Index: http.c
===================================================================
--- http.c	(revision 291129)
+++ http.c	(working copy)
@@ -286,6 +286,10 @@
 	}
 
 	rlen = io->buflen - io->bufpos;
+	if (rlen < 0) {
+		errno = EIO;
+		return (-1);
+	}
 	if (len < rlen)
 		rlen = len;
 	memcpy(buf, io->buf + io->bufpos, rlen);