You're right. I didn't think it through enough. If pchEnd doesn't overflow, then pch always exits the loop equal to pchEnd (assuming no breaks or returns). If it does overflow, the loop never starts. There is no case in which it goes into an infinite loop.
I (and Steve Maguire) had assumed that if pch were 0xFFFFFFFF - size and pchEnd were 0xFFFFFFFF, then it would run into an infinite loop, but it won't; neither pointer will overflow in that case.
It would only run into an infinite loop if you wrote something like this:
pchEnd = pch + size - 1;
while (pch <= pchEnd)
where pch + size is 0 (due to overflow), thus pch + size - 1 is the maximum possible pointer.
I (and Steve Maguire) had assumed that if pch were 0xFFFFFFFF - size and pchEnd were 0xFFFFFFFF, then it would run into an infinite loop, but it won't; neither pointer will overflow in that case.
It would only run into an infinite loop if you wrote something like this:
where pch + size is 0 (due to overflow), thus pch + size - 1 is the maximum possible pointer.