[Bug lto/122515] Integer overflow on i686 when getting offsets in large archives

[siddhesh at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122515

--- Comment #12 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> ---
Actually, it can be even simpler, since diff is always less than page size:

diff --git a/gcc/lto/lto-common.cc b/gcc/lto/lto-common.cc
index 3d35c038916..13aca2c9d2a 100644
--- a/gcc/lto/lto-common.cc
+++ b/gcc/lto/lto-common.cc
@@ -2438,7 +2438,7 @@ lto_read_section_data (struct lto_file_decl_data
*file_data,

   computed_offset = offset & ((off_t) page_mask);
   diff = offset - computed_offset;
-  if (len > (size_t) (SSIZE_MAX - diff))
+  if (len > (((size_t) -1) >> 1) - diff)
     {
       fatal_error (input_location, "Cannot map %s: section is too long",
                   file_data->file_name);