[Bug 29614] New: WinRAR viewer crashes on a particular file

http://bugs.winehq.org/show_bug.cgi?id=29614

Bug #: 29614
           Summary: WinRAR viewer crashes on a particular file
           Product: Wine
           Version: 1.3.37
          Platform: x86
               URL: http://www.rarlabs.com/rar/wrar401.exe
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: richedit
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
    Classification: Unclassified

Created attachment 38365
  --> http://bugs.winehq.org/attachment.cgi?id=38365
Test file

When trying to view the attached file, WinRAR crashes.

Steps to reproduce, download the file, install and run WinRAR, click Commands
-> View File (Alt + V).

(Viewer settings: view as Windows text, word wrap enabled).

caret.c:208: ME_GetCursorCoordinates: Assertion `~para->member.para.nFlags &
0x01' failed.
wine: Assertion failed at address 0xb776f424 (thread 0046), starting
debugger...
Unhandled exception: assertion failed in 32-bit code (0xb776f424).
Register dump:
 CS:0073 SS:007b DS:007b ES:007b FS:0033 GS:003b
 EIP:b776f424 ESP:00322904 EBP:0032291c EFLAGS:00000202(   - --  I   - - - )
 EAX:00000000 EBX:00006589 ECX:00006589 EDX:00000006
 ESI:b758b74a EDI:b75c7ff4
Stack dump:
0x00322904:  0032291c 00000006 00006589 b746d2f1
0x00322914:  b75c7ff4 00322a3c 00322a44 b746ed5e
0x00322924:  00000006 003229bc 00000000 b75c7ff4
0x00322934:  00000060 00000001 00322a54 00322980
0x00322944:  00000000 00000068 0000005c b75c93a0
0x00322954:  b75c7ff4 0000005c 0000005b 00322a2c
Backtrace:
=>0 0xb776f424 __kernel_vsyscall+0x10() in [vdso].so (0x0032291c)
  1 0xb746d2f1 gsignal+0x50() in libc.so.6 (0x0032291c)
  2 0xb746ed5e abort+0x17d() in libc.so.6 (0x00322a44)
  3 0xb7465c08 __assert_fail+0xf7() in libc.so.6 (0x00322a8c)
  4 0x7dbc5657 ME_MoveCaret+0x496() in riched20 (0x00322b5c)
  5 0x7dbd79c2 ME_PaintContent+0xc1() in riched20 (0x00322c0c)
  6 0x7dbd399d RichEditWndProc_common+0x3bc() in riched20 (0x00322ccc)
  7 0x7dbd3ccc RichEditWndProcW+0x2b() in riched20 (0x00322cfc)
  8 0x7ec2b4ea WINPROC_wrapper+0x19() in user32 (0x00322d2c)
  9 0x7ec2bc3c call_window_proc+0x5b() in user32 (0x00322d7c)
  10 0x7ec2e10d WINPROC_call_window+0x10c() in user32 (0x00322dcc)
  11 0x7ebf0b0e DispatchMessageW+0x9d() in user32 (0x00322ebc)
  12 0x0049aa76 in winrar (+0x9aa75) (0x00328308)
  13 0x7dbcf53b ME_HandleMessage+0xcba() in riched20 (0x00328c48)
  14 0x7dbd3764 RichEditWndProc_common+0x183() in riched20 (0x00328d08)
  15 0x7dbd3ccc RichEditWndProcW+0x2b() in riched20 (0x00328d38)
  16 0x7ec2b4ea WINPROC_wrapper+0x19() in user32 (0x00328d68)
  17 0x7ec2bc3c call_window_proc+0x5b() in user32 (0x00328db8)
  18 0x7ec2e10d WINPROC_call_window+0x10c() in user32 (0x00328e08)
  19 0x7ebeec61 call_window_proc+0x90() in user32 (0x00328e78)
  20 0x7ebf5456 send_message+0x205() in user32 (0x00328ef8)
  21 0x7ebf58cc SendMessageW+0x4b() in user32 (0x00328f48)
  22 0x0049dbf5 in winrar (+0x9dbf4) (0x7ebf5880)
  23 0x458b48ec (0x83e58955)
0xb776f424 __kernel_vsyscall+0x10 in [vdso].so: popl    %ebp
Modules:
...
Backtrace:
=>0 0xb776f424 __kernel_vsyscall+0x10() in [vdso].so (0x0032291c)
  1 0xb746d2f1 gsignal+0x50() in libc.so.6 (0x0032291c)
  2 0xb746ed5e abort+0x17d() in libc.so.6 (0x00322a44)
  3 0xb7465c08 __assert_fail+0xf7() in libc.so.6 (0x00322a8c)
  4 0x7dbc5657 ME_MoveCaret+0x496() in riched20 (0x00322b5c)
  5 0x7dbd79c2 ME_PaintContent+0xc1() in riched20 (0x00322c0c)
  6 0x7dbd399d RichEditWndProc_common+0x3bc() in riched20 (0x00322ccc)
  7 0x7dbd3ccc RichEditWndProcW+0x2b() in riched20 (0x00322cfc)
  8 0x7ec2b4ea WINPROC_wrapper+0x19() in user32 (0x00322d2c)
  9 0x7ec2bc3c call_window_proc+0x5b() in user32 (0x00322d7c)
  10 0x7ec2e10d WINPROC_call_window+0x10c() in user32 (0x00322dcc)
  11 0x7ebf0b0e DispatchMessageW+0x9d() in user32 (0x00322ebc)
  12 0x0049aa76 in winrar (+0x9aa75) (0x00328308)
  13 0x7dbcf53b ME_HandleMessage+0xcba() in riched20 (0x00328c48)
  14 0x7dbd3764 RichEditWndProc_common+0x183() in riched20 (0x00328d08)
  15 0x7dbd3ccc RichEditWndProcW+0x2b() in riched20 (0x00328d38)
  16 0x7ec2b4ea WINPROC_wrapper+0x19() in user32 (0x00328d68)
  17 0x7ec2bc3c call_window_proc+0x5b() in user32 (0x00328db8)
  18 0x7ec2e10d WINPROC_call_window+0x10c() in user32 (0x00328e08)
  19 0x7ebeec61 call_window_proc+0x90() in user32 (0x00328e78)
  20 0x7ebf5456 send_message+0x205() in user32 (0x00328ef8)
  21 0x7ebf58cc SendMessageW+0x4b() in user32 (0x00328f48)
  22 0x0049dbf5 in winrar (+0x9dbf4) (0x7ebf5880)
  23 0x458b48ec (0x83e58955)