SockSocket leaves last 9 bytes of EA values uninit

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on August 02, 2013 16:20:16_

I'm splitting this out from issue #1299 b/c it's not completely resolved.

This shows up on remoting_unitests RdpClientTest.Basic and presumably on
any socket creation:

Error `#14`: UNINITIALIZED READ: reading 0x0aa0f8f0-0x0aa0f8f9 9 byte(s) within 0x0aa0f8c0-0x0aa0f8f9
#0 system call NtCreateFile parameter `#9`
#1 MSWSOCK.dll!SockSocket

param `#9` is EaBuffer:
IN PVOID EaBuffer OPTIONAL,
IN ULONG EaLength

So final 9 bytes are uninit.

0:003> dds @@(mc->esp)
0aaaf804 73803529 mswsock!SockSocket+0x504
0aaaf808 0aaaf88c HANDLE*
0aaaf80c c0140000
0aaaf810 0aaaf84c OBJECT_ATTRIBUTES
0aaaf814 0aaaf86c
0aaaf818 00000000
0aaaf81c 00000000
0aaaf820 00000003 FILE_SHARE_READ|FILE_SHARE_WRITE
0aaaf824 00000003 FILE_OPEN_IF
0aaaf828 00000000
0aaaf82c 0aaaf8c0 EaBuffer
0aaaf830 00000039 EaLength
0:003> dt OBJECT_ATTRIBUTES 0aaaf84c
drmemorylib!OBJECT_ATTRIBUTES
+0x000 Length : 0x18
+0x004 RootDirectory : (null)
+0x008 ObjectName : 0x0aaaf844 _UNICODE_STRING "\Device\Afd\Endpoint"
+0x00c Attributes : 0x42
+0x010 SecurityDescriptor : (null)
+0x014 SecurityQualityOfService : (null)

0:003> dc 0x0aaaf8c0
0aaaf8c0 00000000 001e0f00 4f646641 506e6570 ........AfdOpenP
0aaaf8d0 656b6361 00585874 00000011 00000000 acketXX.........
0aaaf8e0 00000002 00000002 00000011 00000000 ................
0aaaf8f0 77539b55 001c0000 80000000 00000000 U.Sw............

The type of EaBuffer is:

typedef struct _FILE_FULL_EA_INFORMATION {
ULONG NextEntryOffset;
UCHAR Flags;
UCHAR EaNameLength; /\* does not include null _/
USHORT EaValueLength; /_ size of each EA value in array */
CHAR EaName[1];
} FILE_FULL_EA_INFORMATION, *PFILE_FULL_EA_INFORMATION; http://msdn.microsoft.com/en-us/library/windows/hardware/ff545793(v=vs.85).aspx The value(s) associated with each entry follows the EaName array. That is,
an EA's values are located at EaName + (EaNameLength + 1).

ReactOS claims the socket creation EA value is:
typedef struct _AFD_CREATE_PACKET {
DWORD EndpointFlags;
DWORD GroupID;
DWORD SizeOfTransportName;
WCHAR TransportName[1];
} AFD_CREATE_PACKET, *PAFD_CREATE_PACKET;

But mswsock!SockSocket doesn't quite match ReactOS:
SizeOfTransportName is 2, but TransportName[] itself is not an
array of wide chars. Must use a different payload.

But the 0x1e for EaValueLength does match the total size of 0x39.

0:003> U 77539b55 -5
ntdll!RtlVerifyVersionInfo+0xee:
77539b50 e8bdc0ffff call ntdll!RtlpVerGetConditionMask (77535c12)
77539b55 83f807 cmp eax,7

Looks uninit: it's a stale retaddr on the stack. But it's hard to say how
serious it is without knowing the real format it. It could be part of a
struct that's ignored by Afd.sys. So we'll treat it as a false positive for now.

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=1302_