Has anyone properly interpreted HTTP request based on this demo of winpcap?

Question

The example is here, and I tried it by changing the filter to tcp and dst port 80 and the following:

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    ....
    ip_len = (ih->ver_ihl & 0xf) * 4;
    tcp_len = (((u_char*)ih)[ip_len + 12] >> 4) * 4;
    tcpPayload = (u_char*)ih + ip_len + tcp_len;
    /* start of url - skip "GET " */
    url = tcpPayload + 4;
    end_url = strchr((char*)url, ' ');
    url_length = end_url - url;
    final_url = (u_char*)malloc(url_length + 1);
    strncpy((char*)final_url, (char*)url, url_length);
    final_url[url_length] = '\0';

    printf("%s\n", final_url);
     ....
}

But through debug, I see tcpPayload is full of messy code,not supposed "GET ..." stuff.

What's wrong with my implement?