Re: Emacs master, security concernes, ms-windows

[Fabrice Popineau <fabrice.popineau@centralesupelec.fr>]

[-- Attachment #1: Type: text/plain, Size: 985 bytes --]

2017-09-14 15:33 GMT+02:00 Óscar Fuentes <ofv@wanadoo.es>:

> Fabrice Popineau <fabrice.popineau@gmail.com> writes:
>
> Apart from that, the security provided by this approach is questionable.
> If the attacker has enough control to install a DLL and modify the PATH,
> it is game over.
>

At the moment, any libpng.dll (for example) on the PATH can be loaded by
emacs.
With this restriction, only the one provided with an emacs package will be.

I came to 'fix' this because I am using the Anaconda Python distribution
which also
provides its own set of dlls. At some point I got a failure because their
dlls got loaded,
instead of the mingw64 ones.

Finally, this patch can be a hindrance for those who build Emacs. After
> the build is over, you need to copy the required extra dlls (for image
> support, etc) to the build binary directory to test or use Emacs. Not a
> huge inconvenience, but it isn't irrelevant either.
>
>
That's true.

-- 
Fabrice

[-- Attachment #2: Type: text/html, Size: 1792 bytes --]