SetsockoptInt error can be silently discarded in the Control callback
low swesweep-fasthttp · reuseport/reuseport_windows.go · Control closure in listenConfig.Control, invoked by reuseport.Listen · run #4
Description
The Control closure assigns windows.SetsockoptInt's error to the named return variable err, but the function returns c.Control(...) directly. If c.Control returns nil, a non-nil err from SetsockoptInt is not propagated. This can make Listen succeed even when SO_REUSEADDR was not set, hiding a fallible socket option configuration step. Impact is low because it does not lead to memory corruption or directly attacker-controlled memory access, but it can cause incorrect listener behavior or later bind failures.
Triage
Not triaged.
Raw scan report for this file
The public entry point is `Listen(network, addr)`. The `network` and `addr` values flow directly into `net.ListenConfig.Listen`, so any validation concerns are primarily handled by the Go `net` package. There are no local copies of attacker-controlled data, no slice indexing, no fixed-size buffers, and no integer arithmetic based on untrusted lengths.
The only Windows-specific operation is in the `Control` callback: it receives a raw file descriptor from `net` and calls `windows.SetsockoptInt` to enable `SO_REUSEADDR`. The `fd` value is not attacker-controlled in a memory-safety sense; it is provided by the `net` package for the socket being created. If the handle were invalid, the Win32 API would normally return an error rather than allow arbitrary memory access.
The main issue is an error-propagation bug. The `Control` closure assigns the result of `windows.SetsockoptInt` to the named return variable `err`, but the surrounding function returns `c.Control(...)` directly. If `c.Control` succeeds and returns `nil`, a non-nil error from `SetsockoptInt` can be discarded. As a result, `Listen` may report success even though `SO_REUSEADDR` was not actually set. This does not create a memory-safety vulnerability, but it can cause the listener to lack the intended socket behavior, potentially leading to bind failures or unexpected listener semantics in `TIME_WAIT` scenarios.
```json
[
{
"severity": "low",
"title": "SetsockoptInt error can be silently discarded in the Control callback",
"function": "Control closure in listenConfig.Control, invoked by reuseport.Listen",
"description": "The Control closure assigns windows.SetsockoptInt's error to the named return variable err, but the function returns c.Control(...) directly. If c.Control returns nil, a non-nil err from SetsockoptInt is not propagated. This can make Listen succeed even when SO_REUSEADDR was not set, hiding a fallible socket option configuration step. Impact is low because it does not lead to memory corruption or directly attacker-controlled memory access, but it can cause incorrect listener behavior or later bind failures."
}
]
```