Crash in riched20 caused by cryptui

[Juan Lang]

Hi Dylan, I wonder if you might be able to shed insight into this.
cryptui uses riched20 to display some text, and inserting an icon into
a richedit control causes a crash:

Assertion failed: (~para->member.para.nFlags & MEPF_REWRAP), function
ME_GetCursorCoordinates, file caret.c, line 183.

If I comment out the assertion, the icon gets displayed, a little
offset from where I expected it, but no other crashes appear.

I'm inserting the icon with:
    IRichEditOle_InsertObject(richEditOle, &reObject);
(in cryptui's main.c.)

The call stack isn't all that interesting, so I followed the call flow
a little by hand.

IRichEditOle_InsertObject is a wrapper that calls
IRichEditOle_fnInsertObject.  This calls ME_InsertOLEFromCursor, which
calls ME_InternalInsertTextFromCursor.  This calls
ME_InsertRunAtCursor.  ME_InsertRunAtCursor sets the MEPF_REWRAP flag:
  cursor->pPara->member.para.nFlags |= MEPF_REWRAP;
which, I believe, is what leads to the assertion.

Might you shed some insight into what the assertion is protecting
against, or better yet how I might avoid it?

If you have any interest in looking at it, I can send you a small .c
file with instructions on how to reproduce the crash.

Thanks,
--Juan