From 64f53f1a536cd871b2948cbea30869d68b37f98e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fridrich=20=C5=A0trba?= <fridrich.strba@bluewin.ch>
Date: Wed, 15 Sep 2010 16:49:01 +0200
Subject: Increase safety on Windows Call SetDllDirectory() to reduce risk of
 DLL hijacking, and call SetProcessDEPPolicy() to reduce risk of rogue code
 execution.

---
 calendar/gui/alarm-notify/notify-main.c | 34 ++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

(limited to 'calendar/gui/alarm-notify/notify-main.c')

diff --git a/calendar/gui/alarm-notify/notify-main.c b/calendar/gui/alarm-notify/notify-main.c
index 8c56abaff2..ad1a1178f8 100644
--- a/calendar/gui/alarm-notify/notify-main.c
+++ b/calendar/gui/alarm-notify/notify-main.c
@@ -35,12 +35,24 @@
 #include <libedataserver/e-source.h>
 #include <libedataserverui/e-passwords.h>
 
-#include "e-util/e-util-private.h"
 #include "alarm.h"
 #include "alarm-queue.h"
 #include "alarm-notify.h"
 #include "config-data.h"
 
+#ifdef G_OS_WIN32
+#include <windows.h>
+#include <conio.h>
+#ifndef PROCESS_DEP_ENABLE
+#define PROCESS_DEP_ENABLE 0x00000001
+#endif
+#ifndef PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION
+#define PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION 0x00000002
+#endif
+#endif
+
+#include "e-util/e-util-private.h"
+
 gint
 main (gint argc, gchar **argv)
 {
@@ -49,6 +61,26 @@ main (gint argc, gchar **argv)
 	UniqueApp *app;
 #ifdef G_OS_WIN32
 	gchar *path;
+
+	/* Reduce risks */
+	{
+		typedef BOOL (WINAPI *t_SetDllDirectoryA) (LPCSTR lpPathName);
+		t_SetDllDirectoryA p_SetDllDirectoryA;
+
+		p_SetDllDirectoryA = GetProcAddress (GetModuleHandle ("kernel32.dll"), "SetDllDirectoryA");
+		if (p_SetDllDirectoryA)
+			(*p_SetDllDirectoryA) ("");
+	}
+#ifndef _WIN64
+	{
+		typedef BOOL (WINAPI *t_SetProcessDEPPolicy) (DWORD dwFlags);
+		t_SetProcessDEPPolicy p_SetProcessDEPPolicy;
+
+		p_SetProcessDEPPolicy = GetProcAddress (GetModuleHandle ("kernel32.dll"), "SetProcessDEPPolicy");
+		if (p_SetProcessDEPPolicy)
+			(*p_SetProcessDEPPolicy) (PROCESS_DEP_ENABLE|PROCESS_DEP_DISABLE_ATL_THUNK_EMULATION);
+	}
+#endif
 #endif
 
 	bindtextdomain (GETTEXT_PACKAGE, EVOLUTION_LOCALEDIR);
-- 
cgit v1.2.3