crates/stdlib/src/overlapped.rs (2)

1826-1862: ⚠️ Potential issue | 🟡 Minor

Fix incorrect error message for unsupported address family.
BindLocal takes an address family, not a tuple length.

Proposed fix

-            return Err(vm.new_value_error("expected tuple of length 2 or 4".to_owned()));
+            return Err(vm.new_value_error("unsupported address family".to_owned()));

---

1395-1482: ⚠️ Potential issue | 🔴 Critical

Validate size against buffer length to prevent out-of-bounds writes.

WSARecvFrom writes WSABUF.len bytes into the buffer. If size exceeds buf.desc.len, Windows writes past the buffer boundary. Compare this with WSARecvInto, which correctly uses the buffer length directly.

Proposed fix

             let buf_len = buf.desc.len;
             if buf_len > u32::MAX as usize {
                 return Err(vm.new_value_error("buffer too large".to_owned()));
             }
+            if size as usize > buf_len {
+                return Err(vm.new_value_error("size exceeds buffer length".to_owned()));
+            }