David Kahurani : xmllite/writer: Properly validate DocType name.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: fa591d3c5603f15328b7321f79dfaf86eb9b4033
URL:    https://gitlab.winehq.org/wine/wine/-/commit/fa591d3c5603f15328b7321f79dfaf8...

Author: David Kahurani 
Date:   Fri Oct  7 10:57:06 2022 +0300

xmllite/writer: Properly validate DocType name.

Current code skips a character and goes on to run is_namechar the next
instead of the current character ultimately always running a null
string on is_namechar and therefore always returning error on
multi-character strings

Signed-off-by: David Kahurani

---

dlls/xmllite/tests/writer.c | 8 ++++++++
 dlls/xmllite/writer.c       | 3 ++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/dlls/xmllite/tests/writer.c b/dlls/xmllite/tests/writer.c
index 7b98f61a207..c4ab079373c 100644
--- a/dlls/xmllite/tests/writer.c
+++ b/dlls/xmllite/tests/writer.c
@@ -2145,6 +2145,14 @@ static void test_WriteDocType(void)
     hr = IXmlWriter_WriteDocType(writer, L"a", pubidW, NULL, NULL);
     ok(hr == WC_E_PUBLICID, "Unexpected hr %#lx.\n", hr);

+    /* Invalid multi-character string */
+    hr = IXmlWriter_WriteDocType(writer, L":ax>m", NULL, NULL, NULL);
+    ok(hr == WC_E_NAMECHARACTER, "Unexpected hr %#lx.\n", hr);
+
+    /* Valid multi-character string */
+    hr = IXmlWriter_WriteDocType(writer, L"root", NULL, NULL, NULL);
+    ok(hr == S_OK, "Unexpected hr %#lx.\n", hr);
+
     IStream_Release(stream);

for (i = 0; i < ARRAY_SIZE(doctype_tests); i++)
diff --git a/dlls/xmllite/writer.c b/dlls/xmllite/writer.c
index 1e1a8e8ddb8..c4f9ed2f440 100644
--- a/dlls/xmllite/writer.c
+++ b/dlls/xmllite/writer.c
@@ -376,11 +376,12 @@ static HRESULT is_valid_name(const WCHAR *str, unsigned int *out)
     if (!is_namestartchar(*str++))
         return WC_E_NAMECHARACTER;

-    while (*str++)
+    while (*str)
     {
         if (!is_namechar(*str))
             return WC_E_NAMECHARACTER;
         len++;
+        str++;
     }

*out = len;