From 2868e9350a18aa5154cb7772c2f848bb5646bed2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gabriel=20Iv=C4=83ncescu?= <gabrielopcode@gmail.com>
Date: Wed, 15 Sep 2021 16:06:07 +0300
Subject: [PATCH] mshtml: Fix out-of-bounds props access.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Gabriel Ivăncescu <gabrielopcode@gmail.com>
Signed-off-by: Jacek Caban <jacek@codeweavers.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>
---
 dlls/mshtml/dispex.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/mshtml/dispex.c b/dlls/mshtml/dispex.c
index c7588006295..64ead8f115c 100644
--- a/dlls/mshtml/dispex.c
+++ b/dlls/mshtml/dispex.c
@@ -1736,7 +1736,7 @@ static HRESULT WINAPI DispatchEx_DeleteMemberByDispID(IDispatchEx *iface, DISPID
         DWORD idx = id - DISPID_DYNPROP_0;
         dynamic_prop_t *prop;
 
-        if(!get_dynamic_data(This) || idx > This->dynamic_data->prop_cnt)
+        if(!get_dynamic_data(This) || idx >= This->dynamic_data->prop_cnt)
             return S_OK;
 
         prop = This->dynamic_data->props + idx;