vendor/subversion/subversion-1.8.8

1 files changed, 6 insertions, 2 deletions

diff --git a/subversion/libsvn_subr/cache-membuffer.c b/subversion/libsvn_subr/cache-membuffer.c
index 5f447b3fa9bd..131d914502c9 100644
--- a/subversion/libsvn_subr/cache-membuffer.c
+++ b/subversion/libsvn_subr/cache-membuffer.c
@@ -422,7 +422,7 @@ struct svn_membuffer_t
    */
   apr_uint64_t current_data;
 
-  /* Total number of data buffer bytes in use. This is for statistics only.
+  /* Total number of data buffer bytes in use.
    */
   apr_uint64_t data_used;
 
@@ -1374,7 +1374,11 @@ membuffer_cache_set_internal(svn_membuffer_t *cache,
    * the old spot, just re-use that space. */
   if (entry && ALIGN_VALUE(entry->size) >= size && buffer)
     {
-      cache->data_used += size - entry->size;
+      /* Careful! We need to cast SIZE to the full width of CACHE->DATA_USED
+       * lest we run into trouble with 32 bit underflow *not* treated as a
+       * negative value.
+       */
+      cache->data_used += (apr_uint64_t)size - entry->size;
       entry->size = size;
 
 #ifdef SVN_DEBUG_CACHE_MEMBUFFER