Fixed possible DLL local injection on Windows due to broken LoadLibrary() API (CVE-2010-5252)

1 files changed, 11 insertions, 1 deletions

diff --git a/src/htsmodules.c b/src/htsmodules.c
index f2524b7..ea75a7f 100644
--- a/src/htsmodules.c
+++ b/src/htsmodules.c
@@ -251,7 +251,17 @@ void htspe_init(void) {
   static int initOk = 0;
   if (!initOk) {
     initOk = 1;
-    
+
+    /* See CVE-2010-5252 */
+#if (defined(_WIN32) && (!defined(_DEBUG)))
+    /* See KB 2389418
+     "If this parameter is an empty string (""), the call removes the 
+     current directory from the default DLL search order" */
+    if (!SetDllDirectory("")) {
+      assertf(! "SetDllDirectory failed");
+    }
+#endif
+ 
     /* Zlib is now statically linked */
     gz_is_available = 1;