From 7c9872e255b33a4d455c18153f1967b87654f443 Mon Sep 17 00:00:00 2001
From: Saki Takamachi <saki@php.net>
Date: Fri, 14 Mar 2025 09:00:00 +0900
Subject: [PATCH] Fixed pointer subtraction for scale (#17986)

Closes #17986
---
 NEWS                               | 3 +++
 ext/bcmath/libbcmath/src/str2num.c | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 72b890d2985..7bcfc484d73 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.6
 
+- BCMath:
+  . Fixed pointer subtraction for scale. (SakiTakamachi)
+
 - Core:
   . Fixed property hook backing value access in multi-level inheritance.
     (ilutov)
diff --git a/ext/bcmath/libbcmath/src/str2num.c b/ext/bcmath/libbcmath/src/str2num.c
index 79c1d4216fe..bd9a44a2405 100644
--- a/ext/bcmath/libbcmath/src/str2num.c
+++ b/ext/bcmath/libbcmath/src/str2num.c
@@ -180,7 +180,7 @@ bool bc_str2num(bc_num *num, const char *str, const char *end, size_t scale, siz
 			 */
 			if (str_scale > 0) {
 				const char *fractional_new_end = bc_skip_zero_reverse(fractional_end, fractional_ptr);
-				str_scale -= fractional_new_end - fractional_end;
+				str_scale -= fractional_end - fractional_new_end; /* fractional_end >= fractional_new_end */
 			}
 		}
 	} else {