go: syscall & x/sys/windows: buffer overflow in GetQueuedCompletionStatus

Those two call sites don’t include the known uses in x/exp and x/benchmarks, so there’s gotta be something missing from that search.

You are mistaken. Correct observation, but incorrect conclusion. x/exp and x/benchmarks – and virtually everything else – uses syscall, not x/sys/windows. The search is for uses of x/sys/windows, because that is the relevant package for that part of the discussion.

Again, in case there’s confusion about what I’m suggesting:

1. We don’t break the signature of syscall, but instead do https://golang.org/cl/296149 and encourage people to switch to x/sys/windows.
2. We make x/sys/windows use the right signature, via https://golang.org/cl/295174 .

We are on the same page about (1). Hence I discussed (2) here. Please re-read https://github.com/golang/go/issues/44538#issuecomment-785427786 in light of that.

https://github.com/criyle/go-judge/pull/10 and https://github.com/WireGuard/wireguard-go/blob/6856c0ff0e50eada76fd2189190016cdbf0ca52f/conn/bind_windows.go#L369-L371 are now updated, so I think we’re all set.

Reproduces easily:

package main

import "golang.org/x/sys/windows"

func main() {
	k32 := windows.NewLazySystemDLL("kernel32.dll")
	port, _, _ := k32.NewProc("CreateIoCompletionPort").Call(^uintptr(0), 0, 0, 0)
	k32.NewProc("PostQueuedCompletionStatus").Call(port, 1, uintptr(77)<<32, 0)

	var things struct {
		o            *windows.Overlapped
		bytes        uint32
		key          uint32
		MYSTERYVALUE uint32
	}
	things.MYSTERYVALUE = 99
	println(things.MYSTERYVALUE)
	windows.GetQueuedCompletionStatus(windows.Handle(port), &things.bytes, &things.key, &things.o, windows.INFINITE)
	println(things.MYSTERYVALUE)
}

Output:

99
77