luo980/libuv
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

win,dl: remove cwd from dlopen search path

Browse Source 
SafeSearch (enabled by default) already moves this near the end of the
search list. This flag (added in Windows 8) removes it entirely. This
may enhance security of applications that depend on libuv, at the high
risk of breaking applications that expected to be able to open
libraries by a relative path without a path separator (e.g. just the
file name).
This commit is contained in:
Jameson Nash 2022-12-12 12:15:37 -05:00 committed by GitHub
parent abf77a9eda
commit 6db87d6ae3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/win/dl.c
View File

@ -27,7 +27,8 @@ static int uv__dlerror(uv_lib_t* lib, const char* filename, DWORD errorno);
int uv_dlopen(const char* filename, uv_lib_t* lib) { int uv_dlopen(const char* filename, uv_lib_t* lib) {
WCHAR filename_w[32768]; WCHAR filename_w[32768];
DWORD flags;
lib->handle = NULL; lib->handle = NULL;
lib->errmsg = NULL; lib->errmsg = NULL;
@ -40,7 +41,8 @@ int uv_dlopen(const char* filename, uv_lib_t* lib) {
return uv__dlerror(lib, filename, GetLastError()); return uv__dlerror(lib, filename, GetLastError());
} }
lib->handle = LoadLibraryExW(filename_w, NULL, LOAD_WITH_ALTERED_SEARCH_PATH); flags = LOAD_WITH_ALTERED_SEARCH_PATH | LOAD_LIBRARY_SAFE_CURRENT_DIRS;
lib->handle = LoadLibraryExW(filename_w, NULL, flags);
if (lib->handle == NULL) { if (lib->handle == NULL) {
return uv__dlerror(lib, filename, GetLastError()); return uv__dlerror(lib, filename, GetLastError());
} }