Fixed but #29437 (Possible crash inside array_walk_recursive()).

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 84625ca71c686f61da29fbf7daa07828ee0237ee..5ee9796357d342d35a04fa208db45dd60caa27c6 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -996,7 +996,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 {
        zval **args[3],                 /* Arguments to userland function */
                  *retval_ptr,                  /* Return value - unused */
-                 *key;                         /* Entry key */
+                 *key=NULL;                            /* Entry key */
        char  *string_key;
        uint   string_key_len;
        ulong  num_key;
@@ -1060,7 +1060,10 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
                        }
                }
 
-               zval_ptr_dtor(&key);
+               if (key) {
+                       zval_ptr_dtor(&key);
+                       key = NULL;
+               }
                zend_hash_move_forward_ex(target_hash, &pos);
        }