r32025 - in trunk: loader/module.c mplayer.c
Author: reimar Date: Fri Aug 27 18:28:53 2010 New Revision: 32025 Log: Disable loading codecs from the current directory. While convenient, it is too risky. Modified: trunk/loader/module.c trunk/mplayer.c Modified: trunk/loader/module.c ============================================================================== --- trunk/loader/module.c Fri Aug 27 18:19:24 2010 (r32024) +++ trunk/loader/module.c Fri Aug 27 18:28:53 2010 (r32025) @@ -381,6 +381,10 @@ HMODULE WINAPI LoadLibraryExA(LPCSTR lib // if(fs_installed==0) // install_fs(); + // Do not load libraries from a path relative to the current directory + if (*libname != '/') + i++; + while (wm == 0 && listpath[++i]) { if (i < 2) Modified: trunk/mplayer.c ============================================================================== --- trunk/mplayer.c Fri Aug 27 18:19:24 2010 (r32024) +++ trunk/mplayer.c Fri Aug 27 18:28:53 2010 (r32025) @@ -2768,9 +2768,13 @@ int gui_no_filename=0; { HMODULE kernel32 = GetModuleHandle("Kernel32.dll"); BOOL WINAPI (*setDEP)(DWORD) = NULL; - if (kernel32) + BOOL WINAPI (*setDllDir)(LPCTSTR) = NULL; + if (kernel32) { setDEP = GetProcAddress(kernel32, "SetProcessDEPPolicy"); + setDllDir = GetProcAddress(kernel32, "SetDllDirectory"); + } if (setDEP) setDEP(3); + if (setDllDir) setDllDir(""); } // stop Windows from showing all kinds of annoying error dialogs SetErrorMode(0x8003);
On Fri, 27 Aug 2010 18:28:53 +0200 (CEST), reimar wrote:
Author: reimar Date: Fri Aug 27 18:28:53 2010 New Revision: 32025
Log: Disable loading codecs from the current directory. While convenient, it is too risky.
awwwwwww current dir makes things much easier for me to add/debug codecs. well i guess its not that big of a deal. -compn
On Fri, Aug 27, 2010 at 04:38:22PM -0400, compn wrote:
On Fri, 27 Aug 2010 18:28:53 +0200 (CEST), reimar wrote:
Author: reimar Date: Fri Aug 27 18:28:53 2010 New Revision: 32025
Log: Disable loading codecs from the current directory. While convenient, it is too risky.
awwwwwww current dir makes things much easier for me to add/debug codecs. well i guess its not that big of a deal.
Yes, but it is also rather convenient to be able to play files in the current directory without risking code being executed you don't want to. However, you can still 1) set -codec-path even at runtime to something that helps there 2) comment out that call if you're willing to take the risk 3) set PATH to include something relative to the current directory. Some people recommend to manually clean the path from these since broken installers often leave them behind and then you have exactly the same issue again, but this level of messing with OS internal is not acceptable to me. To anyone adding things to PATH on Windows: If you add a relative path (can also happen when a shell variable does not expand properly, so check that before you add a PATH using such) you just created a huge vulnerability. For Windows part of the problem is that it is easily possible to set the "current directory" to a WebDAV directory. For Linux nobody is used to it and also you can set LD_LIBRARY_PATH.
participants (3)
-
compn -
reimar -
Reimar Döffinger