v3.15: Merge 3.14 develop-psw

nirbar · Feb 8, 2024 · 5e0362f · 5e0362f
2 parents ee5c5a9 + cb77605
commit 5e0362f
Show file tree

Hide file tree

Showing 6 changed files with 32 additions and 4 deletions.
diff --git a/.github/workflows/wix3-build.yml b/.github/workflows/wix3-build.yml
@@ -24,7 +24,7 @@ jobs:
 
       - name: Set version number
         run: |
-          $version = "3.12.0-c"+(151+$($Env:GITHUB_RUN_NUMBER))
+          $version = "3.15.0-a"+$($Env:GITHUB_RUN_NUMBER)
           echo $version
           echo "NUPKG_VERSION=$version" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
           

diff --git a/src/burn/stub/Stub.vcxproj b/src/burn/stub/Stub.vcxproj
@@ -42,6 +42,7 @@
       <SwapRunFromCD>true</SwapRunFromCD>
       <SwapRunFromNET>true</SwapRunFromNET>
       <DelayLoadDLLs>cabinet.dll;crypt32.dll;msi.dll;shlwapi.dll;version.dll;wininet.dll;wintrust.dll</DelayLoadDLLs>
+      <AdditionalOptions>/DEPENDENTLOADFLAG:0x800 %(AdditionalOptions)</AdditionalOptions>
     </Link>
   </ItemDefinitionGroup>
 

diff --git a/src/burn/stub/precomp.h b/src/burn/stub/precomp.h
@@ -6,6 +6,7 @@
 
 #include <dutil.h>
 #include <apputil.h>
+#include <dirutil.h>
 #include <strutil.h>
 #include <fileutil.h>
 #include <pathutil.h>

diff --git a/src/burn/stub/stub.cpp b/src/burn/stub/stub.cpp
@@ -2,6 +2,10 @@
 
 #include "precomp.h"
 
+static const HRESULT E_SUSPECTED_TAMPERING = MAKE_HRESULT(SEVERITY_ERROR, 500/*FACILITY_WIX*/, 2001);
+
+static void AvoidLocalDllRedirection(LPCWSTR wzPath);
+
 
 int WINAPI wWinMain(
     __in HINSTANCE hInstance,
@@ -53,6 +57,8 @@ int WINAPI wWinMain(
         AppInitialize(rgsczSafelyLoadSystemDlls, countof(rgsczSafelyLoadSystemDlls));
     }
 
+    AvoidLocalDllRedirection(sczPath);
+
     // call run
     hr = EngineRun(hInstance, hEngineFile, lpCmdLine, nCmdShow, &dwExitCode);
     ExitOnFailure(hr, "Failed to run application.");
@@ -63,3 +69,23 @@ int WINAPI wWinMain(
 
     return FAILED(hr) ? (int)hr : (int)dwExitCode;
 }
+
+static void AvoidLocalDllRedirection(LPCWSTR wzPath)
+{
+    LPWSTR sczLocalPath = NULL;
+    HMODULE hmodComCtl = NULL;
+
+    // Bail if there's a <bundle>.exe.local directory, as it's a feature of
+    // DLL redirection that has no real use for a bundle and is a hole for
+    // DLL hijacking attacks.
+
+    if (FAILED(StrAllocFormatted(&sczLocalPath, L"%ls.local", wzPath))
+        || DirExists(sczLocalPath, NULL)
+        || FileExistsEx(sczLocalPath, NULL)
+        || FAILED(LoadSystemLibrary(L"Comctl32.dll", &hmodComCtl)))
+    {
+        ::ExitProcess((UINT)E_SUSPECTED_TAMPERING);
+    }
+
+    ReleaseStr(sczLocalPath);
+}
diff --git a/src/libs/dutil/dirutil.cpp b/src/libs/dutil/dirutil.cpp
@@ -210,8 +210,8 @@ extern "C" HRESULT DAPI DirEnsureDeleteEx(
             }
         }
 
-        // If we're deleting files and/or child directories loop through the contents of the directory.
-        if (fDeleteFiles || fRecurse)
+        // If we're deleting files and/or child directories loop through the contents of the directory, but skip junctions.
+        if ((fDeleteFiles || fRecurse) && (0 == (dwAttrib & FILE_ATTRIBUTE_REPARSE_POINT)))
         {
             if (fScheduleDelete)
             {

diff --git a/tools/WixBuild.Version.targets b/tools/WixBuild.Version.targets
@@ -5,7 +5,7 @@
 <Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
     <PropertyGroup>
         <MajorBuildNumber>3</MajorBuildNumber>
-        <MinorBuildNumber>12</MinorBuildNumber>
+        <MinorBuildNumber>15</MinorBuildNumber>
         <StartBuildYear>2020</StartBuildYear>
         <BuildRevision>0</BuildRevision>