https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99098
--- Comment #5 from Peter Ross <pross at xvid dot org> --- The -1 occurs after checking the malloc()==0 case, so the negative offset is only ever applied to addresses in [1..limit] range. Thanks for your time!
