Description:
------------
The subtraction at <https://github.com/php/php-src/blob/26f8fc833b9668a8b8e14ecd7d94930146019adb/Zend/zend_operators.c#L3059> has no guard to ensure pointer wrapping (which itself is undefined behaviour) doesn't occur.

There's an identical unguarded pointer subtraction at <https://github.com/php/php-src/blob/26f8fc833b9668a8b8e14ecd7d94930146019adb/Zend/zend_operators.c#L3093>.

Successful exploitation would result in high ranges of memory becoming accessible to the attacker, with similar usecases to heartbleed.

Remember this when you try to argue for use of non-standard, reinvented wheels. Testing incurs a price. As does code complexity. To put my "standardisation" rants into perspective, here's how C11/6.5.6p8 defines PHP:

> ... If both the pointer operand and the result point to elements of the same array object, or one past the last element of the array object, the evaluation shall not produce an overflow; otherwise, the behavior is undefined. ...