--- a/libpurple/protocols/msnp9/slplink.c Thu Jun 26 09:14:31 2008 +0000 +++ b/libpurple/protocols/msnp9/slplink.c Thu Jun 26 19:04:52 2008 +0000 @@ -597,7 +597,7 @@ } else if (slpmsg->size) { - if (offset < 0 || (offset + len) > slpmsg->size) + if (G_MAXSIZE - len < offset || (offset + len) > slpmsg->size) { purple_debug_error("msn", "Oversized slpmsg\n"); g_return_if_reached();