@@ -317,8 +317,8 @@ int upx_inflate2b(const char *src, uint32_t ssize, char *dst, uint32_t *dsize, u

     while (1) {

       if ( (oob = doubleebx(src, &myebx, &scur, ssize)) == -1 )

         return -1;

-            if (backbytes + oob > INT32_MAX / 2)

-                return -1;

+      if (((int64_t) backbytes + oob ) > INT32_MAX / 2)

+        return -1;

       backbytes = backbytes*2+oob;

       if ( (oob = doubleebx(src, &myebx, &scur, ssize)) == -1 )

 	return -1;

@@ -402,8 +402,8 @@ int upx_inflate2d(const char *src, uint32_t ssize, char *dst, uint32_t *dsize, u

     while (1) {

       if ( (oob = doubleebx(src, &myebx, &scur, ssize)) == -1 )

         return -1;

-            if (backbytes + oob > INT32_MAX / 2)

-                return -1;

+      if (((int64_t) backbytes + oob ) > INT32_MAX / 2)

+        return -1;

       backbytes = backbytes*2+oob;

       if ( (oob = doubleebx(src, &myebx, &scur, ssize)) == -1 )

         return -1;

@@ -412,6 +412,8 @@ int upx_inflate2d(const char *src, uint32_t ssize, char *dst, uint32_t *dsize, u

       backbytes--;

       if ( (oob = doubleebx(src, &myebx, &scur, ssize)) == -1 )

         return -1;

+      if (((int64_t) backbytes + oob ) > INT32_MAX / 2)

+        return -1;

       backbytes=backbytes*2+oob;

     }

@@ -493,8 +495,8 @@ int upx_inflate2e(const char *src, uint32_t ssize, char *dst, uint32_t *dsize, u

     for(;;) {

       if ( (oob = doubleebx(src, &myebx, &scur, ssize)) == -1 )

         return -1;

-            if (backbytes + oob > INT32_MAX / 2)

-                return -1;

+      if (((int64_t) backbytes + oob ) > INT32_MAX / 2)

+        return -1;

       backbytes = backbytes*2+oob;

       if ( (oob = doubleebx(src, &myebx, &scur, ssize)) == -1 )

         return -1;

@@ -503,6 +505,8 @@ int upx_inflate2e(const char *src, uint32_t ssize, char *dst, uint32_t *dsize, u

       backbytes--;

       if ( (oob = doubleebx(src, &myebx, &scur, ssize)) == -1 )

         return -1;

+      if (((int64_t) backbytes + oob ) > INT32_MAX / 2)

+        return -1;

       backbytes=backbytes*2+oob;

     }