http://bugs.winehq.org/show_bug.cgi?id=60236 Bug ID: 60236 Summary: riched20: uninitialized ITextHost format pointers crash SketchUp LayOut 2026 Product: Wine Version: unspecified Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: richedit Assignee: wine-bugs@list.winehq.org Reporter: dante.dex.arch@gmail.com Target Milestone: --- Distribution: --- Created attachment 81930 --> http://bugs.winehq.org/attachment.cgi?id=81930 fix_richedit_layout2026.patch SketchUp LayOut 2026 crashes while initializing its RTF text services when Wine's builtin RichEdit implementation is used. Wine calls `ITextHost::TxGetCharFormat()` and `ITextHost::TxGetParaFormat()` with uninitialized pointer values. The text host reached through `LayOutRTF.dll` follows native Microsoft text-services behavior: it may fill the writable format storage supplied through the pointer instead of replacing the pointer. Under Wine, this writes through an indeterminate address and causes an access violation. The relevant Wine code currently declares these locals without initializing them: ``` const CHARFORMATW *host_cf; const PARAFORMAT2 *host_fmt; ``` They are then passed to the host callbacks: ``` ITextHost_TxGetCharFormat(editor->texthost, &host_cf); ITextHost_TxGetParaFormat(editor->texthost, (const PARAFORMAT **)&host_fmt); ``` Native Microsoft text services pass initialized writable default-format storage. Initializing the pointers to suitable local format storage prevents the crash while preserving compatibility with hosts that replace the pointer. I reproduced the failure with stock Wine Staging 11.15 and 11.14, and with the Wine 11.0 runtime used by GE-Proton 11-5. Rebuilding their builtin `riched20.dll` with the attached patch allows LayOut to pass repeated RTF stream initialization and also allows SketchUp's **Send to LayOut** child process to pass this initialization point. No native Microsoft `msftedit.dll` is installed in these tests. The issue testing and research was done by GPT 5.6 Sol, who also wrote the patch. So, it is not a ready-to-merge patch, but a proof of fix. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.