Merge branch 'PHP-8.5'

* PHP-8.5:
  Clamp scale in bc_is_zero_for_scale to n_scale

Author: iliaal

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.6.0beta3
 
+- BCMath:
+  . Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds
+    n_scale. (Ilia Alshanetsky)
+
 - Core:
   . Calling is_a() or is_subclass_of() with a string as the first argument
     when $allow_string is false is now deprecated. (Daniel Scherzer)

ext/bcmath/libbcmath/src/zero.c

@@ -45,6 +45,10 @@ bool bc_is_zero_for_scale(bc_num num, size_t scale)
 		return true;
 	}
 
+	if (scale > num->n_scale) {
+		scale = num->n_scale;
+	}
+
 	/* Initialize */
 	count = num->n_len + scale;
 	nptr = num->n_value;

ext/bcmath/tests/bc_is_zero_for_scale_clamp.phpt

@@ -0,0 +1,12 @@
+--TEST--
+bc_is_zero_for_scale clamps scale to n_scale (Number::compare opposite signs)
+--EXTENSIONS--
+bcmath
+--FILE--
+<?php
+$shortZero = (new BcMath\Number('1.0'))->sub('1.0');
+$longNegative = new BcMath\Number('-0.' . str_repeat('0', 64) . '1');
+var_dump($shortZero->compare($longNegative, 64));
+?>
+--EXPECT--
+int(0)