struct cookie *c = f->cookie;
size_t len2;
wchar_t *newbuf;
- if (len >= c->space - c->pos) {
- len2 = 2*c->space+1 | c->space+len+1;
+ if (len + c->pos >= c->space) {
+ len2 = 2*c->space+1 | c->pos+len+1;
if (len2 > SSIZE_MAX/4) return 0;
newbuf = realloc(c->buf, len2*4);
if (!newbuf) return 0;