ws2_32: Avoid an unhandled exception in WSAIoctl.

dlls/ws2_32/socket.c

@@ -3365,17 +3365,20 @@ INT WINAPI WSAIoctl(SOCKET s, DWORD code, LPVOID in_buff, DWORD in_size, LPVOID
    }
    case WS_SIO_KEEPALIVE_VALS:
    {
-        struct tcp_keepalive *k = in_buff;
-        int keepalive = k->onoff ? 1 : 0;
-        int keepidle = k->keepalivetime / 1000;
-        int keepintvl = k->keepaliveinterval / 1000;
+        struct tcp_keepalive *k;
+        int keepalive, keepidle, keepintvl;
 
-        if (!in_buff)
+        if (!in_buff || in_size < sizeof(struct tcp_keepalive))
         {
-            WSASetLastError(WSAEINVAL);
+            WSASetLastError(WSAEFAULT);
             return SOCKET_ERROR;
         }
 
+        k = in_buff;
+        keepalive = k->onoff ? 1 : 0;
+        keepidle = k->keepalivetime / 1000;
+        keepintvl = k->keepaliveinterval / 1000;
+
         TRACE("onoff: %d, keepalivetime: %d, keepaliveinterval: %d\n", keepalive, keepidle, keepintvl);
 
         fd = get_sock_fd(s, 0, NULL);

dlls/ws2_32/tests/sock.c

@@ -26,6 +26,7 @@
 #include <windows.h>
 #include <ws2tcpip.h>
 #include <mswsock.h>
+#include <mstcpip.h>
 #include <stdio.h>
 #include "wine/test.h"
 
@@ -2960,6 +2961,18 @@ static void test_ioctlsocket(void)
     ret = ioctlsocket(sock, SIOCATMARK, &arg);
     if(ret != SOCKET_ERROR)
         todo_wine ok(arg, "expected a non-zero value\n");
+
+    ret = WSAIoctl(sock, SIO_KEEPALIVE_VALS, &arg, 0, NULL, 0, &arg, NULL, NULL);
+    ok(ret == SOCKET_ERROR, "WSAIoctl succeeded unexpectedly\n");
+    ret = WSAGetLastError();
+    ok(ret == WSAEFAULT || broken(ret == WSAEINVAL), "expected WSAEFAULT, got %d instead\n", ret);
+
+    ret = WSAIoctl(sock, SIO_KEEPALIVE_VALS, NULL, sizeof(struct tcp_keepalive), NULL, 0, &arg, NULL, NULL);
+    ok(ret == SOCKET_ERROR, "WSAIoctl succeeded unexpectedly\n");
+    ret = WSAGetLastError();
+    ok(ret == WSAEFAULT || broken(ret == WSAEINVAL), "expected WSAEFAULT, got %d instead\n", ret);
+
+    closesocket(sock);
 }
 
 static int drain_pause=0;