server: Validate the output size of IOCTL_AFD_BIND against the input address…

server: Validate the output size of IOCTL_AFD_BIND against the input address size rather than sizeof(struct sockaddr). Signed-off-by: Zebediah Figura <zfigura@codeweavers.com> Signed-off-by: Alexandre Julliard <julliard@winehq.org>

server: Validate the output size of IOCTL_AFD_BIND against the input address…
c06e5693 · Zebediah Figura · Alexandre Julliard · 1409b421 · c06e5693 · c06e5693
Commit c06e5693 authored Jul 23, 2021 by Zebediah Figura Committed by Alexandre Julliard Jul 23, 2021
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 3 deletions

afd.c dlls/ws2_32/tests/afd.c +2 -2

sock.c server/sock.c +1 -1

No files found.
--- a/dlls/ws2_32/tests/afd.c
+++ b/dlls/ws2_32/tests/afd.c
@@ -1610,7 +1610,7 @@ static void test_bind(void)
    memcpy(&params->addr, &bind_addr6, sizeof(bind_addr6));
    ret = NtDeviceIoControlFile((HANDLE)s, event, NULL, NULL, &io, IOCTL_AFD_BIND,
            params, params6_size, &addr6, sizeof(addr6) - 1);
-    todo_wine ok(ret == STATUS_INVALID_PARAMETER, "got %#x\n", ret);
+    ok(ret == STATUS_INVALID_PARAMETER, "got %#x\n", ret);

    memcpy(&params->addr, &bind_addr6, sizeof(bind_addr6));
    ret = NtDeviceIoControlFile((HANDLE)s, event, NULL, NULL, &io, IOCTL_AFD_BIND,
@@ -1620,7 +1620,7 @@ static void test_bind(void)
    memcpy(&params->addr, &bind_addr6, sizeof(bind_addr6));
    ret = NtDeviceIoControlFile((HANDLE)s, event, NULL, NULL, &io, IOCTL_AFD_BIND,
            params, params6_size, &addr6, sizeof(struct sockaddr_in6_old));
-    todo_wine ok(ret == STATUS_INVALID_PARAMETER, "got %#x\n", ret);
+    ok(ret == STATUS_INVALID_PARAMETER, "got %#x\n", ret);

    memcpy(&params->addr, &bind_addr6, sizeof(bind_addr6));
    memset(&io, 0xcc, sizeof(io));

--- a/server/sock.c
+++ b/server/sock.c
@@ -2492,7 +2492,7 @@ static int sock_ioctl( struct fd *fd, ioctl_code_t code, struct async *async )
        }
        in_size = get_req_data_size() - get_reply_max_size();
        if (in_size < offsetof(struct afd_bind_params, addr.sa_data)
-                || get_reply_max_size() < sizeof(struct WS_sockaddr))
+                || get_reply_max_size() < in_size - sizeof(int))
        {
            set_error( STATUS_INVALID_PARAMETER );
            return 0;