Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Initialize function pointer values with NULL in escapi.cpp #26

Open
bajoraitisd opened this issue Dec 15, 2022 · 0 comments
Open

Initialize function pointer values with NULL in escapi.cpp #26

bajoraitisd opened this issue Dec 15, 2022 · 0 comments

Comments

@bajoraitisd
Copy link

bajoraitisd commented Dec 15, 2022

Description

Not initializing function pointer values with NULL in escapi.cpp function declarations is quite dangerous. All these pointers get random addresses and could point to something completely different. Also even if GetProcAddress does not find a function in the DLL it still is not set to NULL for some C++ compilers (i.e. Embarcadero RAD Studio C++) and so can end up loading a completely different library.

I've seen this myself when we first used ESCAPI 3.0, but then decided to go back to 2.1 because of the DirectShow support. Replacing the 3.0 DLL with 2.1 DLL did not cause any errors and the protection where it checks for function pointers != NULL did nothing and allowed to load the 2.1 DLL into process. Which is scary, cause you don't know what these random pointers can end-up modifying in the running process memory.

Reproduction steps

  • Add escapi.cpp and escapi.h from 3.0 release into your project.
  • Compile
  • Copy escapi.dll version 2.1 to the binary output directory

Expected result

Application should not allow to load the older version of escapi.dll

Actual result

Application loads the older version of escapi.dll even if the Property functions are not found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant