Crash in cfgrelayex, Analyzed 2 dumps, total processed 41, rate equals 4.88%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
03e7e040 753d884e gdi32full!pcfLocateCFONT+0x8
03e7e3c0 753e7bc9 gdi32full!GetFontRealizationInfo+0xde
03e7e968 753d5404 gdi32full!LoadFont+0x69
03e7e98c 753d57f2 gdi32full!FindOrCreateFaceCache+0x98
03e7ea90 753dc284 gdi32full!FindOrCreateSizeCacheWithoutRealizationID+0x7f
03e7ee38 753da66a gdi32full!FindOrCreateSizeCacheUsingRealizationID+0x284
03e7ef44 753d9161 gdi32full!ScriptStringAnalyse+0x76a
03e7f0cc 753d8990 gdi32full!LpkCharsetDraw+0x611
03e7f0f8 768e1a02 gdi32full!LpkDrawTextEx+0x30
03e7f184 768e13fd user32!DT_GetLineBreak+0x122
03e7f244 768e11fe user32!DrawTextExWorker+0x1ed
03e7f260 7098480c user32!DrawTextExW+0x1e
03e7f6b0 70986f4b uxtheme!CThemeWnd::GetNcWindowMetrics+0x87c
03e7f75c 70986fdf uxtheme!_WindowPosChangedWorker+0x77
03e7f768 70983686 uxtheme!OnOwpPostWindowPosChanged+0x1f
03e7f7bc 768e7353 uxtheme!ThemePostWndProc+0x406
03e7f8a4 768e6e3a user32!UserCallWinProcCheckWow+0x463
03e7f908 768f4017 user32!DispatchClientMessage+0xea
03e7f948 772a28ed user32!__fnINLPWINDOWPOS+0x37
03e7f998 709a419f ntdll!KiUserCallbackDispatcher+0x4d
03e7f9c4 70983d7e uxtheme!OnOwpPreDwmCompositionChanged+0x4f
03e7fa20 768e7326 uxtheme!ThemePreWndProc+0x60e
03e7fb08 768e63db user32!UserCallWinProcCheckWow+0x436
03e7fb7c 768e61b0 user32!DispatchMessageWorker+0x21b
03e7fb88 556724f1 user32!DispatchMessageW+0x10
03e7fbac 55672247 CfgRelayEx!WTL::CMessageLoop::Run+0xc1
03e7fc0c 556748bf CfgRelayEx!CConfigCenterStub::Process+0xa7
03e7fc18 5569b53b CfgRelayEx!CThread::ThreadProc+0x1f
03e7fc54 74d1fe09 CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
03e7fc64 7729662d kernel32!BaseThreadInitThunk+0x19
03e7fcc0 772965fd ntdll!__RtlUserThreadStart+0x2f
03e7fcd0 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0357fba4 60d8345d ntdll!RtlInitUnicodeString+0x1b
0357fbec 60d83c0f CfgRelayEx!CChannelImpl::Run+0x3d
0357fbf4 60d9ffcb CfgRelayEx!CChannelImpl::ThreadImpl+0xf
0357fc30 7502343d CfgRelayEx!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0357fc3c 77399802 kernel32!BaseThreadInitThunk+0xe
0357fc7c 773997d5 ntdll!__RtlUserThreadStart+0x70
0357fc94 00000000 ntdll!_RtlUserThreadStart+0x1b