marko10_000
/
wine-wine
forked from Mirrors/wine-wine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

- improve some parameter checking in WSAIoctl 

- fix a memory leak I introduced in WSAIoctl
oldstable
Juan Lang 2003-08-30 00:16:19 +00:00 committed by Alexandre Julliard
parent 549e247844
commit 85abf9cb90
1 changed files with 27 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
dlls/winsock/socket.c
View File

@ -1968,7 +1968,19 @@ INT WINAPI WSAIoctl (SOCKET s,
DWORD size, numInt, apiReturn; DWORD size, numInt, apiReturn;
TRACE ("-> SIO_GET_INTERFACE_LIST request\n"); TRACE ("-> SIO_GET_INTERFACE_LIST request\n");
/* FIXME: length of output buffer not checked */
if (!lpbOutBuffer)
{
close(fd);
WSASetLastError(WSAEFAULT);
return SOCKET_ERROR;
}
if (!lpcbBytesReturned)
{
close(fd);
WSASetLastError(WSAEFAULT);
return SOCKET_ERROR;
}
apiReturn = GetAdaptersInfo(NULL, &size); apiReturn = GetAdaptersInfo(NULL, &size);
if (apiReturn == ERROR_NO_DATA) if (apiReturn == ERROR_NO_DATA)
@ -1985,6 +1997,13 @@ INT WINAPI WSAIoctl (SOCKET s,
{ {
PIP_ADAPTER_INFO ptr; PIP_ADAPTER_INFO ptr;
if (size > cbOutBuffer)
{
HeapFree(GetProcessHeap(),0,table);
close(fd);
WSASetLastError(WSAEFAULT);
return (SOCKET_ERROR);
}
for (ptr = table, numInt = 0; ptr; for (ptr = table, numInt = 0; ptr;
ptr = ptr->Next, intArray++, numInt++) ptr = ptr->Next, intArray++, numInt++)
{ {
@ -2035,7 +2054,6 @@ INT WINAPI WSAIoctl (SOCKET s,
intArray->iiBroadcastAddress.AddressIn.sin_addr. intArray->iiBroadcastAddress.AddressIn.sin_addr.
WS_s_addr = bcast; WS_s_addr = bcast;
} }
HeapFree(GetProcessHeap(),0,table);
} }
else else
{ {
@ -2045,6 +2063,7 @@ INT WINAPI WSAIoctl (SOCKET s,
WSASetLastError(WSAEINVAL); WSASetLastError(WSAEINVAL);
return (SOCKET_ERROR); return (SOCKET_ERROR);
} }
HeapFree(GetProcessHeap(),0,table);
} }
else else
{ {
@ -2416,6 +2435,12 @@ INT WINAPI WSASendTo( SOCKET s, LPWSABUF lpBuffers, DWORD dwBufferCount,
goto error; goto error;
} }
if ( !lpNumberOfBytesSent )
{
err = WSAEFAULT;
goto error;
}
iovec = HeapAlloc (GetProcessHeap(), 0, dwBufferCount * sizeof (struct iovec) ); iovec = HeapAlloc (GetProcessHeap(), 0, dwBufferCount * sizeof (struct iovec) );
if ( !iovec ) if ( !iovec )