Ensure negative offsets cannot be passed to buffer().  When composing
buffers, compute the new buffer size based on the old buffer size.
Fixes SF bug #1034242.
1 file changed