arg_types) {
 		int i;
 
-		CG(active_op_array)->arg_types = (unsigned char *) emalloc(sizeof(unsigned char)*(offset->u.constant.value.lval+2));
-		for (i=1; i<=offset->u.constant.value.lval; i++) {
+		CG(active_op_array)->arg_types = (unsigned char *) emalloc(sizeof(unsigned char)*(offset->u.constant.value.lval+1));
+		for (i=1; i<offset->u.constant.value.lval; i++) {
 			CG(active_op_array)->arg_types[i] = BYREF_NONE;
 		}
 		CG(active_op_array)->arg_types[0]=(unsigned char) offset->u.constant.value.lval;
 	}
 	if (CG(active_op_array)->arg_types) {
-		CG(active_op_array)->arg_types = (unsigned char *) erealloc(CG(active_op_array)->arg_types, sizeof(unsigned char)*(offset->u.constant.value.lval+2));
-		CG(active_op_array)->arg_types[offset->u.constant.value.lval+1] = pass_type;
+		CG(active_op_array)->arg_types = (unsigned char *) erealloc(CG(active_op_array)->arg_types, sizeof(unsigned char)*(offset->u.constant.value.lval+1));
+		CG(active_op_array)->arg_types[offset->u.constant.value.lval] = pass_type;
 		CG(active_op_array)->arg_types[0]++;
 	}
 }