Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign up[3.7] bpo-39401: Avoid unsafe DLL load on Windows 7 and earlier (GH-18231) #18232
+15
−4
Conversation
| @@ -245,7 +245,8 @@ static void | |||
| join(wchar_t *buffer, const wchar_t *stuff) | |||
| { | |||
| if (_PathCchCombineEx_Initialized == 0) { | |||
| HMODULE pathapi = LoadLibraryW(L"api-ms-win-core-path-l1-1-0.dll"); | |||
| HMODULE pathapi = LoadLibraryExW(L"api-ms-win-core-path-l1-1-0.dll", NULL, | |||
This comment has been minimized.
This comment has been minimized.
anthonywee
Jan 28, 2020
•
Contributor
Do we need to check that the LOAD_LIBRARY_SEARCH_ flags are available on the machine? It looks like KB2533623
needs to be installed: https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibraryexw
This comment has been minimized.
This comment has been minimized.
zooba
Jan 28, 2020
Author
Member
The check is in the installer (I backported it for 3.7).
Considering Windows 7 is EOL, I don't think it's unreasonable to require the update.
This comment has been minimized.
This comment has been minimized.
| @@ -245,7 +245,8 @@ static void | |||
| join(wchar_t *buffer, const wchar_t *stuff) | |||
| { | |||
| if (_PathCchCombineEx_Initialized == 0) { | |||
| HMODULE pathapi = LoadLibraryW(L"api-ms-win-core-path-l1-1-0.dll"); | |||
| HMODULE pathapi = LoadLibraryExW(L"api-ms-win-core-path-l1-1-0.dll", NULL, | |||
This comment has been minimized.
This comment has been minimized.
anthonywee
Jan 28, 2020
Contributor
Here's what I was thinking:
Suggested change
| HMODULE pathapi = LoadLibraryExW(L"api-ms-win-core-path-l1-1-0.dll", NULL, | |
| _PathCchCombineEx = NULL; | |
| if (GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "AddDllDirectory") != NULL) { | |
| /* Check that we can use the LOAD_LIBRARY_SEARCH_SYSTEM32 flag below by ensuring | |
| the AddDllDirectory method exists first */ | |
| HMODULE pathapi = LoadLibraryExW(L"api-ms-win-core-path-l1-1-0.dll", NULL, | |
| LOAD_LIBRARY_SEARCH_SYSTEM32); | |
| if (pathapi) { | |
| _PathCchCombineEx = (PPathCchCombineEx)GetProcAddress(pathapi, "PathCchCombineEx"); | |
| } | |
| } | |
This comment has been minimized.
This comment has been minimized.
anthonywee
Jan 28, 2020
Contributor
(the suggestion isn't exactly correct since the GitHub suggestion was only for a single line)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
zooba commentedJan 28, 2020
•
edited by bedevere-bot
https://bugs.python.org/issue39401