func: static unsigned int __stdcall CVE_2014_3523_VULN_winnt_accept(void *lr_) ap_listen_rec * lr = ( ap_listen_rec * ) lr_ ; winnt_conn_ctx_t * context = NULL ; DWORD BytesRead ; SOCKET nlsd ; LPFN_ACCEPTEX lpfnAcceptEx = NULL ; LPFN_GETACCEPTEXSOCKADDRS lpfnGetAcceptExSockaddrs = NULL ; GUID GuidAcceptEx = WSAID_ACCEPTEX ; GUID GuidGetAcceptExSockaddrs = WSAID_GETACCEPTEXSOCKADDRS ; core_server_config * core_sconf ; const char * accf_name ; int rv ; int accf ; int err_count = 0 ; HANDLE events [ 3 ] ; SOCKADDR_STORAGE ss_listen ; core_sconf = ap_get_core_module_config ( ap_server_conf -> module_config ); accf_name = apr_table_get ( core_sconf -> accf_map , lr -> protocol ); if ( ! accf_name )  accf = 0; accf_name = "none"; if ( strcmp ( accf_name , "data" ) == 0 )  accf = 2; if ( strcmp ( accf_name , "connect" ) == 0 )  accf = 1; if ( strcmp ( accf_name , "none" ) == 0 )  accf = 0; accf = 0; if ( getsockname ( nlsd , ( struct sockaddr * ) & ss_listen , & namelen ) == SOCKET_ERROR )  if ( accf > 0 )  if ( WSAIoctl ( nlsd , SIO_GET_EXTENSION_FUNCTION_POINTER , & GuidAcceptEx , sizeof GuidAcceptEx , & lpfnAcceptEx , sizeof lpfnAcceptEx , & BytesRead , NULL , NULL ) == SOCKET_ERROR )  if ( WSAIoctl ( nlsd , SIO_GET_EXTENSION_FUNCTION_POINTER , & GuidGetAcceptExSockaddrs , sizeof GuidGetAcceptExSockaddrs , & lpfnGetAcceptExSockaddrs , sizeof lpfnGetAcceptExSockaddrs , & BytesRead , NULL , NULL ) == SOCKET_ERROR )  events [ 1 ] = exit_event; events [ 2 ] = max_requests_per_child_event; events [ 0 ] = exit_event; events [ 1 ] = max_requests_per_child_event; events [ 2 ] = CreateEvent ( NULL , FALSE , FALSE , NULL ); rv = WSAEventSelect ( nlsd , events [ 2 ] , FD_ACCEPT ); if ( rv )  while ( ! shutdown_in_progress )  if ( ! context )  int timeout ; context = mpm_get_completion_context ( & timeout ); if ( ! context )  if ( ! timeout )  if ( err_count > MAX_ACCEPTEX_ERR_COUNT )  if ( accf > 0 )  DWORD len ; char * buf ; if ( context -> accept_socket == INVALID_SOCKET )  context -> accept_socket = socket ( ss_listen . ss_family , SOCK_STREAM , IPPROTO_TCP ); context -> socket_family = ss_listen . ss_family; if ( context -> socket_family != ss_listen . ss_family )  context -> accept_socket = socket ( ss_listen . ss_family , SOCK_STREAM , IPPROTO_TCP ); context -> socket_family = ss_listen . ss_family; if ( context -> accept_socket == INVALID_SOCKET )  if ( accf == 2 )  len = APR_BUCKET_BUFF_SIZE; buf = apr_bucket_alloc ( len , context -> ba ); len -= PADDED_ADDR_SIZE * 2; len = 0; buf = context -> buff; if ( ! lpfnAcceptEx ( nlsd , context -> accept_socket , buf , len , PADDED_ADDR_SIZE , PADDED_ADDR_SIZE , & BytesRead , & context -> overlapped ) )  rv = apr_get_netos_error ( ); if ( ( rv == APR_FROM_OS_ERROR ( WSAECONNRESET ) ) || ( rv == APR_FROM_OS_ERROR ( WSAEACCES ) ) )  context -> accept_socket = INVALID_SOCKET; if ( ( rv == APR_FROM_OS_ERROR ( WSAEINVAL ) ) || ( rv == APR_FROM_OS_ERROR ( WSAENOTSOCK ) ) )  context -> accept_socket = INVALID_SOCKET; if ( err_count > MAX_ACCEPTEX_ERR_COUNT )  err_count = 0; accf = 0; if ( ( rv != APR_FROM_OS_ERROR ( ERROR_IO_PENDING ) ) && ( rv != APR_FROM_OS_ERROR ( WSA_IO_PENDING ) ) )  context -> accept_socket = INVALID_SOCKET; if ( err_count > MAX_ACCEPTEX_ERR_COUNT )  err_count = 0; accf = 0; err_count = 0; events [ 0 ] = context -> overlapped . hEvent; rv = WaitForMultipleObjectsEx ( 3 , events , FALSE , INFINITE , TRUE ); while ( rv == WAIT_IO_COMPLETION )  if ( rv == WAIT_OBJECT_0 )  if ( ( context -> accept_socket != INVALID_SOCKET ) && ! GetOverlappedResult ( ( HANDLE ) context -> accept_socket , & context -> overlapped , & BytesRead , FALSE ) )  context -> accept_socket = INVALID_SOCKET; if ( context -> accept_socket == INVALID_SOCKET )  err_count = 0; if ( accf == 2 && BytesRead )  apr_bucket * b ; b = apr_bucket_heap_create ( buf , APR_BUCKET_BUFF_SIZE , apr_bucket_free , context -> ba ); b -> length = BytesRead; context -> overlapped . Pointer = b; context -> overlapped . Pointer = NULL; rv = WaitForMultipleObjectsEx ( 3 , events , FALSE , INFINITE , TRUE ); while ( rv == WAIT_IO_COMPLETION )  if ( rv != WAIT_OBJECT_0 + 2 )  context -> sa_server = ( void * ) context -> buff; context -> sa_server_len = sizeof ( context -> buff ) / 2; context -> sa_client_len = context -> sa_server_len; context -> sa_client = ( void * ) ( context -> buff + context -> sa_server_len ); context -> accept_socket = accept ( nlsd , context -> sa_server , & context -> sa_server_len ); if ( context -> accept_socket == INVALID_SOCKET )  rv = apr_get_netos_error ( ); if ( rv == APR_FROM_OS_ERROR ( WSAECONNRESET ) || rv == APR_FROM_OS_ERROR ( WSAEINPROGRESS ) || rv == APR_FROM_OS_ERROR ( WSAEWOULDBLOCK ) )  if ( rv == APR_FROM_OS_ERROR ( WSAEMFILE ) || rv == APR_FROM_OS_ERROR ( WSAENOBUFS ) )  if ( err_count > MAX_ACCEPTEX_ERR_COUNT )  context -> overlapped . Pointer = NULL; err_count = 0; context -> sa_server_len = sizeof ( context -> buff ) / 2; if ( getsockname ( context -> accept_socket , context -> sa_server , & context -> sa_server_len ) == SOCKET_ERROR )  if ( ( getpeername ( context -> accept_socket , context -> sa_client , & context -> sa_client_len ) ) == SOCKET_ERROR )  memset ( & context -> sa_client , '\0' , sizeof ( context -> sa_client ) ); sockinfo . os_sock = & context -> accept_socket; sockinfo . local = context -> sa_server; sockinfo . remote = context -> sa_client; sockinfo . family = context -> sa_server -> sa_family; sockinfo . type = SOCK_STREAM; sockinfo . protocol = IPPROTO_TCP; ioctlsocket ( context -> accept_socket , FIONBIO , & zero ); setsockopt ( context -> accept_socket , SOL_SOCKET , SO_RCVTIMEO , ( char * ) & zero , sizeof ( zero ) ); setsockopt ( context -> accept_socket , SOL_SOCKET , SO_SNDTIMEO , ( char * ) & zero , sizeof ( zero ) ); apr_os_sock_make ( & context -> sock , & sockinfo , context -> ptrans ); PostQueuedCompletionStatus ( ThreadDispatchIOCP , BytesRead , IOCP_CONNECTION_ACCEPTED , & context -> overlapped ); context = NULL; 