[Python-checkins] [3.8] bpo-39401: Avoid unsafe DLL load on Windows 7 and earlier (GH-18231) (GH-18234)
Steve Dower
webhook-mailer at python.org
Thu Jan 30 01:18:34 EST 2020
https://github.com/python/cpython/commit/ad4a20b87d79a619ffbdea3f26848780899494e5
commit: ad4a20b87d79a619ffbdea3f26848780899494e5
branch: 3.8
author: Steve Dower <steve.dower at python.org>
committer: GitHub <noreply at github.com>
date: 2020-01-29T22:18:25-08:00
summary:
[3.8] bpo-39401: Avoid unsafe DLL load on Windows 7 and earlier (GH-18231) (GH-18234)
https://bugs.python.org/issue39401
Automerge-Triggered-By: @zooba
files:
A Misc/NEWS.d/next/Security/2020-01-28-20-54-09.bpo-39401.he7h_A.rst
M PC/getpathp.c
diff --git a/Misc/NEWS.d/next/Security/2020-01-28-20-54-09.bpo-39401.he7h_A.rst b/Misc/NEWS.d/next/Security/2020-01-28-20-54-09.bpo-39401.he7h_A.rst
new file mode 100644
index 0000000000000..5071e126b70d0
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2020-01-28-20-54-09.bpo-39401.he7h_A.rst
@@ -0,0 +1 @@
+Avoid unsafe load of ``api-ms-win-core-path-l1-1-0.dll`` at startup on Windows 7.
diff --git a/PC/getpathp.c b/PC/getpathp.c
index 04f24d986f667..3747ffb2d89f0 100644
--- a/PC/getpathp.c
+++ b/PC/getpathp.c
@@ -251,7 +251,8 @@ static void
join(wchar_t *buffer, const wchar_t *stuff)
{
if (_PathCchCombineEx_Initialized == 0) {
- HMODULE pathapi = LoadLibraryW(L"api-ms-win-core-path-l1-1-0.dll");
+ HMODULE pathapi = LoadLibraryExW(L"api-ms-win-core-path-l1-1-0.dll", NULL,
+ LOAD_LIBRARY_SEARCH_SYSTEM32);
if (pathapi) {
_PathCchCombineEx = (PPathCchCombineEx)GetProcAddress(pathapi, "PathCchCombineEx");
}
@@ -287,7 +288,8 @@ canonicalize(wchar_t *buffer, const wchar_t *path)
}
if (_PathCchCanonicalizeEx_Initialized == 0) {
- HMODULE pathapi = LoadLibraryW(L"api-ms-win-core-path-l1-1-0.dll");
+ HMODULE pathapi = LoadLibraryExW(L"api-ms-win-core-path-l1-1-0.dll", NULL,
+ LOAD_LIBRARY_SEARCH_SYSTEM32);
if (pathapi) {
_PathCchCanonicalizeEx = (PPathCchCanonicalizeEx)GetProcAddress(pathapi, "PathCchCanonicalizeEx");
}
More information about the Python-checkins
mailing list