Harden stream bounds checks against pointer-arithmetic overflow

common/parse.h

@@ -186,7 +186,7 @@ unsigned int
 in_utf16_le_terminated_as_utf8_length(struct stream *s);
 
 /******************************************************************************/
-#define s_check_rem(s, n) ((s)->p + (n) <= (s)->end)
+#define s_check_rem(s, n) ((n) >= 0 && (n) <= (s)->end - (s)->p)
 
 /******************************************************************************/
 /**
@@ -202,7 +202,7 @@ in_utf16_le_terminated_as_utf8_length(struct stream *s);
       && 0 )
 
 /******************************************************************************/
-#define s_check_rem_out(s, n) ((s)->p + (n) <= (s)->data + (s)->size)
+#define s_check_rem_out(s, n) ((n) >= 0 && (n) <= (s)->size - ((s)->p - (s)->data))
 
 /******************************************************************************/
 /**

common/trans.c

@@ -472,7 +472,7 @@ trans_force_read_s(struct trans *self, struct stream *in_s, int size)
 
     if (self->status != TRANS_STATUS_UP ||
             size < 0 ||
-            in_s->end + size > in_s->data + in_s->size)
+            size > in_s->size - (in_s->end - in_s->data))
     {
         return 1;
     }