Bugzilla@Mozilla – Bug 589190
Binary planting potential in nsMIMEInfoWin::LaunchWithFile
Last modified: 2010-11-11 14:11:18 PST
Summon comment box
This code <http://mxr.mozilla.org/mozilla-central/source/uriloader/exthandler/win/nsMIMEInfoWin.cpp#142> needs to use an absolute path.
Created attachment 467835 [details] [review] Patch (v1)
Comment on attachment 467835 [details] [review] Patch (v1) Please make rundll32.exe a #define so that the sizeof and the lstrcat don't accidentally end up out of sync. As noted on IRC, I'd prefer that we had a helper function to do this (that we could share to fix LoadLibrary callsites also), but that is not essential.
Created attachment 469115 [details] [review] Patch (v1.1) (In reply to comment #2) > Comment on attachment 467835 [details] [review] > Patch (v1) > > Please make rundll32.exe a #define so that the sizeof and the lstrcat don't > accidentally end up out of sync. Done. > As noted on IRC, I'd prefer that we had a > helper function to do this (that we could share to fix LoadLibrary callsites > also), but that is not essential. I'll do that if we decide to patch all the callsites in bug 286382.
http://hg.mozilla.org/mozilla-central/rev/e94ae58bfd42
Is there really a risk that rundll32.dll won't exist in the windows system directory? If it's always in the path before the current directory there's no "dll planting" risk.
(In reply to comment #5) > Is there really a risk that rundll32.dll won't exist in the windows system > directory? If it's always in the path before the current directory there's no > "dll planting" risk. The order in which Windows tries to load executables from is even worse than DLLs: The directory from which the application loaded. The current directory for the parent process. The 32-bit Windows system directory. Use the GetSystemDirectory function to get the path of this directory. The 16-bit Windows system directory. There is no function that obtains the path of this directory, but it is searched. The name of this directory is System. The Windows directory. Use the GetWindowsDirectory function to get the path of this directory. The directories that are listed in the PATH environment variable. Note that this function does not search the per-application path specified by the App Paths registry key. To include this per-application path in the search sequence, use the ShellExecute function. (From http://msdn.microsoft.com/en-us/library/ms682425%28VS.85%29.aspx) Therefore, if rundll32.exe is present in the current directory, it will be picked up by default no matter whether one exists in the system directory). (BTW, rundll32 is not a DLL, it's an executable program.)
Comment on attachment 469115 [details] [review] Patch (v1.1) Approved for 1.9.2.10 and 1.9.1.13, a=dveditz for release-drivers
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/4113b60ec4b6 http://hg.mozilla.org/releases/mozilla-1.9.1/rev/c14b8ca2bba0
Other than code inspection, is there anything for QA to do in regards to verification for this bug on the branches?
(In reply to comment #9) > Other than code inspection, is there anything for QA to do in regards to > verification for this bug on the branches? I'm afraid not.
All right. Thanks.