Pointer subtraction is only valid for pointers within the same object. To overflow a signed ptrdiff_t, you'd need to allocate an array of char with more than 2^31 elements. This can be done on some systems, but it's really rare.