Improved fix for #61058, and add test script

1 files changed, 7 insertions, 6 deletions

diff --git a/ext/standard/array.c b/ext/standard/array.c
index bd7d125eba..7af2f44b60 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1563,15 +1563,16 @@ PHP_FUNCTION(array_fill)
 	array_init_size(return_value, num);
 
 	num--;
+	zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL);
 	zval_add_ref(&val);
-	if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, sizeof(zval *), NULL) == FAILURE) {
-		zval_ptr_dtor(&val);
-	}
 
 	while (num--) {
-		zval_add_ref(&val);
-		if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == FAILURE) {
-			zval_ptr_dtor(&val);
+		if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, sizeof(zval *), NULL) == SUCCESS) {
+			zval_add_ref(&val);
+		} else {
+			zval_dtor(return_value);
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			RETURN_FALSE;
 		}
 	}
 }