We don't support any long protocol names so we can use a smaller buffer.

Also, make sure we have room for the trailing zero, only scan to size-1.

Gisle Vanem reported.

lib/url.c

@@ -2148,7 +2148,7 @@ static CURLcode CreateConnection(struct SessionHandle *data,
    * proxy -- and we don't know if we will need to use SSL until we parse the
    * url ...
    ************************************************************/
-  if((2 == sscanf(data->change.url, "%64[^:]:%[^\n]",
+  if((2 == sscanf(data->change.url, "%15[^:]:%[^\n]",
                   conn->protostr,
                   conn->path)) && strequal(conn->protostr, "file")) {
     if(conn->path[0] == '/' && conn->path[1] == '/') {
@@ -2208,7 +2208,7 @@ static CURLcode CreateConnection(struct SessionHandle *data,
      * that missing slash at the beginning of the path.
      */
     if (2 > sscanf(data->change.url,
-                   "%64[^\n:]://%[^\n/?]%[^\n]",
+                   "%15[^\n:]://%[^\n/?]%[^\n]",
                    conn->protostr,
                    conn->host.name, conn->path)) {
 

lib/urldata.h

@@ -438,7 +438,7 @@ struct connectdata {
 #else
   struct sockaddr_in serv_addr;
 #endif
-  char protostr[64];  /* store the protocol string in this buffer */
+  char protostr[16];  /* store the protocol string in this buffer */
 
   struct hostname host;
   struct hostname proxy;