From be84f7f52ea3dc3a40be6449e81b3671dd26d9db Mon Sep 17 00:00:00 2001 From: Conn O'Griofa Date: Tue, 10 Jan 2023 03:05:07 +0000 Subject: [PATCH] CMake: Windows: harden install by including zlib1.dll mingw's openssl library is built using the "zlib-dynamic" flag, which invokes LoadLibrary() of zlib1.dll during runtime to allow openssl to function if no zlib.dll is installed. This is a problem because it prevents static linkage of zlib, thus opening a security vulnerability by which a malicious zlib1.dll can be loaded from any valid system dll search path. Increase security by including the mingw version of zlib1.dll in the application path, which will override any other versions. --- CMakeLists.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CMakeLists.txt b/CMakeLists.txt index 2305eab86fe..855daef422d 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -475,6 +475,8 @@ add_executable(sunshine ${SUNSHINE_TARGET_FILES}) if(WIN32) set_target_properties(sunshine PROPERTIES LINK_SEARCH_START_STATIC 1) + set(CMAKE_FIND_LIBRARY_SUFFIXES ".dll") + find_library(ZLIB ZLIB1) endif() target_link_libraries(sunshine ${SUNSHINE_EXTERNAL_LIBRARIES} ${EXTRA_LIBS}) @@ -521,6 +523,9 @@ install(DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/node_modules" if(WIN32) # see options at: https://cmake.org/cmake/help/latest/cpack_gen/nsis.html install(TARGETS sunshine RUNTIME DESTINATION "." COMPONENT application) + # Hardening: include zlib1.dll (loaded via LoadLibrary() in openssl's libcrypto.a) + install(FILES "${ZLIB}" DESTINATION "." COMPONENT application) + # Adding tools install(TARGETS dxgi-info RUNTIME DESTINATION "tools" COMPONENT dxgi) install(TARGETS audio-info RUNTIME DESTINATION "tools" COMPONENT audio)