Fix return-by-ref from array_reduce callback

Fixes oss-fuzz #32990.

Author: nikic

ext/standard/array.c

@@ -5877,6 +5877,9 @@ PHP_FUNCTION(array_reduce)
 			zval_ptr_dtor(&args[1]);
 			zval_ptr_dtor(&args[0]);
 			ZVAL_COPY_VALUE(return_value, &retval);
+			if (UNEXPECTED(Z_ISREF_P(return_value))) {
+				zend_unwrap_reference(return_value);
+			}
 		} else {
 			zval_ptr_dtor(&args[1]);
 			zval_ptr_dtor(&args[0]);

ext/standard/tests/array/array_reduce_return_by_ref.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Return by reference from array_reduce() callback
+--FILE--
+<?php
+$array = [1, 2];
+var_dump(array_reduce($array, function &($a, $b) {
+    return $b;
+}, 0));
+?>
+--EXPECT--
+int(2)