Jacek Caban (@jacek) commented about dlls/urlmon/uri.c:
*pbstrProperty = SysAllocStringLen(NULL, This->canon_len-This->userinfo_len); if(*pbstrProperty) {
unsigned int length;
/* Copy everything before the userinfo over. */ memcpy(*pbstrProperty, This->canon_uri, This->userinfo_start*sizeof(WCHAR));
/* Skip fragment if Uri_DISPLAY_NO_FRAGMENT is specified */
length = This->canon_len-(This->userinfo_start+This->userinfo_len+1);
if(dwFlags == Uri_DISPLAY_NO_FRAGMENT && This->fragment_start > -1)
length -= This->fragment_len;
It's too late, BSTRs carry string length, so we need to pass a precise length to `SysAllocStringLen`.