[PATCH 3/3] ws2_32: avoid data corruption of WSAPROTOCOL_INFO in ws_protocol_info()
Damjan Jovanovic
damjan.jov at gmail.com
Wed Jul 31 23:11:32 CDT 2019
WS_EnterSingleProtocol[A/W]() fills WSAPROTOCOL_INFO with zeroes,
ovewriting what was already there, so in ws_protocol_info(),
populate the address family, socket type and protocol
only AFTER calling it.
This bug was found through Python's test suite, in particular its
test.test_socket.TestSocketSharing unit test.
Signed-off-by: Damjan Jovanovic <damjan.jov at gmail.com>
---
dlls/ws2_32/socket.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
-------------- next part --------------
diff --git a/dlls/ws2_32/socket.c b/dlls/ws2_32/socket.c
index 00347871b2..d82172aa5b 100644
--- a/dlls/ws2_32/socket.c
+++ b/dlls/ws2_32/socket.c
@@ -2328,6 +2328,9 @@ static INT WS_EnumProtocols( BOOL unicode, const INT *protocols, LPWSAPROTOCOL_I
static BOOL ws_protocol_info(SOCKET s, int unicode, WSAPROTOCOL_INFOW *buffer, int *size)
{
NTSTATUS status;
+ int address_family;
+ int socket_type;
+ int protocol;
*size = unicode ? sizeof(WSAPROTOCOL_INFOW) : sizeof(WSAPROTOCOL_INFOA);
memset(buffer, 0, *size);
@@ -2338,9 +2341,9 @@ static BOOL ws_protocol_info(SOCKET s, int unicode, WSAPROTOCOL_INFOW *buffer, i
status = wine_server_call( req );
if (!status)
{
- buffer->iAddressFamily = convert_af_u2w(reply->family);
- buffer->iSocketType = convert_socktype_u2w(reply->type);
- buffer->iProtocol = convert_proto_u2w(reply->protocol);
+ address_family = convert_af_u2w(reply->family);
+ socket_type = convert_socktype_u2w(reply->type);
+ protocol = convert_proto_u2w(reply->protocol);
}
}
SERVER_END_REQ;
@@ -2353,9 +2356,12 @@ static BOOL ws_protocol_info(SOCKET s, int unicode, WSAPROTOCOL_INFOW *buffer, i
}
if (unicode)
- WS_EnterSingleProtocolW( buffer->iProtocol, buffer);
+ WS_EnterSingleProtocolW( protocol, buffer);
else
- WS_EnterSingleProtocolA( buffer->iProtocol, (WSAPROTOCOL_INFOA *)buffer);
+ WS_EnterSingleProtocolA( protocol, (WSAPROTOCOL_INFOA *)buffer);
+ buffer->iAddressFamily = address_family;
+ buffer->iSocketType = socket_type;
+ buffer->iProtocol = protocol;
return TRUE;
}
More information about the wine-devel
mailing list