user32: Fix segfault when combobox contains a longer text than buffer_limit.

dlls/user32/edit.c

@@ -3203,7 +3203,11 @@ static void EDIT_EM_ReplaceSel(EDITSTATE *es, BOOL can_undo, LPCWSTR lpsz_replac
 	 * such that buffer limit is honored. */
 	if ((honor_limit) && (size > es->buffer_limit)) {
 		EDIT_NOTIFY_PARENT(es, EN_MAXTEXT);
-		strl = es->buffer_limit - (tl - (e-s));
+		/* Buffer limit can be smaller than the actual length of text in combobox */
+		if (es->buffer_limit < (tl - (e-s)))
+			strl = 0;
+		else
+			strl = es->buffer_limit - (tl - (e-s));
 	}
 
 	if (!EDIT_MakeFit(es, tl - (e - s) + strl))