destroy return_value and fix leak in array_fill()

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 587fc92b163abb4003b44727060d1d8fd6ac1fdc..93b9cd28ff3f488099a0818ef18d898e37f50a3d 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1542,6 +1542,8 @@ PHP_FUNCTION(array_fill)
        convert_to_long_ex(num);
        i = Z_LVAL_PP(num) - 1; 
        if (i < 0) {
+               zend_hash_destroy(Z_ARRVAL_P(return_value));
+               efree(Z_ARRVAL_P(return_value));
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of elements must be positive");
                RETURN_FALSE;
        }