Fix double free in array_reduce

return_value needs to be explicitly nulled out in the failure case.

Author: nikic

ext/standard/array.c

@@ -6057,7 +6057,7 @@ PHP_FUNCTION(array_reduce)
 		} else {
 			zval_ptr_dtor(&args[1]);
 			zval_ptr_dtor(&args[0]);
-			return;
+			RETURN_NULL();
 		}
 	} ZEND_HASH_FOREACH_END();