Module: wine Branch: master Commit: fa591d3c5603f15328b7321f79dfaf86eb9b4033 URL: https://gitlab.winehq.org/wine/wine/-/commit/fa591d3c5603f15328b7321f79dfaf8...
Author: David Kahurani k.kahurani@gmail.com Date: Fri Oct 7 10:57:06 2022 +0300
xmllite/writer: Properly validate DocType name.
Current code skips a character and goes on to run is_namechar the next instead of the current character ultimately always running a null string on is_namechar and therefore always returning error on multi-character strings
Signed-off-by: David Kahurani k.kahurani@gmail.com
---
dlls/xmllite/tests/writer.c | 8 ++++++++ dlls/xmllite/writer.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/dlls/xmllite/tests/writer.c b/dlls/xmllite/tests/writer.c index 7b98f61a207..c4ab079373c 100644 --- a/dlls/xmllite/tests/writer.c +++ b/dlls/xmllite/tests/writer.c @@ -2145,6 +2145,14 @@ static void test_WriteDocType(void) hr = IXmlWriter_WriteDocType(writer, L"a", pubidW, NULL, NULL); ok(hr == WC_E_PUBLICID, "Unexpected hr %#lx.\n", hr);
+ /* Invalid multi-character string */ + hr = IXmlWriter_WriteDocType(writer, L":ax>m", NULL, NULL, NULL); + ok(hr == WC_E_NAMECHARACTER, "Unexpected hr %#lx.\n", hr); + + /* Valid multi-character string */ + hr = IXmlWriter_WriteDocType(writer, L"root", NULL, NULL, NULL); + ok(hr == S_OK, "Unexpected hr %#lx.\n", hr); + IStream_Release(stream);
for (i = 0; i < ARRAY_SIZE(doctype_tests); i++) diff --git a/dlls/xmllite/writer.c b/dlls/xmllite/writer.c index 1e1a8e8ddb8..c4f9ed2f440 100644 --- a/dlls/xmllite/writer.c +++ b/dlls/xmllite/writer.c @@ -376,11 +376,12 @@ static HRESULT is_valid_name(const WCHAR *str, unsigned int *out) if (!is_namestartchar(*str++)) return WC_E_NAMECHARACTER;
- while (*str++) + while (*str) { if (!is_namechar(*str)) return WC_E_NAMECHARACTER; len++; + str++; }
*out = len;