Of course, if this is true, then we should be overwriting the whole URL string as well since that is a full strdup() of the original data and could also have the password information in it.