cURL -- URL file scheme drive letter buffer overflow

cURL security advisory:

When libcurl is given either

1. a file: URL that doesn’t use two slashes following the colon, or
2. is told that file is the default scheme to use for URLs without scheme
   … and the given path starts with a drive letter and libcurl is built for
   Windows or DOS, then libcurl would copy the path with a wrong offset, so that
   the end of the given path would write beyond the malloc buffer. Up to seven
   bytes too much.
   We are not aware of any exploit of this flaw.