# Fix pointer arithmetic overflow introduced in upstream commit 4063ade8503ac8877a02fc4eae8ebbe242b9110b,
# which caused the following tests to fail on i486 and i686:
# t/re/pat_rt_report_thr ........................................ FAILED at test 55
# Failed test 55 - UTF-8 regex matches above 32k; Bug 20020630.002 at re/pat_rt_report.t line 224
# <utf8 x 32000>; pos = 1
# Failed test 57 - UTF-8 regex matches above 32k; Bug 20020630.002 at re/pat_rt_report.t line 224
# <utf8 x 32768>; pos = 1
# Failed test 59 - UTF-8 regex matches above 32k; Bug 20020630.002 at re/pat_rt_report.t line 224
# <utf8 x 33000>; pos = 1
diff --git a/regexec.c b/regexec.c
index bc38839..6199677 100644
--- a/regexec.c
+++ b/regexec.c
@@ -6662,7 +6662,7 @@ S_regrepeat(pTHX_ regexp *prog, char **startposp, const regnode *p,
     scan = *startposp;
     if (max == REG_INFTY)
 	max = I32_MAX;
-    else if (! utf8_target && scan + max < loceol)
+    else if (! utf8_target && max < loceol - scan)
 	loceol = scan + max;
 
     /* Here, for the case of a non-UTF-8 target we have adjusted <loceol> down
@@ -6711,7 +6711,7 @@ S_regrepeat(pTHX_ regexp *prog, char **startposp, const regnode *p,
 	    scan = loceol;
 	break;
     case CANY:  /* Move <scan> forward <max> bytes, unless goes off end */
-        if (utf8_target && scan + max < loceol) {
+        if (utf8_target && max < loceol - scan) {
 
             /* <loceol> hadn't been adjusted in the UTF-8 case */
             scan +=  max;
@@ -6730,7 +6730,7 @@ S_regrepeat(pTHX_ regexp *prog, char **startposp, const regnode *p,
          * can use UTF8_IS_INVARIANT() even if the pattern isn't UTF-8, as it's
          * true iff it doesn't matter if the argument is in UTF-8 or not */
         if (UTF8_IS_INVARIANT(c) || (! utf8_target && ! is_utf8_pat)) {
-            if (utf8_target && scan + max < loceol) {
+            if (utf8_target && max < loceol - scan) {
                 /* We didn't adjust <loceol> because is UTF-8, but ok to do so,
                  * since here, to match at all, 1 char == 1 byte */
                 loceol = scan + max;
@@ -6910,7 +6910,7 @@ S_regrepeat(pTHX_ regexp *prog, char **startposp, const regnode *p,
         /* FALLTHROUGH */
 
     case POSIXA:
-        if (utf8_target && scan + max < loceol) {
+        if (utf8_target && max < loceol - scan) {
 
             /* We didn't adjust <loceol> at the beginning of this routine
              * because is UTF-8, but it is actually ok to do so, since here, to