MFH: Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX)

NEWS

@@ -30,6 +30,10 @@ PHP                                                                        NEWS
   . Fixed bug #60968 (Late static binding doesn't work with 
     ReflectionMethod::invokeArgs()). (Laruence)
 
+- Array:
+  . Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX).
+    (Laruence)
+
 01 Mar 2012, PHP 5.4.0 
 
 - Installation:

ext/standard/array.c

@@ -1563,12 +1563,17 @@ PHP_FUNCTION(array_fill)
 	array_init_size(return_value, num);
 
 	num--;
-	zval_add_ref(&val);
 	zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL);
+	zval_add_ref(&val);
 
 	while (num--) {
-		zval_add_ref(&val);
-		zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == SUCCESS) {
+			zval_add_ref(&val);
+		} else {
+			zval_dtor(return_value);
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			RETURN_FALSE;
+		}
 	}
 }
 /* }}} */

ext/standard/tests/array/bug61058.phpt

@@ -0,0 +1,8 @@
+--TEST--
+Bug #61058 (array_fill leaks if start index is PHP_INT_MAX)
+--FILE--
+<?php 
+array_fill(PHP_INT_MAX, 2, '*');
+?>
+--EXPECTF--
+Warning: array_fill(): Cannot add element to the array as the next element is already occupied in %sbug61058.php on line %d