Avoid overflow in BorrowedCursor::advance

Author: a1phyr

library/core/src/io/borrowed_buf.rs

@@ -261,9 +261,10 @@ impl<'a> BorrowedCursor<'a> {
     /// Panics if there are less than `n` bytes initialized.
     #[inline]
     pub fn advance(&mut self, n: usize) -> &mut Self {
-        assert!(self.buf.init >= self.buf.filled + n);
+        let new_filled = self.buf.filled.strict_add(n);
+        assert!(self.buf.init >= new_filled);
 
-        self.buf.filled += n;
+        self.buf.filled = new_filled;
         self
     }