1 files changed, 4 insertions, 2 deletions

diff --git a/src/alloc.c b/src/alloc.c
index f203061161b..e556fc86a3b 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -4641,8 +4641,10 @@ mark_maybe_object (Lisp_Object obj)
       break;
     }
 
-  void *po = (char *) ((intptr_t) (char *) XLP (obj)
-                       + (offset - LISP_WORD_TAG (type_tag)));
+  bool overflow
+    = INT_SUBTRACT_WRAPV (offset, LISP_WORD_TAG (type_tag), &offset);
+  eassert (!overflow);
+  void *po = (char *) ((intptr_t) (char *) XLP (obj) + offset);
 
   /* If the pointer is in the dump image and the dump has a record
      of the object starting at the place where the pointer points, we