[PATCH v3 0/1] MR1170: wbemprox: Fix out-of-bounds access caused by codepoints above U+00FF.

[Jinoh Kang (＠iamahuman)]

For now, assume all Unicode codepoints in range U+0100 - U+10FFFF
constitute a valid identifier.  Note that we already do that for range
U+0080 - U+00FF.

--
  v3: wbemprox: Fix out-of-bounds access caused by codepoints above U+00FF.

https://gitlab.winehq.org/wine/wine/-/merge_requests/1170

[PATCH v3 1/1] wbemprox: Fix out-of-bounds access caused by codepoints above U+00FF.

[Jinoh Kang]

From: Jinoh Kang

Windows seems to recognize Unicode codepoints above U+007F as a valid
identifier character regardless of their actual character class.
Mimic that behaviour.
---
 dlls/wbemprox/tests/query.c | 6 ++++++
 dlls/wbemprox/wql.y         | 9 +++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/dlls/wbemprox/tests/query.c b/dlls/wbemprox/tests/query.c
index 23b4c86d33a..825ad2459f5 100644
--- a/dlls/wbemprox/tests/query.c
+++ b/dlls/wbemprox/tests/query.c
@@ -94,6 +94,12 @@ static void test_select( IWbemServices *services )
         L"SELECT * FROM Win32_BIOS WHERE NULL = NAME",
         L"SELECT * FROM Win32_LogicalDiskToPartition",
         L"SELECT * FROM Win32_DiskDriveToDiskPartition",
+        L"SELECT \x80 FROM \x80",
+        L"SELECT \xC6 FROM \xC6",
+        L"SELECT \xFF FROM \xFF",
+        L"SELECT \x200C FROM \x200C",
+        L"SELECT \xFF21 FROM \xFF21",
+        L"SELECT \xFFFD FROM \xFFFD",
     };
     HRESULT hr;
     IEnumWbemClassObject *result;
diff --git a/dlls/wbemprox/wql.y b/dlls/wbemprox/wql.y
index 637eb6f05fa..ba33396ddeb 100644
--- a/dlls/wbemprox/wql.y
+++ b/dlls/wbemprox/wql.y
@@ -645,6 +645,11 @@ static const char id_char[] =
     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
 };

+static int is_idchar(WCHAR chr)
+{
+    return chr >= ARRAY_SIZE(id_char) || id_char[chr];
+}
+
 struct wql_keyword
 {
     const WCHAR *name;
@@ -802,9 +807,9 @@ static int get_token( const WCHAR *s, int *token )
         for (i = 1; is_digit( s[i] ); i++) {}
         return i;
     default:
-        if (!id_char[*s]) break;
+        if (!is_idchar(*s)) break;

-        for (i = 1; id_char[s[i]]; i++) {}
+        for (i = 1; is_idchar(s[i]); i++) {}
         *token = keyword_type( s, i );
         return i;
     }

[PATCH v3 0/1] MR1170: wbemprox: Fix out-of-bounds access caused by codepoints above U+00FF. - approved

[Hans Leidekker (＠hans)]

This merge request was approved by Hans Leidekker.