Fix leak of invalid stream_read() return value

Fixes oss-fuzz 6225190686687232 (part of #38542).

ext/standard/tests/streams/stream_read_object_return.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Returning an object from stream_read() is invalid, but should not leak
+--FILE--
+<?php
+class MyStream {
+    function stream_open() {
+        return true;
+    }
+    function stream_stat() {
+        return false;
+    }
+    function stream_read() {
+        return new stdClass;
+    }
+}
+stream_wrapper_register('mystream', MyStream::class);
+try {
+    var_dump(file_get_contents('mystream://'));
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Object of class stdClass could not be converted to string

main/streams/userspace.c

@@ -648,6 +648,7 @@ static ssize_t php_userstreamop_read(php_stream *stream, char *buf, size_t count
 	}
 
 	if (!try_convert_to_string(&retval)) {
+		zval_ptr_dtor(&retval);
 		return -1;
 	}