new valgrind errors in riched20

[Dan Kegel]

Seem to be four or so new valgrind warnings in riched20 today,
probably due to Dylan's changes (though my cat may have been
sufing to friskies.com and affected the results, who knows):
http://kegel.com/wine/valgrind/logs-2008-06-27/vg-riched20_editor-diff.txt

+ Invalid read of size 4
+    at  ME_AddUndoItem (undo.c:59)
+    by  ME_SetParaFormat (para.c:362)
+    by  ME_PlayUndoItem (undo.c:288)
+    by  ME_Undo (undo.c:360)
+    by  RichEditWndProc_common (editor.c:2067)
+    by  RichEditWndProcA (editor.c:3386)
+    by  ??? (library.h:163)
+    by  call_window_proc (winproc.c:457)
+    by  WINPROC_call_window (winproc.c:2207)
+    by  call_window_proc (message.c:1639)
+    by  send_message (message.c:2463)
+    by  SendMessageA (message.c:2608)
+    by  test_EM_SETUNDOLIMIT (editor.c:2238)
+    by  func_editor (editor.c:4581)
+    by  run_test (test.h:449)
+    by  main (test.h:498)

...

+ Conditional jump or move depends on uninitialised value(s)
+    at  test_EM_AUTOURLDETECT (editor.c:1719)
+    by  func_editor (editor.c:4600)
+    by  run_test (test.h:449)
+    by  main (test.h:498)
+  Uninitialised value was created by a client request
+    at  mark_block_uninitialized (heap.c:164)
+    by  RtlAllocateHeap (heap.c:1239)
+    by  heap_alloc (editor.h:28)
+    by  RichEditWndProc_common (editor.c:2573)
+    by  RichEditWndProcA (editor.c:3386)
+    by  ??? (library.h:163)
+    by  call_window_proc (winproc.c:457)
+    by  WINPROC_call_window (winproc.c:2207)
+    by  call_window_proc (message.c:1639)
+    by  send_message (message.c:2463)
+    by  SendMessageA (message.c:2608)
+    by  test_EM_AUTOURLDETECT (editor.c:1705)
+    by  func_editor (editor.c:4600)
+    by  run_test (test.h:449)
+    by  main (test.h:498)

...

+ Invalid write of size 4
+    at  ME_AddUndoItem (undo.c:62)
+    by  ME_InternalDeleteText (caret.c:322)
+    by  ME_PlayUndoItem (undo.c:308)
+    by  ME_Undo (undo.c:360)
+    by  RichEditWndProc_common (editor.c:2067)
+    by  RichEditWndProcW (editor.c:3381)
+    by  ??? (library.h:163)
+    by  call_window_proc (winproc.c:457)
+    by  WINPROC_CallProcAtoW (winproc.c:1011)
+    by  WINPROC_call_window (winproc.c:2209)
+    by  call_window_proc (message.c:1639)
+    by  send_message (message.c:2463)
+    by  SendMessageA (message.c:2608)
+    by  test_undo_coalescing (editor.c:4398)
+    by  func_editor (editor.c:4602)
+    by  run_test (test.h:449)
+    by  main (test.h:498)

...

+ Conditional jump or move depends on uninitialised value(s)
+    at  ME_AddUndoItem (undo.c:59)
+    by  ME_InternalDeleteText (caret.c:322)
+    by  ME_PlayUndoItem (undo.c:308)
+    by  ME_Undo (undo.c:360)
+    by  RichEditWndProc_common (editor.c:2067)
+    by  RichEditWndProcW (editor.c:3381)
+    by  ??? (library.h:163)
+    by  call_window_proc (winproc.c:457)
+    by  WINPROC_CallProcAtoW (winproc.c:1011)
+    by  WINPROC_call_window (winproc.c:2209)
+    by  call_window_proc (message.c:1639)
+    by  send_message (message.c:2463)
+    by  SendMessageA (message.c:2608)
+    by  test_undo_coalescing (editor.c:4398)
+    by  func_editor (editor.c:4602)
+    by  run_test (test.h:449)
+    by  main (test.h:498)
+  Uninitialised value was created by a client request
+    at  mark_block_uninitialized (heap.c:164)
+    by  RtlAllocateHeap (heap.c:1239)
+    by  heap_alloc (editor.h:28)
+    by  ME_MakeStringN (string.c:46)
+    by  ME_InternalDeleteText (caret.c:326)
+    by  ME_PlayUndoItem (undo.c:308)
+    by  ME_Undo (undo.c:360)
+    by  RichEditWndProc_common (editor.c:2067)
+    by  RichEditWndProcW (editor.c:3381)
+    by  ??? (library.h:163)
+    by  call_window_proc (winproc.c:457)
+    by  WINPROC_CallProcAtoW (winproc.c:1011)
+    by  WINPROC_call_window (winproc.c:2209)
+    by  call_window_proc (message.c:1639)
+    by  send_message (message.c:2463)
+    by  SendMessageA (message.c:2608)
+    by  test_undo_coalescing (editor.c:4398)
+    by  func_editor (editor.c:4602)
+    by  run_test (test.h:449)
+    by  main (test.h:498)