Fix double free in array_reduce

return_value needs to be explicitly nulled out in the failure case.

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 14ff138004748021f1dab52c8f9a984fc575ff3d..3624881c4c7ae9c298506776ba4c4a717cdb67a3 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -6057,7 +6057,7 @@ PHP_FUNCTION(array_reduce)
                } else {
                        zval_ptr_dtor(&args[1]);
                        zval_ptr_dtor(&args[0]);
-                       return;
+                       RETURN_NULL();
                }
        } ZEND_HASH_FOREACH_END();