Index: libcxx/trunk/include/sstream
===================================================================
--- libcxx/trunk/include/sstream
+++ libcxx/trunk/include/sstream
@@ -577,6 +577,7 @@
     if ((__wch & (ios_base::in | ios_base::out)) == (ios_base::in | ios_base::out)
         && __way == ios_base::cur)
         return pos_type(-1);
+    const ptrdiff_t __hm = __hm_ == nullptr ? 0 : __hm_ - __str_.data();
     off_type __noff;
     switch (__way)
     {
@@ -590,13 +591,13 @@
             __noff = this->pptr() - this->pbase();
         break;
     case ios_base::end:
-        __noff = __hm_ - __str_.data();
+        __noff = __hm;
         break;
     default:
         return pos_type(-1);
     }
     __noff += __off;
-    if (__noff < 0 || __hm_ - __str_.data() < __noff)
+    if (__noff < 0 || __hm < __noff)
         return pos_type(-1);
     if (__noff != 0)
     {
Index: libcxx/trunk/test/std/input.output/string.streams/stringbuf/stringbuf.virtuals/seekoff.pass.cpp
===================================================================
--- libcxx/trunk/test/std/input.output/string.streams/stringbuf/stringbuf.virtuals/seekoff.pass.cpp
+++ libcxx/trunk/test/std/input.output/string.streams/stringbuf/stringbuf.virtuals/seekoff.pass.cpp
@@ -21,6 +21,30 @@
 int main()
 {
     {
+        std::stringbuf sb(std::ios_base::in);
+        assert(sb.pubseekoff(3, std::ios_base::beg, std::ios_base::out) == -1);
+        assert(sb.pubseekoff(3, std::ios_base::cur, std::ios_base::out) == -1);
+        assert(sb.pubseekoff(-3, std::ios_base::end, std::ios_base::out) == -1);
+        assert(sb.pubseekoff(3, std::ios_base::beg, std::ios_base::in | std::ios_base::out) == -1);
+        assert(sb.pubseekoff(3, std::ios_base::cur, std::ios_base::in | std::ios_base::out) == -1);
+        assert(sb.pubseekoff(-3, std::ios_base::end, std::ios_base::in | std::ios_base::out) == -1);
+        assert(sb.pubseekoff(0, std::ios_base::beg, std::ios_base::in) == 0);
+        assert(sb.pubseekoff(0, std::ios_base::cur, std::ios_base::in) == 0);
+        assert(sb.pubseekoff(0, std::ios_base::end, std::ios_base::in) == 0);
+    }
+    {
+        std::stringbuf sb(std::ios_base::out);
+        assert(sb.pubseekoff(3, std::ios_base::beg, std::ios_base::in) == -1);
+        assert(sb.pubseekoff(3, std::ios_base::cur, std::ios_base::in) == -1);
+        assert(sb.pubseekoff(-3, std::ios_base::end, std::ios_base::in) == -1);
+        assert(sb.pubseekoff(3, std::ios_base::beg, std::ios_base::in | std::ios_base::out) == -1);
+        assert(sb.pubseekoff(3, std::ios_base::cur, std::ios_base::in | std::ios_base::out) == -1);
+        assert(sb.pubseekoff(-3, std::ios_base::end, std::ios_base::in | std::ios_base::out) == -1);
+        assert(sb.pubseekoff(0, std::ios_base::beg, std::ios_base::out) == 0);
+        assert(sb.pubseekoff(0, std::ios_base::cur, std::ios_base::out) == 0);
+        assert(sb.pubseekoff(0, std::ios_base::end, std::ios_base::out) == 0);
+    }
+    {
         std::stringbuf sb("0123456789", std::ios_base::in);
         assert(sb.pubseekoff(3, std::ios_base::beg, std::ios_base::out) == -1);
         assert(sb.pubseekoff(3, std::ios_base::cur, std::ios_base::out) == -1);