Jinoh Kang : wbemprox: Fix out-of-bounds access caused by codepoints above U+00FF.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 67fbcff74598f26638544533f08fc39a9fbef50b
URL:    https://gitlab.winehq.org/wine/wine/-/commit/67fbcff74598f26638544533f08fc39...

Author: Jinoh Kang 
Date:   Wed Oct 26 23:32:22 2022 +0900

wbemprox: Fix out-of-bounds access caused by codepoints above U+00FF.

Windows seems to recognize Unicode codepoints above U+007F as a valid
identifier character regardless of their actual character class.
Mimic that behaviour.

---

dlls/wbemprox/tests/query.c | 6 ++++++
 dlls/wbemprox/wql.y         | 9 +++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/dlls/wbemprox/tests/query.c b/dlls/wbemprox/tests/query.c
index 23b4c86d33a..825ad2459f5 100644
--- a/dlls/wbemprox/tests/query.c
+++ b/dlls/wbemprox/tests/query.c
@@ -94,6 +94,12 @@ static void test_select( IWbemServices *services )
         L"SELECT * FROM Win32_BIOS WHERE NULL = NAME",
         L"SELECT * FROM Win32_LogicalDiskToPartition",
         L"SELECT * FROM Win32_DiskDriveToDiskPartition",
+        L"SELECT \x80 FROM \x80",
+        L"SELECT \xC6 FROM \xC6",
+        L"SELECT \xFF FROM \xFF",
+        L"SELECT \x200C FROM \x200C",
+        L"SELECT \xFF21 FROM \xFF21",
+        L"SELECT \xFFFD FROM \xFFFD",
     };
     HRESULT hr;
     IEnumWbemClassObject *result;
diff --git a/dlls/wbemprox/wql.y b/dlls/wbemprox/wql.y
index 637eb6f05fa..ba33396ddeb 100644
--- a/dlls/wbemprox/wql.y
+++ b/dlls/wbemprox/wql.y
@@ -645,6 +645,11 @@ static const char id_char[] =
     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
 };

+static int is_idchar(WCHAR chr)
+{
+    return chr >= ARRAY_SIZE(id_char) || id_char[chr];
+}
+
 struct wql_keyword
 {
     const WCHAR *name;
@@ -802,9 +807,9 @@ static int get_token( const WCHAR *s, int *token )
         for (i = 1; is_digit( s[i] ); i++) {}
         return i;
     default:
-        if (!id_char[*s]) break;
+        if (!is_idchar(*s)) break;

-        for (i = 1; id_char[s[i]]; i++) {}
+        for (i = 1; is_idchar(s[i]); i++) {}
         *token = keyword_type( s, i );
         return i;
     }