DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org A85583858416
Message-ID: <3391e2e4-da0e-4985-9ec3-a6639f497db9@dronecode.org.uk>
Date: Fri, 9 Feb 2024 13:36:18 +0000
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Updated: setup (2.930)
To: Kaz Kylheku <kaz@kylheku.com>
References: <6a25c776-98bb-4240-8a57-7081324c5a05@dronecode.org.uk>
 <23db00778577ab0853fe1026befb9fe8@kylheku.com>
Content-Language: en-GB
Cc: cygwin@cygwin.com
In-Reply-To: <23db00778577ab0853fe1026befb9fe8@kylheku.com>
Precedence: list
From: Jon Turney via Cygwin <cygwin@cygwin.com>
Reply-To: Jon Turney <jon.turney@dronecode.org.uk>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: cygwin-bounces+archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie.com@cygwin.com>

On 09/02/2024 02:17, Kaz Kylheku via Cygwin wrote:
> 
> I see the commit: https://cygwin.com/cgit/cygwin-apps/setup/commit/?id=0122154811bacdd7dc042cff0c80bb0a36af360c
> 
> I'm curious, what improvement arises out of looking up the SetDefaultDllDirectories
> function dynamically in kernel32.dll?
> 
> Is it the case that malicious software can interpose itself somehow such that
> the statically linked SetDefaultDllDirectories call goes elsewhere other than
> kernel32.dll, which we can thwart by asking for the genuine article in kernel32.dll?

You're looking at the wrong commit there.

The dynamic lookup merely ensures that setup continues to work at all on 
Windows versions (<6.0), which don't support that function.

Instead look at:

https://cygwin.com/cgit/cygwin-apps/setup/commit/?id=86c0ada12dce4403a9b796380fde9e5c1824734f


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple