July 16, 2026
8:03 a.m.
InternetCrackUrlW would read past the end of the string when parsing a \"file:\" URL with an empty path and an immediate fragment, e.g., \"file://#\". Add a check for this case and return ERROR_INVALID_PARAMETER as expected. Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=59973 -- v4: wininet: Fix out-of-bounds read in InternetCrackUrlW for empty file paths. https://gitlab.winehq.org/wine/wine/-/merge_requests/11347