--- lbbs/src/article_favor.c	2025/10/15 03:02:17	1.3
+++ lbbs/src/article_favor.c	2025/10/24 02:07:01	1.5
@@ -148,9 +148,9 @@ int article_favor_save_inc(const ARTICLE
 			 "DELETE FROM article_favorite WHERE UID = %d AND AID IN (",
 			 p_favor->uid);
 
-	for (i = 0, j = 0; i < p_favor->aid_base_cnt && j < p_favor->aid_inc_cnt;)
+	for (i = 0, j = 0; j < p_favor->aid_inc_cnt;)
 	{
-		if (p_favor->aid_base[i] == p_favor->aid_inc[j]) // XOR - delete record
+		if (i < p_favor->aid_base_cnt && p_favor->aid_base[i] == p_favor->aid_inc[j]) // XOR - delete record
 		{
 			snprintf(tuple_tmp, sizeof(tuple_tmp), "%d, ", p_favor->aid_inc[j]);
 			strncat(sql_del, tuple_tmp, sizeof(sql_del) - 1 - strnlen(sql_del, sizeof(sql_del)));
@@ -159,11 +159,11 @@ int article_favor_save_inc(const ARTICLE
 			i++;
 			j++;
 		}
-		else if (p_favor->aid_base[i] < p_favor->aid_inc[j]) // skip existing record
+		else if (i < p_favor->aid_base_cnt && p_favor->aid_base[i] < p_favor->aid_inc[j]) // skip existing record
 		{
 			i++;
 		}
-		else // if (p_favor->aid_base[i] > p_favor->aid_inc[j])
+		else // if (i >= p_favor->aid_base_cnt || p_favor->aid_base[i] > p_favor->aid_inc[j])
 		{
 			snprintf(tuple_tmp, sizeof(tuple_tmp),
 					 "(%d, %d), ",
@@ -321,7 +321,7 @@ int article_favor_check(int32_t aid, con
 			mid = (left + right) / 2;
 			if (aid < (i == 0 ? p_favor->aid_base[mid] : p_favor->aid_inc[mid]))
 			{
-				right = mid;
+				right = mid - 1;
 			}
 			else if (aid > (i == 0 ? p_favor->aid_base[mid] : p_favor->aid_inc[mid]))
 			{
@@ -372,7 +372,7 @@ int article_favor_set(int32_t aid, ARTIC
 			mid = (left + right) / 2;
 			if (aid < (i == 0 ? p_favor->aid_base[mid] : p_favor->aid_inc[mid]))
 			{
-				right = mid;
+				right = mid - 1;
 			}
 			else if (aid > (i == 0 ? p_favor->aid_base[mid] : p_favor->aid_inc[mid]))
 			{