This->travellog.position is 0 based while This->travellog.length is a total counter. So, with current comparison if(This->travellog.position >= This->travellog.length) go_forward() would jump to an invalid index if position == 1 and length == 2.
This patch fixes a crash while navigating html help file that I have here.
Signed-off-by: Dmitry Timoshkov dmitry@baikal.ru --- dlls/ieframe/navigate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/dlls/ieframe/navigate.c b/dlls/ieframe/navigate.c index 9efdacc080e..82d1399334f 100644 --- a/dlls/ieframe/navigate.c +++ b/dlls/ieframe/navigate.c @@ -1127,7 +1127,7 @@ HRESULT go_back(DocHost *This)
HRESULT go_forward(DocHost *This) { - if(This->travellog.position >= This->travellog.length) { + if(This->travellog.position+1 >= This->travellog.length) { WARN("No history available\n"); return E_FAIL; }