rpcrt4: Validate the uuid portion of the string passed to RpcStringBindingParseA/W.

dlls/rpcrt4/rpc_binding.c

diff --git a/dlls/rpcrt4/rpc_binding.c b/dlls/rpcrt4/rpc_binding.c
index e42b8f9..a439bc3 100644
--- a/dlls/rpcrt4/rpc_binding.c
+++ b/dlls/rpcrt4/rpc_binding.c
@@ -481,7 +481,18 @@
 
   next = strchr(data, '@');
   if (next) {
-    if (ObjUuid) *ObjUuid = (unsigned char*)RPCRT4_strndupA(data, next - data);
+    UUID uuid;
+    RPC_STATUS status;
+    RPC_CSTR str_uuid = (unsigned char*)RPCRT4_strndupA(data, next - data);
+    status = UuidFromStringA(str_uuid, &uuid);
+    if (status != RPC_S_OK) {
+      HeapFree(GetProcessHeap(), 0, str_uuid);
+      return status;
+    }
+    if (ObjUuid)
+      *ObjUuid = str_uuid;
+    else
+      HeapFree(GetProcessHeap(), 0, str_uuid);
     data = next+1;
   }
 
@@ -579,7 +590,18 @@
 
   next = strchrW(data, '@');
   if (next) {
-    if (ObjUuid) *ObjUuid = RPCRT4_strndupW(data, next - data);
+    UUID uuid;
+    RPC_STATUS status;
+    RPC_WSTR str_uuid = RPCRT4_strndupW(data, next - data);
+    status = UuidFromStringW(str_uuid, &uuid);
+    if (status != RPC_S_OK) {
+      HeapFree(GetProcessHeap(), 0, str_uuid);
+      return status;
+    }
+    if (ObjUuid)
+      *ObjUuid = str_uuid;
+    else
+      HeapFree(GetProcessHeap(), 0, str_uuid);
     data = next+1;
   }
 

dlls/rpcrt4/tests/rpc.c

diff --git a/dlls/rpcrt4/tests/rpc.c b/dlls/rpcrt4/tests/rpc.c
index 671159d..19a0a94 100644
--- a/dlls/rpcrt4/tests/rpc.c
+++ b/dlls/rpcrt4/tests/rpc.c
@@ -611,9 +611,7 @@
 
     /* test with invalid uuid */
     status = RpcStringBindingParseA(invalid_uuid_binding, NULL, &protseq, NULL, NULL, NULL);
-    todo_wine
     ok(status == RPC_S_INVALID_STRING_UUID, "RpcStringBindingParseA should have returned RPC_S_INVALID_STRING_UUID instead of %ld\n", status);
-    todo_wine
     ok(protseq == NULL, "protseq was %p instead of NULL\n", protseq);
 
     /* test with invalid endpoint */