From b33a7634ba34ffa7ce7368cc0ebf5ca40b54c7e6 Mon Sep 17 00:00:00 2001
From: itchyny <itchyny@cybozu.co.jp>
Date: Tue, 20 Jan 2026 21:56:09 +0900
Subject: [PATCH] Fix reversed pointer subtraction in `f_env` bounds check
 (#3465)

---
 src/builtin.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/builtin.c b/src/builtin.c
index 8e673940..5a5d1e0c 100644
--- a/src/builtin.c
+++ b/src/builtin.c
@@ -1238,7 +1238,7 @@ static jv f_env(jq_state *jq, jv input) {
     val = strchr(e[0], '=');
     if (val == NULL)
       env = jv_object_set(env, jv_string(var), jv_null());
-    else if (var - val < INT_MAX)
+    else if (val - var < INT_MAX)
       env = jv_object_set(env, jv_string_sized(var, val - var), jv_string(val + 1));
   }
   return env;