diff --git a/dlls/hhctrl.ocx/stream.c b/dlls/hhctrl.ocx/stream.c
index 6e831e579f9..84ed317cda2 100644
--- a/dlls/hhctrl.ocx/stream.c
+++ b/dlls/hhctrl.ocx/stream.c
@@ -122,7 +122,7 @@ static BOOL find_node_end(stream_t *stream, strbuf_t *buf)
         if(buf->len == 0)
             break;
         p = &buf->buf[b];
-        while((p = memchr(p+1, '"', buf->len-(p-buf->buf))) != NULL)
+        while((p = memchr(p+1, '"', buf->len-(p+1-buf->buf))) != NULL)
             tag_count++;
         b = buf->len;
         if(tag_count % 2 != 0)