From 0ee252d7c83c119931d87524d6cf369839171cc5 Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Wed, 13 Nov 2024 07:07:11 +0000
Subject: [PATCH] Fix GH-16769: php_pcntl_set_user_signal_infos aborts when a
 signal is a reference.

---
 ext/pcntl/pcntl.c            |  1 +
 ext/pcntl/tests/gh16769.phpt | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)
 create mode 100644 ext/pcntl/tests/gh16769.phpt

diff --git a/ext/pcntl/pcntl.c b/ext/pcntl/pcntl.c
index b2fe964e7face..c3b53aec0ebb8 100644
--- a/ext/pcntl/pcntl.c
+++ b/ext/pcntl/pcntl.c
@@ -874,6 +874,7 @@ static bool php_pcntl_set_user_signal_infos(
 	zval *user_signal_no;
 	ZEND_HASH_FOREACH_VAL(user_signals, user_signal_no) {
 		bool failed = true;
+		ZVAL_DEREF(user_signal_no);
 		zend_long tmp = zval_try_get_long(user_signal_no, &failed);
 
 		if (failed) {
diff --git a/ext/pcntl/tests/gh16769.phpt b/ext/pcntl/tests/gh16769.phpt
new file mode 100644
index 0000000000000..60baee616101d
--- /dev/null
+++ b/ext/pcntl/tests/gh16769.phpt
@@ -0,0 +1,18 @@
+--TEST--
+pcntl_sigwaitinfo abort when signals is an array with self-reference.
+--EXTENSIONS--
+pcntl
+--SKIPIF--
+<?php if (!function_exists("pcntl_sigwaitinfo")) die("skip pcntl_sigwaitinfo() not available"); ?>
+--FILE--
+<?php
+$a[0] = &$a;
+
+try {
+	pcntl_sigwaitinfo($a,$a);
+} catch(\TypeError $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECT--
+pcntl_sigwaitinfo(): Argument #1 ($signals) signals must be of type int, array given