tree 64673b17df4fd7e932f1d6fc2c01ab7cce5990d8
parent c33990a300674e24f47ff0f172f7efb10b63b88a
author Chris Dickens <christopher.a.dickens@gmail.com> 1603260530 -0700
committer Chris Dickens <christopher.a.dickens@gmail.com> 1603260530 -0700

Windows: Restrict path for dynamic library loading

The LoadLibraryA() function performs a search through various paths when
provided a library name that does not include a path element. All of the
libraries that libusb needs to dynamically load are installed in the
Windows system directory, thus it is not necessary to search any paths.

To harden the security of libusb and prevent loading libraries from
outside of the system directory should an attacker be able to alter the
environment or place an identically named library somewhere in the
search paths that occur before the Windows system directory, introduce a
function that calls LoadLibraryA() with a full path to the requested
library witin the Windows system directory. Note that we cannot call
SetDllDirectoryA() because as a library we should not alter the DLL
search path of the application. We also cannot use LoadLibraryExA() with
the LOAD_LIBRARY_SEARCH_* flags because those flags require a specific
security update to be installed on Vista and 7.

Signed-off-by: Chris Dickens <christopher.a.dickens@gmail.com>