deepclone_to_array: fix UAF on ref pointers across packed→hash conversion

dc_copy_array stashes pointers into dst's HT in ref_entry->tree_pos
for later dtor/replacement. But dst was initialized as an empty packed
HT, and the first add_new() on a string key triggers
zend_hash_packed_to_hash() — which frees the packed storage. Any
tree_pos saved by an earlier (integer-keyed) iteration from this array
now dangles, and the post-processing pass hits a heap-use-after-free
when dtoring through it.

Fix: force mixed/hash storage on dst and mask_dst before the loop, so
the first and all subsequent add_new() calls write into a stable
arData that won't be realloc'd out from under saved tree_pos pointers.

Found by libFuzzer (to_array round-trip harness + ASAN) — reproduced
with a 9-byte input that builds an array containing a ref and then
adds a string key via convert_to_string on a SplFixedArray key.

Author: nicolas-grekas

deepclone.c

@@ -909,6 +909,13 @@ static void dc_copy_array(dc_ctx *ctx, HashTable *src_ht, zval *dst, zval *mask_
 		return;
 	}
 
+	/* Force hash (mixed) storage up front. dc_copy_value on a reference
+	 * stashes new_dst_slot in ref_entry->tree_pos; if the first insert here
+	 * transitioned dst from packed to hash mode, the later zend_hash_add_new
+	 * would free the packed storage and leave that tree_pos dangling. */
+	zend_hash_real_init_mixed(Z_ARRVAL_P(dst));
+	zend_hash_real_init_mixed(Z_ARRVAL_P(mask_dst));
+
 	ZEND_HASH_FOREACH_KEY_VAL(src_ht, idx, key, src_val) {
 		zval undef, null_marker;
 		ZVAL_UNDEF(&undef);