Jacek Caban (@jacek) commented about dlls/urlmon/uri.c:
*pbstrProperty = SysAllocStringLen(NULL, This->canon_len-This->userinfo_len);
if(*pbstrProperty) { + unsigned int length; + /* Copy everything before the userinfo over. */ memcpy(*pbstrProperty, This->canon_uri, This->userinfo_start*sizeof(WCHAR)); + + /* Skip fragment if Uri_DISPLAY_NO_FRAGMENT is specified */ + length = This->canon_len-(This->userinfo_start+This->userinfo_len+1); + if(dwFlags == Uri_DISPLAY_NO_FRAGMENT && This->fragment_start > -1) + length -= This->fragment_len;
It's too late, BSTRs carry string length, so we need to pass a precise length to `SysAllocStringLen`. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/6796#note_87223