From: "Gabriel Ivăncescu" <gabrielopcode@gmail.com>
Subject: [PATCH] mshtml: Fix out-of-bounds props access.
Message-Id: <e16383711ac62f1731bf408ac8b276f43cc5248a.1631710984.git.gabrielopcode@gmail.com>
Date: Wed, 15 Sep 2021 16:06:07 +0300

Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
---
 dlls/mshtml/dispex.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/mshtml/dispex.c b/dlls/mshtml/dispex.c
index c758800..64ead8f 100644
--- a/dlls/mshtml/dispex.c
+++ b/dlls/mshtml/dispex.c
@@ -1736,7 +1736,7 @@ static HRESULT WINAPI DispatchEx_DeleteMemberByDispID(IDispatchEx *iface, DISPID
         DWORD idx = id - DISPID_DYNPROP_0;
         dynamic_prop_t *prop;
 
-        if(!get_dynamic_data(This) || idx > This->dynamic_data->prop_cnt)
+        if(!get_dynamic_data(This) || idx >= This->dynamic_data->prop_cnt)
             return S_OK;
 
         prop = This->dynamic_data->props + idx;

-- 
2.31.1