--- lbbs/src/article_view_log.c	2025/10/15 03:02:17	1.13
+++ lbbs/src/article_view_log.c	2025/10/24 02:07:01	1.15
@@ -185,6 +185,7 @@ int article_view_log_merge_inc(ARTICLE_V
 	int32_t *aid_new;
 	int aid_new_cnt;
 	int i, j, k;
+	int len;
 
 	if (p_view_log == NULL)
 	{
@@ -225,10 +226,20 @@ int article_view_log_merge_inc(ARTICLE_V
 		}
 	}
 
-	memcpy(aid_new + k, p_view_log->aid_base + i, sizeof(int32_t) * (size_t)(p_view_log->aid_base_cnt - i));
-	k += (p_view_log->aid_base_cnt - i);
-	memcpy(aid_new + k, p_view_log->aid_inc + j, sizeof(int32_t) * (size_t)(p_view_log->aid_inc_cnt - j));
-	k += (p_view_log->aid_inc_cnt - j);
+	len = p_view_log->aid_base_cnt - i;
+	if (len > 0)
+	{
+		memcpy(aid_new + k, p_view_log->aid_base + i,
+			   sizeof(int32_t) * (size_t)len);
+		k += len;
+	}
+	len = p_view_log->aid_inc_cnt - j;
+	if (len > 0)
+	{
+		memcpy(aid_new + k, p_view_log->aid_inc + j,
+			   sizeof(int32_t) * (size_t)len);
+		k += len;
+	}
 
 	free(p_view_log->aid_base);
 	p_view_log->aid_base = aid_new;
@@ -267,7 +278,7 @@ int article_view_log_is_viewed(int32_t a
 			mid = (left + right) / 2;
 			if (aid < (i == 0 ? p_view_log->aid_base[mid] : p_view_log->aid_inc[mid]))
 			{
-				right = mid;
+				right = mid - 1;
 			}
 			else if (aid > (i == 0 ? p_view_log->aid_base[mid] : p_view_log->aid_inc[mid]))
 			{
@@ -316,7 +327,7 @@ int article_view_log_set_viewed(int32_t
 			mid = (left + right) / 2;
 			if (aid < (i == 0 ? p_view_log->aid_base[mid] : p_view_log->aid_inc[mid]))
 			{
-				right = mid;
+				right = mid - 1;
 			}
 			else if (aid > (i == 0 ? p_view_log->aid_base[mid] : p_view_log->aid_inc[mid]))
 			{