mercurial/parsers.c

--- a/mercurial/parsers.c	Sat Feb 13 22:10:31 2010 +0100
+++ b/mercurial/parsers.c	Sat Feb 13 17:37:44 2010 -0600
@@ -194,7 +194,7 @@
 		mtime = ntohl(*(uint32_t *)(decode + 8));
 		flen = ntohl(*(uint32_t *)(decode + 12));
 		cur += 17;
-		if (flen > end - cur) {
+		if (cur + flen > end || cur + flen < cur) {
 			PyErr_SetString(PyExc_ValueError, "overflow in dirstate");
 			goto quit;
 		}
@@ -332,7 +332,7 @@
 
 		n++;
 		step = 64 + (inlined ? comp_len : 0);
-		if (end - data < step)
+		if (data + step > end || data + step < data)
 			break;
 		data += step;
 	}