From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 8 Jun 2005 19:54:24 +0000 (+0000)
Subject: Fixed memory allocation bugs in array_reduce() with initial value (#22463 & #24980)
X-Git-Tag: php-5.0.1b1~35
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=72c6d5cbafc949312f2b8e26ac195c2135119dc3;p=php

Fixed memory allocation bugs in array_reduce() with initial value (#22463 & #24980)
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 482803019b..2e0909633f 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4000,8 +4000,11 @@ PHP_FUNCTION(array_reduce)
 	efree(callback_name);
 
 	if (ZEND_NUM_ARGS() > 2) {
-		convert_to_long_ex(initial);
-		result = *initial;
+		ALLOC_ZVAL(result);
+		*result = **initial;
+		zval_copy_ctor(result);
+		convert_to_long(result);
+		INIT_PZVAL(result);
 	} else {
 		MAKE_STD_ZVAL(result);
 		ZVAL_NULL(result);
@@ -4015,7 +4018,7 @@ PHP_FUNCTION(array_reduce)
 	
 	if (zend_hash_num_elements(htbl) == 0) {
 		if (result) {
-			RETVAL_ZVAL(result, 1, 0);
+			RETVAL_ZVAL(result, 1, 1);
 		}
 		return;
 	}