Jacek Caban : mshtml: Fixed increasing buffer size logic in text range implementation.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 3fc0c731592dc82d8f6a2614b3ab02fb2556a999
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=3fc0c731592dc82d8f6a2614b3ab02fb2556a999

Author: Jacek Caban <jacek at codeweavers.com>
Date:   Mon Oct 13 14:50:13 2008 -0500

mshtml: Fixed increasing buffer size logic in text range implementation.

---

 dlls/mshtml/txtrange.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dlls/mshtml/txtrange.c b/dlls/mshtml/txtrange.c
index 78ca90c..5a71ab3 100644
--- a/dlls/mshtml/txtrange.c
+++ b/dlls/mshtml/txtrange.c
@@ -193,7 +193,7 @@ static inline void wstrbuf_finish(wstrbuf_t *buf)
 static void wstrbuf_append_len(wstrbuf_t *buf, LPCWSTR str, int len)
 {
     if(buf->len+len >= buf->size) {
-        buf->size = 2*buf->len+len;
+        buf->size = 2*buf->size+len;
         buf->buf = heap_realloc(buf->buf, buf->size * sizeof(WCHAR));
     }
 
@@ -210,7 +210,7 @@ static void wstrbuf_append_nodetxt(wstrbuf_t *buf, LPCWSTR str, int len)
     TRACE("%s\n", debugstr_wn(str, len));
 
     if(buf->len+len >= buf->size) {
-        buf->size = 2*buf->len+len;
+        buf->size = 2*buf->size+len;
         buf->buf = heap_realloc(buf->buf, buf->size * sizeof(WCHAR));
     }