winmerge-svn Mailing List for WinMerge (Page 15)

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Revision: 7244
          http://winmerge.svn.sourceforge.net/winmerge/?rev=7244&view=rev
Author:   sdottaka
Date:     2010-09-11 13:03:38 +0000 (Sat, 11 Sep 2010)

Log Message:
-----------
BUG: [3056008] About Winmerge & Microsoft Security Advisory (2269637)

Modified Paths:
--------------
    trunk/Docs/Users/ChangeLog.txt
    trunk/Src/Merge.cpp

Modified: trunk/Docs/Users/ChangeLog.txt
===================================================================

--- trunk/Docs/Users/ChangeLog.txt	2010-09-09 09:01:48 UTC (rev 7243)
+++ trunk/Docs/Users/ChangeLog.txt	2010-09-11 13:03:38 UTC (rev 7244)
@@ -19,6 +19,8 @@
   Bugfix: Take changed compareoptions into use in folder compare (#3046938)
   Bugfix: "Copy and advance" toolbar icons not automatically enabled (#3033325)
   Bugfix: Location pane focus enabled "Save" (#3022292)
+  Bugfix: WinMerge was vulnerable to DLL hijacking as described in
+    Microsoft Security Advisory (2269637)  (#33056008)
   Translation updates:
   - Chinese (#3033324)
   - French (#3025202)

Modified: trunk/Src/Merge.cpp
===================================================================
--- trunk/Src/Merge.cpp	2010-09-09 09:01:48 UTC (rev 7243)
+++ trunk/Src/Merge.cpp	2010-09-11 13:03:38 UTC (rev 7244)
@@ -172,6 +172,15 @@
  */
 BOOL CMergeApp::InitInstance()
 {
+	// Prevents DLL hijacking
+	HMODULE hLibrary = GetModuleHandle(_T("kernel32.dll"));
+	BOOL (WINAPI *pfnSetSearchPathMode)(DWORD) = (BOOL (WINAPI *)(DWORD))GetProcAddress(hLibrary, "SetSearchPathMode");
+	if (pfnSetSearchPathMode)
+		pfnSetSearchPathMode(0x00000001L /*BASE_SEARCH_PATH_ENABLE_SAFE_SEARCHMODE*/ | 0x00008000L /*BASE_SEARCH_PATH_PERMANENT*/);
+	BOOL (WINAPI *pfnSetDllDirectoryA)(LPCSTR) = (BOOL (WINAPI *)(LPCSTR))GetProcAddress(hLibrary, "SetDllDirectoryA");
+	if (pfnSetDllDirectoryA)
+		pfnSetDllDirectoryA("");
+
 	InitCommonControls();    // initialize common control library
 	CWinApp::InitInstance(); // call parent class method
 


This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.




2006	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep (148)	Oct (84)	Nov (130)	Dec (121)
2007	Jan (89)	Feb (50)	Mar (81)	Apr (45)	May (42)	Jun (46)	Jul (40)	Aug (98)	Sep (80)	Oct (101)	Nov (128)	Dec (46)
2008	Jan (132)	Feb (117)	Mar (118)	Apr (112)	May (69)	Jun (140)	Jul (164)	Aug (159)	Sep (115)	Oct (65)	Nov (80)	Dec (128)
2009	Jan (145)	Feb (97)	Mar (118)	Apr (87)	May (96)	Jun (83)	Jul (50)	Aug (42)	Sep (18)	Oct (32)	Nov (12)	Dec (35)
2010	Jan (38)	Feb (8)	Mar (5)	Apr (19)	May (23)	Jun (39)	Jul (16)	Aug (4)	Sep (60)	Oct (100)	Nov (57)	Dec (43)
2011	Jan (25)	Feb (1)	Mar (3)	Apr	May (13)	Jun (19)	Jul	Aug (6)	Sep (5)	Oct (6)	Nov	Dec (1)
2012	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov (2)	Dec
2013	Jan	Feb	Mar (19)	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec
2016	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct (1)	Nov	Dec
2018	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct (1)	Nov	Dec
2019	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug (1)	Sep	Oct	Nov	Dec

winmerge-svn Mailing List for WinMerge (Page 15)

Windows visual diff and merge for files and directories

winmerge-svn — Subscribe to this list if you wish to receive notifications from Subversion