[PATCH 1/5] server: Validate the output size of IOCTL_AFD_BIND against the input address size rather than sizeof(struct sockaddr).
Zebediah Figura
zfigura at codeweavers.com
Fri Jul 23 11:39:07 CDT 2021
Signed-off-by: Zebediah Figura <zfigura at codeweavers.com>
---
dlls/ws2_32/tests/afd.c | 4 ++--
server/sock.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/dlls/ws2_32/tests/afd.c b/dlls/ws2_32/tests/afd.c
index 32daab0beab..c31d1def139 100644
--- a/dlls/ws2_32/tests/afd.c
+++ b/dlls/ws2_32/tests/afd.c
@@ -1610,7 +1610,7 @@ static void test_bind(void)
memcpy(¶ms->addr, &bind_addr6, sizeof(bind_addr6));
ret = NtDeviceIoControlFile((HANDLE)s, event, NULL, NULL, &io, IOCTL_AFD_BIND,
params, params6_size, &addr6, sizeof(addr6) - 1);
- todo_wine ok(ret == STATUS_INVALID_PARAMETER, "got %#x\n", ret);
+ ok(ret == STATUS_INVALID_PARAMETER, "got %#x\n", ret);
memcpy(¶ms->addr, &bind_addr6, sizeof(bind_addr6));
ret = NtDeviceIoControlFile((HANDLE)s, event, NULL, NULL, &io, IOCTL_AFD_BIND,
@@ -1620,7 +1620,7 @@ static void test_bind(void)
memcpy(¶ms->addr, &bind_addr6, sizeof(bind_addr6));
ret = NtDeviceIoControlFile((HANDLE)s, event, NULL, NULL, &io, IOCTL_AFD_BIND,
params, params6_size, &addr6, sizeof(struct sockaddr_in6_old));
- todo_wine ok(ret == STATUS_INVALID_PARAMETER, "got %#x\n", ret);
+ ok(ret == STATUS_INVALID_PARAMETER, "got %#x\n", ret);
memcpy(¶ms->addr, &bind_addr6, sizeof(bind_addr6));
memset(&io, 0xcc, sizeof(io));
diff --git a/server/sock.c b/server/sock.c
index f730bb31c55..cce91f5150d 100644
--- a/server/sock.c
+++ b/server/sock.c
@@ -2492,7 +2492,7 @@ static int sock_ioctl( struct fd *fd, ioctl_code_t code, struct async *async )
}
in_size = get_req_data_size() - get_reply_max_size();
if (in_size < offsetof(struct afd_bind_params, addr.sa_data)
- || get_reply_max_size() < sizeof(struct WS_sockaddr))
+ || get_reply_max_size() < in_size - sizeof(int))
{
set_error( STATUS_INVALID_PARAMETER );
return 0;
--
2.30.2
More information about the wine-devel
mailing list