Index: kernel/generic/src/mm/as.c
===================================================================
--- kernel/generic/src/mm/as.c	(revision 0941e9aef8d4c35315c1613a3fbc4d83335aa988)
+++ kernel/generic/src/mm/as.c	(revision 7dba813edf9ca94fe86972cf728c299ee15088c8)
@@ -299,5 +299,11 @@
 	ASSERT((addr % PAGE_SIZE) == 0);
 	ASSERT(mutex_locked(&as->lock));
-	ASSERT(!overflows_add(addr, P2SZ(count)));
+
+	/*
+	 * If the addition of the supposed area address and size overflows,
+	 * report conflict.
+	 */
+	if (overflows_into_positive(addr, P2SZ(count)))
+		return false;
 	
 	/*
@@ -331,5 +337,6 @@
 			mutex_lock(&area->lock);
 
-			/* If at least one of the two areas are protected
+			/*
+			 * If at least one of the two areas are protected
 			 * by the AS_AREA_GUARD flag then we must be sure
 			 * that they are separated by at least one unmapped
@@ -339,4 +346,10 @@
 			    (area->flags & AS_AREA_GUARD)) ? 1 : 0;
 			
+			/*
+			 * The area comes from the left neighbour node, which
+			 * means that there already are some areas in the leaf
+			 * node, which in turn means that adding gp is safe and
+			 * will not cause an integer overflow.
+			 */
 			if (overlaps(addr, P2SZ(count), area->base,
 			    P2SZ(area->pages + gp))) {
@@ -354,8 +367,18 @@
 		
 		if (area != avoid) {
+			int gp;
+
 			mutex_lock(&area->lock);
 
-			int const gp = (guarded ||
-			    (area->flags & AS_AREA_GUARD)) ? 1 : 0;
+			gp = (guarded || (area->flags & AS_AREA_GUARD)) ? 1 : 0;
+			if (gp && overflows(addr, P2SZ(count))) {
+				/*
+				 * Guard page not needed if the supposed area
+				 * is adjacent to the end of the address space.
+				 * We already know that the following test is
+				 * going to fail...
+				 */
+				gp--;
+			}
 			
 			if (overlaps(addr, P2SZ(count + gp), area->base,
@@ -373,4 +396,6 @@
 	for (i = 0; i < leaf->keys; i++) {
 		area = (as_area_t *) leaf->value[i];
+		int agp;
+		int gp;
 		
 		if (area == avoid)
@@ -379,9 +404,17 @@
 		mutex_lock(&area->lock);
 
-		int const gp = (guarded ||
-		    (area->flags & AS_AREA_GUARD)) ? 1 : 0;
+		gp = (guarded || (area->flags & AS_AREA_GUARD)) ? 1 : 0;
+		agp = gp;
+
+		/*
+		 * Sanitize the two possible unsigned integer overflows.
+		 */
+		if (gp && overflows(addr, P2SZ(count)))
+			gp--;
+		if (agp && overflows(area->base, P2SZ(area->pages)))
+			agp--;
 
 		if (overlaps(addr, P2SZ(count + gp), area->base,
-		    P2SZ(area->pages + gp))) {
+		    P2SZ(area->pages + agp))) {
 			mutex_unlock(&area->lock);
 			return false;
@@ -533,5 +566,5 @@
 	}
 
-	if (overflows_add(*base, size))
+	if (overflows_into_positive(*base, size))
 		return NULL;
 
@@ -816,5 +849,5 @@
 		 */
 
-		if (overflows_add(address, P2SZ(pages)))
+		if (overflows_into_positive(address, P2SZ(pages)))
 			return EINVAL;