[Bug 29879] New: Wine's help viewer crashes on a particular CHM file

http://bugs.winehq.org/show_bug.cgi?id=29879

Bug #: 29879
           Summary: Wine's help viewer crashes on a particular CHM file
           Product: Wine
           Version: 1.4-rc3
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: hhctrl.ocx
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]
    Classification: Unclassified

Specifically it crashes on nthelp.chm from Windows XP SP3 (English).

Since Wine developers shun files from Windows, I've uploaded it here:
http://ompldr.org/vY3NwdQ

Unhandled exception: page fault on read access to 0x00000004 in 32-bit code
(0x7eb18dc0).
Register dump:
 CS:0073 SS:007b DS:007b ES:007b FS:0033 GS:003b
 EIP:7eb18dc0 ESP:0033f110 EBP:0033f128 EFLAGS:00010202(  R- --  I   - - - )
 EAX:0015bfa8 EBX:7eb35e08 ECX:7eb3b704 EDX:00000000
 ESI:00154468 EDI:00000000
Stack dump:
0x0033f110:  000004d4 00000000 0033f168 7eb35e08
0x0033f120:  00154468 000004d4 0033f168 7eab62e3
0x0033f130:  000004d4 000004d4 00000000 00000000
0x0033f140:  00000000 00000018 00cc0020 00000168
0x0033f150:  00000018 000005a0 7eab61bb 7ed51ba4
0x0033f160:  0015bab0 00000000 0033f1f8 7ecbc291
Backtrace:
=>0 0x7eb18dc0 AbortPath+0x20() in gdi32 (0x0033f128)
  1 0x7eab62e3 DeleteDC+0x132() in gdi32 (0x0033f168)
  2 0x7ecbc291 ImageList_Add+0x2b0() in comctl32 (0x0033f1f8)
  3 0x7ecbc580 ImageList_AddMasked+0x1bf() in comctl32 (0x0033f278)
  4 0x7ed123d4 TOOLBAR_AddBitmapToImageList.clone+0xe3() in comctl32
(0x0033f2d8)
  5 0x7ed18423 TOOLBAR_AddBitmap+0xe2() in comctl32 (0x0033f348)
  6 0x7ed1be4c ToolbarWindowProc+0x1d1b() in comctl32 (0x0033f4f8)
  7 0x7ebfc58a WINPROC_wrapper+0x19() in user32 (0x0033f528)
  8 0x7ebfccdc call_window_proc+0x5b() in user32 (0x0033f578)
  9 0x7ebff1ad WINPROC_call_window+0x10c() in user32 (0x0033f5c8)
  10 0x7ebbfd01 call_window_proc+0x90() in user32 (0x0033f638)
  11 0x7ebc64f6 send_message+0x205() in user32 (0x0033f6b8)
  12 0x7ebc696c SendMessageW+0x4b() in user32 (0x0033f708)
  13 0x7ed976ef CreateViewer+0x50e() in hhctrl (0x0033fa68)
  14 0x7ed9a208 CreateHelpViewer+0x97() in hhctrl (0x0033fa88)
  15 0x7ed9a899 HtmlHelpW+0x218() in hhctrl (0x0033fcf8)
  16 0x7ed9b035 doWinMain+0x1e4() in hhctrl (0x0033fd88)
  17 0x7effe537 WinMain+0x46() in hh (0x0033fda8)
  18 0x7effe68f main+0xae() in hh (0x0033fe28)
  19 0x7effe5cc __wine_spec_exe_entry+0x7b() in hh (0x0033fe70)
  20 0x7b85a08c call_process_entry+0xb() in kernel32 (0x0033fe88)
  21 0x7b85b25f start_process+0x5e() in kernel32 (0x0033fec8)
  22 0x7bc70fb0 call_thread_func_wrapper+0xb() in ntdll (0x0033fed8)
  23 0x7bc739ed call_thread_func+0x7c() in ntdll (0x0033ffa8)
  24 0x7bc70f8e call_thread_entry_point+0x11() in ntdll (0x0033ffc8)
  25 0x7bc49efe start_process+0x1d() in ntdll (0x0033ffe8)
  26 0xb76597cd wine_call_on_stack+0x1c() in libwine.so.1 (0x00000000)
0x7eb18dc0 AbortPath+0x20 in gdi32: movl        0x4(%edx),%edi