Fix nasty 32-bit overflow bug in buffer i/o code