CVE-2025-4447: Reverse Pointer Subtraction Sizecve-2025-4447-reverse-pointer-subtraction-size
Incorrect remaining buffer size calculation using 'sizeof(buf) - (buf - ptr)'. Pointer arithmetic 'buf - ptr' results in a negative value when 'ptr' is advanced past 'buf', leading to a larger buffer length calculation than the actual remaining capacity. This causes integer underflow and can lead to a stack-based buffer overflow. The correct calculation is '
