romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 14:23:39 +03:00
Code Issues Projects Releases Packages Wiki Activity

loadlibrary: Only load system DLLs from the system directory

Browse source 
Inspiration provided by: Daniel Stenberg and Ray Satiro

Bug: https://curl.haxx.se/docs/adv_20160530.html

Ref: Windows DLL hijacking with curl, CVE-2016-4802
This commit is contained in:
Steve Holme 2016-05-29 22:57:40 +02:00 • committed by Daniel Stenberg
parent ddf25f6b28
commit 6df916d751
7 changed files with 180 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

39
lib/system_win32.h Normal file
View file

@ -0,0 +1,39 @@
#ifndef HEADER_CURL_SYSTEM_WIN32_H
#define HEADER_CURL_SYSTEM_WIN32_H
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 2016, Steve Holme, <steve_holme@hotmail.com>.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.haxx.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
***************************************************************************/
#include "curl_setup.h"
#if defined(WIN32)
#if defined(USE_WINDOWS_SSPI) || (!defined(CURL_DISABLE_TELNET) && \
defined(USE_WINSOCK))
/* This is used to dynamically load DLLs */
HMODULE Curl_load_library(LPCTSTR filename);
#endif /* USE_WINDOWS_SSPI || (!CURL_DISABLE_TELNET && USE_WINSOCK) */
#endif /* WIN32 */
#endif /* HEADER_CURL_SYSTEM_WIN32_H */