don't hardcode the buffer for escaped urls
Fixed that for you

* Pulled the malloc fail check up for moar faster fails
* Avoided the string duplication
* Avoided the memory leak with not freeing the pre-dup buf