do not depend on signed integer overflow