MFH: destroy return_value and fix leak in array_fill()

diff --git a/ext/standard/array.c b/ext/standard/array.c
index efe26cdec6252c6d7635c85152167525898a8b39..854247c3c607bda781c817d3269ca9785a17f672 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1510,6 +1510,8 @@ PHP_FUNCTION(array_fill)
        convert_to_long_ex(num);
        i = Z_LVAL_PP(num) - 1; 
        if (i < 0) {
+               zend_hash_destroy(Z_ARRVAL_P(return_value));
+               efree(Z_ARRVAL_P(return_value));
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of elements must be positive");
                RETURN_FALSE;
        }