@@ -375,11 +375,12 @@
 	[self removeItemsInRange: of_range(index, 1)];
 }
 
 - (void)removeItemsInRange: (of_range_t)range
 {
-	if (range.location + range.length > count)
+	if (range.length > SIZE_MAX - range.location ||
+	    range.location + range.length > count)
 		@throw [OFOutOfRangeException exceptionWithClass: [self class]];
 
 	memmove(data + range.location * itemSize,
 	    data + (range.location + range.length) * itemSize,
 	    (count - range.location - range.length) * itemSize);
@@ -638,11 +639,12 @@
 
 - (void)removeItemsInRange: (of_range_t)range
 {
 	size_t newSize, lastPageByte;
 
-	if (range.location + range.length > count)
+	if (range.length > SIZE_MAX - range.location ||
+	    range.location + range.length > count)
 		@throw [OFOutOfRangeException exceptionWithClass: [self class]];
 
 	memmove(data + range.location * itemSize,
 	    data + (range.location + range.length) * itemSize,
 	    (count - range.location - range.length) * itemSize);