http://bugs.winehq.org/show_bug.cgi?id=22020 Some applications don't bother to pass properly allocated BSTR as a ::loadXML() parameter, so we crash on invalid length taken from DWORD before passed pointer. try3: lstrcpyW replaced by memcpy try2: test added.