Skip to content

Commit

Permalink
Bug 1762576 - Firefox is not allowing Symantec DLP to inject DLL into…
Browse files Browse the repository at this point in the history
… the browser for Data Loss Prevention software r=mhowell

Move the LoadLibrary injection blocking back to Nightly-only.

Differential Revision: https://phabricator.services.mozilla.com/D143843
  • Loading branch information
hafta committed Apr 15, 2022
1 parent d282b98 commit e18ba67
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions toolkit/xre/dllservices/mozglue/WindowsDllBlocklist.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -531,9 +531,11 @@ static NTSTATUS NTAPI patched_LdrLoadDll(PWCHAR filePath, PULONG flags,
return ret;
}

#if defined(NIGHTLY_BUILD)
// Map of specific thread proc addresses we should block. In particular,
// LoadLibrary* APIs which indicate DLL injection
static void* gStartAddressesToBlock[4];
#endif // defined(NIGHTLY_BUILD)

static bool ShouldBlockThread(void* aStartAddress) {
// Allows crashfirefox.exe to continue to work. Also if your threadproc is
Expand All @@ -542,11 +544,13 @@ static bool ShouldBlockThread(void* aStartAddress) {
return false;
}

#if defined(NIGHTLY_BUILD)
for (auto p : gStartAddressesToBlock) {
if (p == aStartAddress) {
return true;
}
}
#endif

bool shouldBlock = false;
MEMORY_BASIC_INFORMATION startAddressInfo = {0};
Expand Down Expand Up @@ -614,6 +618,7 @@ MFBT_API void DllBlocklist_Initialize(uint32_t aInitFlags) {
}
}

#if defined(NIGHTLY_BUILD)
// Populate a list of thread start addresses to block.
HMODULE hKernel = GetModuleHandleW(L"kernel32.dll");
if (hKernel) {
Expand All @@ -631,6 +636,7 @@ MFBT_API void DllBlocklist_Initialize(uint32_t aInitFlags) {
pProc = (void*)GetProcAddress(hKernel, "LoadLibraryExW");
gStartAddressesToBlock[3] = pProc;
}
#endif

if (aInitFlags & eDllBlocklistInitFlagWasBootstrapped) {
GetNativeNtBlockSetWriter();
Expand Down

0 comments on commit e18ba67

Please sign in to comment.