[PATCH 0/1] MR9339: winhttp/tests: Avoid buffer-overflow in WinHttpCreateUrl_test (ASan).

[Bernhard Übelacker]

The test sets in fill_url_components the dwPasswordLength to 8,
therefore the memcpy copies 8 wide characters.
But before this patch variable empty allocates just one wide character.

[ASan report details](https://gitlab.winehq.org/bernhardu/wine/-/blob/asan-pe_2025-10-18_wine-10.1...)

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9339

[PATCH 1/1] winhttp/tests: Avoid buffer-overflow in WinHttpCreateUrl_test (ASan).

[Bernhard Übelacker]

From: Bernhard Übelacker <bernhardu(a)mailbox.org>

The test sets in fill_url_components the dwPasswordLength to 8,
therefore the memcpy copies 8 wide characters.
But before this patch variable empty allocates just one wide character.
---
 dlls/winhttp/tests/url.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/winhttp/tests/url.c b/dlls/winhttp/tests/url.c
index fadf8b850ca..299113e4782 100644
--- a/dlls/winhttp/tests/url.c
+++ b/dlls/winhttp/tests/url.c
@@ -25,7 +25,7 @@
 
 #include "wine/test.h"
 
-static WCHAR empty[]    = {0};
+static WCHAR empty[8]   = {0};
 static WCHAR ftp[]      = {'f','t','p',0};
 static WCHAR http[]     = {'h','t','t','p',0};
 static WCHAR winehq[]   = {'w','w','w','.','w','i','n','e','h','q','.','o','r','g',0};
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/9339

[Hans Leidekker (＠hans)]

Please set dwPasswordLength to zero in that test instead.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/9339#note_120390