lib: var-expand - Avoid unsigned overflow in offset calculation

diff --git a/src/lib/var-expand.c b/src/lib/var-expand.c
index 4d785f068001d9db61f3a7e7a58e36e8c061e3f7..7ddaec0a63f93a3f11236f3990b1648d59f52cd1 100644 (file)
--- a/src/lib/var-expand.c
+++ b/src/lib/var-expand.c
@@ -599,9 +599,10 @@ int var_expand_with_funcs(string_t *dest, const char *str,
                                        /* if offset is < 0 then we want to
                                           start at the end */
                                        size_t len = strlen(var);
+                                       size_t offset_from_end = -ctx.offset;
 
-                                       if (len > (size_t)-ctx.offset)
-                                               var += len + ctx.offset;
+                                       if (len > offset_from_end)
+                                               var += len - offset_from_end;
                                } else {
                                        while (*var != '\0' && ctx.offset > 0) {
                                                ctx.offset--;