From: Dmitry Timoshkov Subject: [PATCH] ieframe: Fix position vs. length check in the go_forward() helper. Message-Id: <20220121133711.59cfff37d22d2a3aa513f396@baikal.ru> Date: Fri, 21 Jan 2022 13:37:11 +0300 This->travellog.position is 0 based while This->travellog.length is a total counter. So, with current comparison if(This->travellog.position >= This->travellog.length) go_forward() would jump to an invalid index if position == 1 and length == 2. This patch fixes a crash while navigating html help file that I have here. Signed-off-by: Dmitry Timoshkov --- dlls/ieframe/navigate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dlls/ieframe/navigate.c b/dlls/ieframe/navigate.c index 9efdacc080e..82d1399334f 100644 --- a/dlls/ieframe/navigate.c +++ b/dlls/ieframe/navigate.c @@ -1127,7 +1127,7 @@ HRESULT go_back(DocHost *This) HRESULT go_forward(DocHost *This) { - if(This->travellog.position >= This->travellog.length) { + if(This->travellog.position+1 >= This->travellog.length) { WARN("No history available\n"); return E_FAIL; } -- 2.34.1