romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 21:53:37 +03:00
Code Issues Projects Releases Packages Wiki Activity

loadlibrary: Only load system DLLs from the system directory

Browse source 
Inspiration provided by: Daniel Stenberg and Ray Satiro

Bug: https://curl.haxx.se/docs/adv_20160530.html

Ref: Windows DLL hijacking with curl, CVE-2016-4802
This commit is contained in:
Steve Holme 2016-05-29 22:57:40 +02:00 • committed by Daniel Stenberg
parent ddf25f6b28
commit 6df916d751
7 changed files with 180 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/Makefile.vc6
View file

@ -5,7 +5,7 @@
# | (__| |_| | _ <| |___
# \___|\___/|_| \_\_____|
#
# Copyright (C) 1999 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
# Copyright (C) 1999 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
#
# This software is licensed as described in the file COPYING, which
# you should have received as part of this distribution. The terms
@ -616,6 +616,7 @@ X_OBJS= \
$(DIROBJ)\speedcheck.obj \
$(DIROBJ)\splay.obj \
$(DIROBJ)\ssh.obj \
$(DIROBJ)\system_win32.obj \
$(DIROBJ)\vauth.obj \
$(DIROBJ)\cleartext.obj \
$(DIROBJ)\cram.obj \