From: Antony Dovgal <tony2001@php.net>
Date: Thu, 23 Dec 2004 16:35:48 +0000 (+0000)
Subject: destroy return_value and fix leak in array_fill()
X-Git-Tag: RELEASE_0_2~478
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=38d8e20f68234e7fdf2256327747e05e4b942bb2;p=php

destroy return_value and fix leak in array_fill()
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 587fc92b16..93b9cd28ff 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1542,6 +1542,8 @@ PHP_FUNCTION(array_fill)
 	convert_to_long_ex(num);
 	i = Z_LVAL_PP(num) - 1;	
 	if (i < 0) {
+		zend_hash_destroy(Z_ARRVAL_P(return_value));
+		efree(Z_ARRVAL_P(return_value));
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of elements must be positive");
 		RETURN_FALSE;
 	}