MFH: destroy return_value and fix leak in array_fill()

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 6b8798d0eb9e2ec57e957818c21f5cfb41d12b22..21c7db4e6f6224a4e95bb506862c566e5e5707f1 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1414,6 +1414,8 @@ PHP_FUNCTION(array_fill)
        convert_to_long_ex(num);
        i = Z_LVAL_PP(num) - 1; 
        if (i < 0) {
+               zend_hash_destroy(Z_ARRVAL_P(return_value));
+               efree(Z_ARRVAL_P(return_value));
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of elements must be positive");
                RETURN_FALSE;
        }