--- a/libpurple/protocols/msn/slplink.c Thu Jun 26 01:18:05 2008 +0000 +++ b/libpurple/protocols/msn/slplink.c Thu Jun 26 08:42:49 2008 +0000 @@ -593,7 +593,7 @@ } else if (slpmsg->size) { - if ((offset + len) > slpmsg->size) + if (offset < 0 || (offset + len) > slpmsg->size) { purple_debug_error("msn", "Oversized slpmsg - msgsize=%lld offset=%" G_GSIZE_FORMAT " len=%" G_GSIZE_FORMAT "\n",