[PATCH 0/1] MR9338: itss: Avoid reading beyond buffer end in ITSProtocol_Start (ASan).

[Bernhard Übelacker (＠bernhardu)]

[ASan report details](https://gitlab.winehq.org/bernhardu/wine/-/blob/asan-pe_2025-10-18_wine-10.1...)

[PATCH 1/1] itss: Avoid reading beyond buffer end in ITSProtocol_Start (ASan).

[Bernhard Übelacker]

From: Bernhard Übelacker

---
 dlls/itss/protocol.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/itss/protocol.c b/dlls/itss/protocol.c
index cb1df3c2e1a..d1ee38191e4 100644
--- a/dlls/itss/protocol.c
+++ b/dlls/itss/protocol.c
@@ -250,7 +250,7 @@ static HRESULT WINAPI ITSProtocol_Start(IInternetProtocol *iface, LPCWSTR szUrl,

len = lstrlenW(ptr)+3;
     file_name = HeapAlloc(GetProcessHeap(), 0, len*sizeof(WCHAR));
-    memcpy(file_name, ptr, len*sizeof(WCHAR));
+    memcpy(file_name, ptr, (len-2)*sizeof(WCHAR));
     hres = UrlUnescapeW(file_name, NULL, &len, URL_UNESCAPE_INPLACE);
     if(FAILED(hres)) {
         WARN("UrlUnescape failed: %08lx\n", hres);