Fix use of uninitialized memory in pcntl SIGCHLD handling

psig needs to stay the tail, so that we don't get a dangling element on the end.

Author: iluuu1994

ext/pcntl/pcntl.c

@@ -1338,15 +1338,13 @@ static void pcntl_signal_handler(int signo, siginfo_t *siginfo, void *context)
 static void pcntl_signal_handler(int signo)
 #endif
 {
-	struct php_pcntl_pending_signal *psig;
-
-	psig = PCNTL_G(spares);
-	if (!psig) {
+	struct php_pcntl_pending_signal *psig_first = PCNTL_G(spares);
+	if (!psig_first) {
 		/* oops, too many signals for us to track, so we'll forget about this one */
 		return;
 	}
 
-	struct php_pcntl_pending_signal *psig_first = psig;
+	struct php_pcntl_pending_signal *psig = NULL;
 
 	/* Standard signals may be merged into a single one.
 	 * POSIX specifies that SIGCHLD has the si_pid field (https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/signal.h.html),
@@ -1365,28 +1363,25 @@ static void pcntl_signal_handler(int signo)
 				pid = waitpid(WAIT_ANY, &status, WNOHANG | WUNTRACED);
 			} while (pid <= 0 && errno == EINTR);
 			if (pid <= 0) {
-				if (UNEXPECTED(psig == psig_first)) {
-					/* Don't handle multiple, revert back to the single signal handling. */
-					goto single_signal;
-				}
+				/* There must've been at least one iteration so that psig is initialized. */
+				ZEND_ASSERT(psig != NULL);
 				break;
 			}
 
+			psig = psig ? psig->next : psig_first;
 			psig->signo = signo;
 
 #ifdef HAVE_STRUCT_SIGINFO_T
 			psig->siginfo = *siginfo;
 			psig->siginfo.si_pid = pid;
 #endif
 
-			if (EXPECTED(psig->next)) {
-				psig = psig->next;
-			} else {
+			if (UNEXPECTED(!psig->next)) {
 				break;
 			}
 		}
 	} else {
-single_signal:;
+		psig = psig_first;
 		psig->signo = signo;
 
 #ifdef HAVE_STRUCT_SIGINFO_T

ext/pcntl/tests/gh11498.phpt

@@ -17,7 +17,7 @@ pcntl_signal(SIGCHLD, function($sig, $info) use (&$processes) {
     unset($processes[$info['pid']]);
 }, false);
 
-foreach (range(0, 5) as $i) {
+for ($i = 0; $i <= 5; $i++) {
     $process = proc_open('echo $$ > /dev/null', [], $pipes);
     $pid = proc_get_status($process)['pid'];
     $processes[$pid] = $process;