This->travellog.position is 0 based while This->travellog.length is a total counter. So, with current comparison if(This->travellog.position >= This->travellog.length) go_forward() would jump to an invalid index if position == 1 and length == 2. This patch fixes a crash while navigating html help file that I have here. Signed-off-by: Dmitry Timoshkov <dmitry(a)baikal.ru> --- dlls/ieframe/navigate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dlls/ieframe/navigate.c b/dlls/ieframe/navigate.c index 9efdacc080e..82d1399334f 100644 --- a/dlls/ieframe/navigate.c +++ b/dlls/ieframe/navigate.c @@ -1127,7 +1127,7 @@ HRESULT go_back(DocHost *This) HRESULT go_forward(DocHost *This) { - if(This->travellog.position >= This->travellog.length) { + if(This->travellog.position+1 >= This->travellog.length) { WARN("No history available\n"); return E_FAIL; } -- 2.34.1