[Bug 10439] Raddecay crashes with:"Access violation in riched20.dll"

http://bugs.winehq.org/show_bug.cgi?id=10439

Alex Villacís Lasso  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Alex Villacís Lasso   2007-12-07 15:18:27 ---
Bug still exists in 0.9.50 git. App is using riched32 (richedit 1.0).

Traced it down to a broken linked list at dlls/riched20/para.c at line 100:

void ME_MarkForPainting(ME_TextEditor *editor, ME_DisplayItem *first, const
ME_DisplayItem *last)
{
  while(first != last)
  {
    first->member.para.nFlags |= MEPF_REPAINT;
    first = first->member.para.next_para;         // <-- next_para is NULL
(BUG!)
  }
}

Somehow first->member.para.next_para is unexpectedly NULL, but last != NULL, so
a null pointer access occurs. Currently a NULL pointer check averts the crash,
but this particular pointer should not be NULL in the first place.