The test sets in fill_url_components the dwPasswordLength to 8, therefore the memcpy copies 8 wide characters. But before this patch variable empty allocates just one wide character.
[ASan report details](https://gitlab.winehq.org/bernhardu/wine/-/blob/asan-pe_2025-10-18_wine-10.1...)
-- v2: winhttp/tests: Fix setting string lengths in WinHttpCreateUrl_test (ASan).