Jacek Caban (@jacek) commented about dlls/kernelbase/path.c:
next = (WCHAR) ih; src += 2; /* Advance to end of escape */
if (flags & URL_UNESCAPE_AS_UTF8)
{
utf8_buf[0] = ih;
utf8_len = get_utf8_len(ih);
for (i = 1; i < utf8_len; i++)
{
memcpy(buf + 2, src + 2, 2 * sizeof(WCHAR));
StrToIntExW(buf, STIF_SUPPORT_HEX, &ih);
/* Check if it is a valid continuation byte. */
if ((ih & 0xc0) == 0x80)
{
utf8_buf[i] = ih;
src += 3;
Here you assume that src[2] == '%', but what if it's not? Please add more tests.