Fixed the edge case where rounding up causes overflow.

tests/test_generated_code.c

@@ -540,6 +540,13 @@ void test_arena_unaligned(void) {
       unaligned_buf_ptr, &buf1[sizeof(buf1)] - unaligned_buf_ptr, NULL);
   char *mem = upb_arena_malloc(arena, 5);
   ASSERT(((uintptr_t)mem & 15) == 0);
+  upb_arena_free(arena);
+
+  // Try the same, but with a size so small that aligning up will overflow.
+  arena = upb_arena_init(unaligned_buf_ptr, 5, &upb_alloc_global);
+  mem = upb_arena_malloc(arena, 5);
+  ASSERT(((uintptr_t)mem & 15) == 0);
+  upb_arena_free(arena);
 }
 
 int run_tests(int argc, char *argv[]) {

upb/upb.c

@@ -210,10 +210,13 @@ upb_arena *arena_initslow(void *mem, size_t n, upb_alloc *alloc) {
 upb_arena *upb_arena_init(void *mem, size_t n, upb_alloc *alloc) {
   upb_arena *a;
 
+  if (n) {
     /* Align initial pointer up so that we return properly-aligned pointers. */
     void *aligned = (void*)UPB_ALIGN_UP((uintptr_t)mem, 16);
-  n -= (uintptr_t)aligned - (uintptr_t)mem;
+    size_t delta = (uintptr_t)aligned - (uintptr_t)mem;
+    n = delta <= n ? n - delta : 0;
     mem = aligned;
+  }
 
   /* Round block size down to alignof(*a) since we will allocate the arena
    * itself at the end. */