Steps to reproduce:

1. Add such UserParemeter to agent's config file:

   UserParameter=leak[*],echo "some long string, the longer it is, the faster memory leaks $1"
   

2. Launch agent;
3. Execute zabbix_get in an infinite loop passing a string with suppressed characters (search for UnsafeUserParameters here) as a parameter:

   while true; do zabbix_get -s localhost -k leak[@]; done
   

4. Watch memory leaking (e.g. using proc.mem[,,,zabbix_agent.*listener,rss] and/or proc.mem[,,,zabbix_agent.*listener,data])

Neither replace_param() nor process() frees memory allocated for a part of the command before the first faulty positional parameter.