[Bug 40892] New: Charmap.exe crashes on close after copying a character

https://bugs.winehq.org/show_bug.cgi?id=40892

Bug ID: 40892
           Summary: Charmap.exe crashes on close after copying a character
           Product: Wine
           Version: 1.9.13
          Hardware: x86
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: ole32
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 54982
  --> https://bugs.winehq.org/attachment.cgi?id=54982
Backtrace of crash

Window's charmap application will crash if you try to close it after selecting
and copying a character from it's list.

Steps to reproduce.
1. Create clean 32-bit prefix using wine version 1.9.13

2. Obtain a copy of Window's charmap.exe and the required dll getuname.dll. (I
got mine from my Windows XP machine)

md5sum:
ac9fa2ba34225342a8897930503ae12f  charmap.exe
60b9959d333c3d11255d8695d2685430  getuname.dll

3. Open charmap.exe

4. Click the select button then click the copy button.

5. Close exit out of the application.

Backtrace will be attached in this post.

Looking at the backtrace it seems to crash in the clipboard uninitialization
function "OLEClipbrd_UnInitialize". Specifically in the inlined function
"IDataObject_Release". Here is the relevant code.

void OLEClipbrd_UnInitialize(void)
{
    ole_clipbrd *clipbrd = theOleClipboard;

TRACE("()\n");

if ( clipbrd )
    {
        static const WCHAR ole32W[] = {'o','l','e','3','2',0};
        HINSTANCE hinst = GetModuleHandleW(ole32W);

if ( clipbrd->window )
        {
            DestroyWindow(clipbrd->window);
            UnregisterClassW( clipbrd_wndclass, hinst );
        }

IStream_Release(clipbrd->marshal_data);
        if (clipbrd->src_data) IDataObject_Release(clipbrd->src_data);
        HeapFree(GetProcessHeap(), 0, clipbrd->cached_enum);
        HeapFree(GetProcessHeap(), 0, clipbrd);
        theOleClipboard = NULL;
    }
}

static FORCEINLINE ULONG IDataObject_Release(IDataObject* This) {
    return This->lpVtbl->Release(This);
}