https://bugs.winehq.org/show_bug.cgi?id=10347
--- Comment #26 from super_man@post.com --- (In reply to Alistair Leslie-Hughes from comment #25)
Created attachment 53418 [details] patch
Obsoletes the other patches, as they are either partially accepted or no longer apply to the current source.
The crash is caused by the ti->lpszText parameter that is passed into this function, which has an invalid address. This address when passed to lstrlenW is causes the crash.
Confirming that the patch works.
Still an issue against current wine-git.