Fixed memory allocation bugs in array_reduce() with initial value (#22463 & #24980)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 482803019b455c699024aea9e21d252751d03f8d..2e0909633f6528a77c051c61fffc68029558ce0e 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4000,8 +4000,11 @@ PHP_FUNCTION(array_reduce)
        efree(callback_name);
 
        if (ZEND_NUM_ARGS() > 2) {
-               convert_to_long_ex(initial);
-               result = *initial;
+               ALLOC_ZVAL(result);
+               *result = **initial;
+               zval_copy_ctor(result);
+               convert_to_long(result);
+               INIT_PZVAL(result);
        } else {
                MAKE_STD_ZVAL(result);
                ZVAL_NULL(result);
@@ -4015,7 +4018,7 @@ PHP_FUNCTION(array_reduce)
        
        if (zend_hash_num_elements(htbl) == 0) {
                if (result) {
-                       RETVAL_ZVAL(result, 1, 0);
+                       RETVAL_ZVAL(result, 1, 1);
                }
                return;
        }