From 94d73de143e7a8297e25af7423fc0fdb27e1e808 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 26 Apr 2025 23:49:34 +0200
Subject: [PATCH] Fix reference handling in cancel callback

Broke in 8765e9f5e74651b582cd3de1218135a72dd4eea8
---
 ext/zip/php_zip.c          |  6 ++++--
 ext/zip/tests/gh18439.phpt | 27 +++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 ext/zip/tests/gh18439.phpt

diff --git a/ext/zip/php_zip.c b/ext/zip/php_zip.c
index 1c2e430485884..316c22aab5f06 100644
--- a/ext/zip/php_zip.c
+++ b/ext/zip/php_zip.c
@@ -3073,10 +3073,12 @@ static int php_zip_cancel_callback(zip_t *arch, void *ptr)
 		return -1;
 	}
 	bool failed = false;
-	zend_long retval = zval_try_get_long(&cb_retval, &failed);
+	zval *cb_retval_ptr = &cb_retval;
+	ZVAL_DEREF(cb_retval_ptr);
+	zend_long retval = zval_try_get_long(cb_retval_ptr, &failed);
 	if (failed) {
 		zend_type_error("Return value of callback provided to ZipArchive::registerCancelCallback()"
-			" must be of type int, %s returned", zend_zval_value_name(&cb_retval));
+			" must be of type int, %s returned", zend_zval_value_name(cb_retval_ptr));
 		zval_ptr_dtor(&cb_retval);
 		return -1;
 	}
diff --git a/ext/zip/tests/gh18439.phpt b/ext/zip/tests/gh18439.phpt
new file mode 100644
index 0000000000000..5235bd99e47bd
--- /dev/null
+++ b/ext/zip/tests/gh18439.phpt
@@ -0,0 +1,27 @@
+--TEST--
+GH-18439 (Reference handling in cancel callback)
+--EXTENSIONS--
+zip
+--FILE--
+<?php
+
+function &cb() {
+    $test = false;
+    return $test;
+}
+
+$file = __DIR__ . '/gh18439.zip';
+$zip = new ZipArchive;
+$zip->open($file, ZIPARCHIVE::CREATE);
+$zip->registerCancelCallback(cb(...));
+$zip->addFromString('test', 'test');
+echo "Done\n";
+
+?>
+--CLEAN--
+<?php
+$file = __DIR__ . '/gh18439.zip';
+@unlink($file);
+?>
+--EXPECT--
+Done