automata: check for overflow in Span::offset

regex-automata/src/util/search.rs

@@ -843,9 +843,23 @@ impl Span {
 
     /// Returns a new span with `offset` added to this span's `start` and `end`
     /// values.
+    ///
+    /// # Panics
+    ///
+    /// This panics if adding `offset` to either part of this `Span` would
+    /// result in overflow.
     #[inline]
     pub fn offset(&self, offset: usize) -> Span {
-        Span { start: self.start + offset, end: self.end + offset }
+        Span {
+            start: self
+                .start
+                .checked_add(offset)
+                .expect("Span::offset: start+offset overflowed usize"),
+            end: self
+                .end
+                .checked_add(offset)
+                .expect("Span::offset: end+offset overflowed usize"),
+        }
     }
 }
 
@@ -1940,6 +1954,15 @@ impl core::fmt::Display for MatchError {
 mod tests {
     use super::*;
 
+    #[test]
+    #[should_panic(expected = "overflowed usize")]
+    fn span_offset_overflow_panics() {
+        let s = Span { start: usize::MAX, end: usize::MAX };
+        let _ = s.offset(1);
+    }
+
+    use super::*;
+
     // We test that our 'MatchError' type is the size we expect. This isn't an
     // API guarantee, but if the size increases, we really want to make sure we
     // decide to do that intentionally. So this should be a speed bump. And in