The offset *can* be negative, but the sanitizer reports strange address behaviour when row_offset is unsigned size_t. For safety, use int64_t instead (probably overkill. int32_t is probably ok). Change-Id: I1bd424bfdb5447b3839f40679581d6bdea075320