[expr.add]

For subtraction, one of the following shall hold:

(2.1)
both operands have arithmetic type; or
(2.2)
both operands are pointers to cv-qualified or cv-unqualified versions of the same completely-defined object type; or
(2.3)
the left operand is a pointer to a completely-defined object type and the right operand has integral type.

The result of the binary + operator is the sum of the operands.

The result of the binary - operator is the difference resulting from the subtraction of the second operand from the first.

When an expression J that has integral type is added to or subtracted from an expression P of pointer type, the result has the type of P.

(4.1)
If P evaluates to a null pointer value and J evaluates to 0, the result is a null pointer value.
(4.2)
Otherwise, if P points to a (possibly-hypothetical) array element i of an array object x with n elements ([dcl.array]),60 the expressions P + J and J + P (where J has the value j) point to the (possibly-hypothetical) array element $i + j of x if 0 \leq i + j \leq n and the expression P - J points to the (possibly-hypothetical) array element i - j of x if 0 \leq i - j \leq n .$
(4.3)
Otherwise, the behavior is undefined.

[Note 1:

Adding a value other than 0 or 1 to a pointer to a base class subobject, a member subobject, or a complete object results in undefined behavior.

— end note]

The result of subtracting two pointer expressions P and Q is a prvalue of type std::ptrdiff_t ([support.types.layout]).

(5.1)
If P and Q both evaluate to null pointer values, the value is 0.
(5.2)
Otherwise, if P and Q point to, respectively, array elements i and j of the same array object x, the expression P - Q has the value $i - j .$

[Note 2:
If the value $i - j is not in the range of representable values of type std :: ptrdiff_t, the behavior is undefined ([expr. pre]) .$
— end note]
(5.3)
Otherwise, the behavior is undefined.

For addition or subtraction, if the expressions P or Q have type “pointer to cv T”, where T and the array element type are not similar, the behavior is undefined.

[Example 1: int arr[5] = {1, 2, 3, 4, 5}; unsigned int *p = reinterpret_cast<unsigned int*>(arr + 1); unsigned int k = *p; / OK, value of k is 2 ([conv.lval]) unsigned int *q = p + 1; / undefined behavior: p points to an int, not an unsigned int object — end example]

60)60)

As specified in [basic.compound], an object that is not an array element is considered to belong to a single-element array for this purpose and a pointer past the last element of an array of n elements is considered to be equivalent to a pointer to a hypothetical array element n for this purpose.