diff --git a/dlls/riched20/editor.c b/dlls/riched20/editor.c
index e35e3cb..ce754b9 100644
--- a/dlls/riched20/editor.c
+++ b/dlls/riched20/editor.c
@@ -3544,6 +3544,7 @@ static LRESULT RichEditWndProc_common(HWND hWnd, UINT msg, WPARAM wParam,
         nCharOfs = lParam;
     nLength = ME_GetTextLength(editor);
     nCharOfs = min(nCharOfs, nLength);
+    nCharOfs = max(nCharOfs, 0);
 
     ME_RunOfsFromCharOfs(editor, nCharOfs, &pRun, &nOffset);
     assert(pRun->type == diRun);
diff --git a/dlls/riched20/tests/editor.c b/dlls/riched20/tests/editor.c
index 2c803ae..7748d92 100644
--- a/dlls/riched20/tests/editor.c
+++ b/dlls/riched20/tests/editor.c
@@ -649,6 +649,10 @@ static void test_EM_POSFROMCHAR(void)
               SendMessage(hwndRichEdit, WM_GETTEXTLENGTH, 0, 0)+1);
   ok(pt.x == xpos, "pt.x = %d\n", pt.x);
 
+  /* Try a negative position. */
+  SendMessage(hwndRichEdit, EM_POSFROMCHAR, (WPARAM)&pt, -1);
+  ok(pt.x == 1, "pt.x = %d\n", pt.x);
+
   DestroyWindow(hwndRichEdit);
 }