A call to bccomp() with attacker-supplied inputs can lead to an out-of-bounds write to either stack or heap memory. The bug occurs in bc_str2num() when the scale truncates a number whose trailing zeros are subsequently trimmed.
str_scale later determines the number of digits after the decimal point in the resulting string.
The string is later populated using bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end).
Note that we have shortened the allocated string (str_scale -= fractional_end - fractional_new_end;) but have not adjusted fractional_end itself. Consequently, bc_copy_and_toggle_bcd(nptr, fractional_ptr, fractional_end) will copy the original, untruncated string into a buffer that is too small, leading to an out-of-bounds write.
BCMath uses a small stack-allocated arena for numbers before falling back to heap allocation, enabling both stack and heap corruption, depending on where the buffer is allocated.
The patch adds fractional_end = fractional_new_end; after the zero truncation.