java-native-access / java-native-access/jna

windows/security: explicit LOAD_LIBRARY_SEARCH_SYSTEM32 for system32 dll

Open
#1,717 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
8.9k
Forks
1.7k
PR merge metrics
No merged PRs in 30d

Description

We recently stumpled upon dll loading issues of wtsapi32.dll with prior modification of dll search path via SetDefaultDllDirectories resulting exact same issue as in https://github.com/java-native-access/jna/pull/1614

calling LoadLibraryEx(relative_path, ..., LOAD_WITH_ALTERED_SEARCH_PATH) results in ERROR_INVALID_PARAMETER.

According to LoadLibraryEx documentation, this results in an undefined behavior when a library name is given as a relative path.
With that in mind, it would be best practise to secure system32 dll loading by using OPTION_OPEN_FLAGS set to LOAD_LIBRARY_SEARCH_SYSTEM32 for those interfaces against system32 dlls.

Map<String, Object> DEFAULT_W32SYSTEM32APIOptions = new HashMap<String, Object>(W32APIOptions.DEFAULT_OPTIONS) {{ //LOAD_LIBRARY_SEARCH_SYSTEM32 put(com.sun.jna.Library.OPTION_OPEN_FLAGS, 0x00000800); }};
Once we switched to LOAD_LIBRARY_SEARCH_SYSTEM32 all system32 dlls in use were properly found/loaded.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating W32APIOptions and the interfaces that load system32 DLLs, then inspect how OPTION_OPEN_FLAGS and LOAD_WITH_ALTERED_SEARCH_PATH are currently used. Reproduce the relative-path loading case on Windows and verify that system32 DLLs load with LOAD_LIBRARY_SEARCH_SYSTEM32 without breaking other native interfaces.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
operating-systems, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.