rlm_expr overflow bug