mshtml: Make sure actual host length matches returned BSTR length.

dlls/mshtml/htmllocation.c

@@ -351,13 +351,16 @@ static HRESULT WINAPI HTMLLocation_get_host(IHTMLLocation *iface, BSTR *p)
     if(url.nPort) {
         /* <hostname>:<port> */
         const WCHAR format[] = {'%','u',0};
-        DWORD len = url.dwHostNameLength + 1 + 5;
+        DWORD len, port_len;
+        WCHAR portW[6];
         WCHAR *buf;
 
+        port_len = snprintfW(portW, sizeof(portW)/sizeof(portW[0]), format, url.nPort);
+        len = url.dwHostNameLength + 1 /* ':' */ + port_len;
         buf = *p = SysAllocStringLen(NULL, len);
         memcpy(buf, url.lpszHostName, url.dwHostNameLength * sizeof(WCHAR));
         buf[url.dwHostNameLength] = ':';
-        snprintfW(buf + url.dwHostNameLength + 1, 6, format, url.nPort);
+        memcpy(buf + url.dwHostNameLength + 1, portW, port_len * sizeof(WCHAR));
     }else
         *p = SysAllocStringLen(url.lpszHostName, url.dwHostNameLength);
 

dlls/mshtml/tests/htmllocation.c

@@ -168,10 +168,15 @@ static void test_host(IHTMLLocation *loc, const struct location_test *test)
 
     hres = IHTMLLocation_get_host(loc, &str);
     ok(hres == S_OK, "%s: get_host failed: 0x%08x\n", test->name, hres);
-    if(hres == S_OK)
+    if(hres == S_OK){
+        int len = test->host ? strlen(test->host) : 0;
         ok(str_eq_wa(str, test->host),
                 "%s: expected retrieved host to be L\"%s\", was: %s\n",
                 test->name, test->host, wine_dbgstr_w(str));
+        ok(SysStringLen(str) == len, "%s: unexpected string length %u, expected %u\n",
+                test->name, SysStringLen(str), len);
+    }
+
     SysFreeString(str);
 }