Alex Henrie (@alexhenrie) commented about dlls/gdi32/text.c:
static void logfont_AtoW( const LOGFONTA *fontA, LPLOGFONTW fontW ) { memcpy( fontW, fontA, sizeof(LOGFONTA) - LF_FACESIZE ); - MultiByteToWideChar( CP_ACP, 0, fontA->lfFaceName, strnlen( fontA->lfFaceName, LF_FACESIZE ), + MultiByteToWideChar( CP_ACP, 0, fontA->lfFaceName, strnlen( fontA->lfFaceName, LF_FACESIZE - 1 ) + 1, fontW->lfFaceName, LF_FACESIZE ); fontW->lfFaceName[LF_FACESIZE - 1] = 0; This line actually isn't right either because if CP_ACP is a variable-length encoding such as UTF-8 and the source string is not null-terminated, the destination string could be shorter than the source string and the null terminator would not be placed in the correct location. I'll send a better fix.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/7956#note_102416