PHP：脆弱性情報

A call to `bccomp()` with attacker-supplied inputs can lead to an out-of-bounds write to either stack or heap memory. The bug occurs in `bc_str2num()` when the scale truncates a number whose trailing zeros are subsequently trimmed. https://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L169-L185 `str_scale` later determines the number of digits after the decimal point in the resulting string. https://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L203 The string is later populated using `bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end)`. https://github.com/php/php-src/blob/a480965c90b4f4948f211c8b139788371e031838/ext/bcmath/libbcmath/src/str2num.c#L213 Note that we have shortened the allocated string (`str_scale -= fractional_end - fractional_new_end;`) but have not adjusted `fractional_end` itself. Consequently, `bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end)` will copy the original, untruncated string into a buffer that is too small, leading to an out-of-bounds write. BCMath uses a small stack-allocated arena for numbers before falling back to heap allocation, enabling both stack and heap corruption, depending on where the buffer is allocated. The patch adds `fractional_end = fractional_new_end;` after the zero truncation.