diff --git a/dlls/riched20/editor.c b/dlls/riched20/editor.c
index f90c353956..4efaa9001f 100644
--- a/dlls/riched20/editor.c
+++ b/dlls/riched20/editor.c
@@ -1732,6 +1732,7 @@ static LRESULT RichEditWndProc_common(HWND hWnd, UINT msg, WPARAM wParam,
     CHARFORMAT2W buf, *p;
     BOOL bRepaint = TRUE;
     p = ME_ToCF2W(&buf, (CHARFORMAT2W *)lParam);
+    if (p == NULL) return 0;
     if (!wParam || (editor->mode & TM_PLAINTEXT))
       ME_SetDefaultCharFormat(editor, p);
     else if (wParam == (SCF_WORD | SCF_SELECTION))
diff --git a/dlls/riched20/style.c b/dlls/riched20/style.c
index 48e29b5c25..0530c42d7f 100644
--- a/dlls/riched20/style.c
+++ b/dlls/riched20/style.c
@@ -60,8 +60,7 @@ CHARFORMAT2W *ME_ToCF2W(CHARFORMAT2W *to, CHARFORMAT2W *from)
     return to;
   }
 
-  assert(from->cbSize >= sizeof(CHARFORMAT2W));  
-  return from;
+  return (from->cbSize >= sizeof(CHARFORMAT2W)) ? from : NULL;
 }
 
 void ME_CopyToCF2W(CHARFORMAT2W *to, CHARFORMAT2W *from)
diff --git a/dlls/riched20/tests/editor.c b/dlls/riched20/tests/editor.c
index 7a092c3b85..416c803461 100644
--- a/dlls/riched20/tests/editor.c
+++ b/dlls/riched20/tests/editor.c
@@ -333,6 +333,80 @@ static void test_EM_SCROLLCARET(void)
   DestroyWindow(hwndRichEdit);
 }
 
+static void test_EM_SETCHARFORMAT(void)
+{
+  HWND hwndRichEdit = new_richedit(NULL);
+  CHARFORMAT2 cf2;
+  int rc = 0;
+
+  /* Invalid flags, CHARFORMAT2 structure blanked out */
+  memset(&cf2, 0, sizeof(cf2));
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) 0xfffffff0,
+             (LPARAM) &cf2);
+  ok(rc == 0, "EM_SETCHARFORMAT returned %d instead of 0\n", rc);
+
+  /* A valid flag, CHARFORMAT2 structure blanked out */
+  memset(&cf2, 0, sizeof(cf2));
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) SCF_DEFAULT,
+             (LPARAM) &cf2);
+  ok(rc == 0, "EM_SETCHARFORMAT returned %d instead of 0\n", rc);
+
+  /* A valid flag, CHARFORMAT2 structure blanked out */
+  memset(&cf2, 0, sizeof(cf2));
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) SCF_SELECTION,
+             (LPARAM) &cf2);
+  ok(rc == 0, "EM_SETCHARFORMAT returned %d instead of 0\n", rc);
+
+  /* A valid flag, CHARFORMAT2 structure blanked out */
+  memset(&cf2, 0, sizeof(cf2));
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) SCF_WORD,
+             (LPARAM) &cf2);
+  ok(rc == 0, "EM_SETCHARFORMAT returned %d instead of 0\n", rc);
+
+  /* A valid flag, CHARFORMAT2 structure blanked out */
+  memset(&cf2, 0, sizeof(cf2));
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) SCF_ALL,
+             (LPARAM) &cf2);
+  ok(rc == 0, "EM_SETCHARFORMAT returned %d instead of 0\n", rc);
+
+  /* Invalid flags, CHARFORMAT2 structure minimally filled */
+  memset(&cf2, 0, sizeof(cf2));
+  cf2.cbSize = sizeof(CHARFORMAT2);
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) 0xfffffff0,
+             (LPARAM) &cf2);
+  ok(rc == 1, "EM_SETCHARFORMAT returned %d instead of 1\n", rc);
+
+  /* A valid flag, CHARFORMAT2 structure minimally filled */
+  memset(&cf2, 0, sizeof(cf2));
+  cf2.cbSize = sizeof(CHARFORMAT2);
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) SCF_DEFAULT,
+             (LPARAM) &cf2);
+  ok(rc == 1, "EM_SETCHARFORMAT returned %d instead of 1\n", rc);
+
+  /* A valid flag, CHARFORMAT2 structure minimally filled */
+  memset(&cf2, 0, sizeof(cf2));
+  cf2.cbSize = sizeof(CHARFORMAT2);
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) SCF_SELECTION,
+             (LPARAM) &cf2);
+  ok(rc == 1, "EM_SETCHARFORMAT returned %d instead of 1\n", rc);
+
+  /* A valid flag, CHARFORMAT2 structure minimally filled */
+  memset(&cf2, 0, sizeof(cf2));
+  cf2.cbSize = sizeof(CHARFORMAT2);
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) SCF_WORD,
+             (LPARAM) &cf2);
+  ok(rc == 1, "EM_SETCHARFORMAT returned %d instead of 1\n", rc);
+
+  /* A valid flag, CHARFORMAT2 structure minimally filled */
+  memset(&cf2, 0, sizeof(cf2));
+  cf2.cbSize = sizeof(CHARFORMAT2);
+  rc = SendMessage(hwndRichEdit, EM_SETCHARFORMAT, (WPARAM) SCF_ALL,
+             (LPARAM) &cf2);
+  ok(rc == 1, "EM_SETCHARFORMAT returned %d instead of 1\n", rc);
+
+  DestroyWindow(hwndRichEdit);
+}
+
 static void test_EM_SETTEXTMODE(void)
 {
   HWND hwndRichEdit = new_richedit(NULL);
@@ -2125,6 +2199,7 @@ START_TEST( editor )
   test_EM_SCROLLCARET();
   test_EM_SCROLL();
   test_WM_SETTEXT();
+  test_EM_SETCHARFORMAT();
   test_EM_SETTEXTMODE();
   test_TM_PLAINTEXT();
   test_EM_SETOPTIONS();