From 65016636f4fd7cd25b9f061c3df0bddb760160d5 Mon Sep 17 00:00:00 2001
From: Eric Kohl <ekohl@abo.rhein-zeitung.de>
Date: Sun, 24 Jan 1999 19:09:56 +0000
Subject: [PATCH] Fixed pointer bugs in DPA_InsertPtr() and DPA_DeletePtr().

---
 dlls/comctl32/comctl32undoc.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/dlls/comctl32/comctl32undoc.c b/dlls/comctl32/comctl32undoc.c
index b3f8be45813..bd259b95e62 100644
--- a/dlls/comctl32/comctl32undoc.c
+++ b/dlls/comctl32/comctl32undoc.c
@@ -179,7 +179,7 @@ COMCTL32_ReAlloc (LPVOID lpSrc, DWORD dwSize)
 
 /**************************************************************************
  * Free [COMCTL32.73]
-.*
+ *
  * Frees an allocated memory block from the dll's private heap.
  *
  * PARAMS
@@ -1115,8 +1115,8 @@ DPA_InsertPtr (const HDPA hdpa, INT32 i, LPVOID p)
 	}
 	else {
 	    TRACE (commctrl, "-- inserting at %d\n", i);
-	    lpTemp = hdpa->ptrs + (sizeof(LPVOID) * i);
-	    lpDest = lpTemp + sizeof(LPVOID);
+	    lpTemp = hdpa->ptrs + i;
+	    lpDest = lpTemp + 1;
 	    nSize  = (hdpa->nItemCount - i) * sizeof(LPVOID);
 	    TRACE (commctrl, "-- move dest=%p src=%p size=%x\n",
 		   lpDest, lpTemp, nSize);
@@ -1216,8 +1216,8 @@ DPA_DeletePtr (const HDPA hdpa, INT32 i)
 
     /* do we need to move ?*/
     if (i < hdpa->nItemCount - 1) {
-	lpDest = hdpa->ptrs + (i * sizeof (LPVOID));
-	lpSrc = lpDest + sizeof(LPVOID);
+	lpDest = hdpa->ptrs + i;
+	lpSrc = lpDest + 1;
 	nSize = (hdpa->nItemCount - i - 1) * sizeof(LPVOID);
 	TRACE (commctrl,"-- move dest=%p src=%p size=%x\n",
 	       lpDest, lpSrc, nSize);