https://bugs.winehq.org/show_bug.cgi?id=40832
--- Comment #15 from Roman Pisl rpisl@seznam.cz --- This bug is NOT fixed by http://source.winehq.org/git/wine.git/commit/9de8ea75645d7092f888ddd7572f352... which fixed a buffer overflow.
This bug is caused by a NULL pointer that is dereferenced when EM_REPLACESEL is called after EM_GETHANDLE.