[PATCH 0/1] MR2026: ws2_32/test: Fix sockaddr buffer overflow in test_reuseaddr.

[Jinoh Kang (＠iamahuman)]

Today, test_reuseaddr() triggers a buffer overflow when accept()-ing an
IPv6 client due to the supplied peer name buffer (`struct sockaddr`)
being too small to hold an AF_INET6 address (`struct sockaddr_in6`).

Fix this by changing the type of `saddr` from `struct sockaddr` to
`struct sockaddr_storage`.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=54376

[PATCH 1/1] ws2_32/test: Fix sockaddr buffer overflow in test_reuseaddr.

[Jinoh Kang]

From: Jinoh Kang

Today, test_reuseaddr() triggers a buffer overflow when accept()-ing an
IPv6 client due to the supplied peer name buffer (`struct sockaddr`)
being too small to hold an AF_INET6 address (`struct sockaddr_in6`).

Fix this by changing the type of `saddr` from `struct sockaddr` to
`struct sockaddr_storage`.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=54376
---
 dlls/ws2_32/tests/sock.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dlls/ws2_32/tests/sock.c b/dlls/ws2_32/tests/sock.c
index 6f2bcb73a06..1336889b9fd 100644
--- a/dlls/ws2_32/tests/sock.c
+++ b/dlls/ws2_32/tests/sock.c
@@ -2153,7 +2153,7 @@ static void test_reuseaddr(void)
     };

unsigned int rc, reuse, value;
-    struct sockaddr saddr;
+    struct sockaddr_storage saddr;
     SOCKET s1, s2, s3, s4;
     unsigned int i, j;
     int size;
@@ -2245,7 +2245,7 @@ static void test_reuseaddr(void)

/* The connection is delivered to the first socket. */
         size = tests[i].addrlen;
-        s4 = accept(s1, &saddr, &size);
+        s4 = accept(s1, (struct sockaddr *)&saddr, &size);
         ok(s4 != INVALID_SOCKET, "got error %d.\n", WSAGetLastError());

closesocket(s1);
@@ -2279,7 +2279,7 @@ static void test_reuseaddr(void)
         ok(!rc, "got error %d.\n", WSAGetLastError());

size = tests[i].addrlen;
-        s4 = accept(s2, &saddr, &size);
+        s4 = accept(s2, (struct sockaddr *)&saddr, &size);
         todo_wine ok(s4 != INVALID_SOCKET, "got error %d.\n", WSAGetLastError());

closesocket(s1);
@@ -2313,7 +2313,7 @@ static void test_reuseaddr(void)
         rc = connect(s3, tests[i].addr_loopback, tests[i].addrlen);
         ok(!rc, "got error %d.\n", WSAGetLastError());
         size = tests[i].addrlen;
-        s4 = accept(s1, &saddr, &size);
+        s4 = accept(s1, (struct sockaddr *)&saddr, &size);

ok(s4 != INVALID_SOCKET, "got error %d.\n", WSAGetLastError());

[PATCH 0/1] MR2026: ws2_32/test: Fix sockaddr buffer overflow in test_reuseaddr. - approved

[Paul Gofman (＠gofman)]

This merge request was approved by Paul Gofman.

[PATCH 0/1] MR2026: ws2_32/test: Fix sockaddr buffer overflow in test_reuseaddr. - approved

[Zebediah Figura (＠zfigura)]

This merge request was approved by Zebediah Figura.