Skip to content

fix: DLL hijacking vulnerability in c2patool (CAI-8608)#2031

Merged
scouten-adobe merged 6 commits into
mainfrom
CAI-8608/dll-hijacking-vuln
Jun 9, 2026
Merged

fix: DLL hijacking vulnerability in c2patool (CAI-8608)#2031
scouten-adobe merged 6 commits into
mainfrom
CAI-8608/dll-hijacking-vuln

Conversation

@scouten-adobe

@scouten-adobe scouten-adobe commented Apr 9, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

@scouten-adobe scouten-adobe requested a review from gpeacock April 9, 2026 22:30
@scouten-adobe scouten-adobe self-assigned this Apr 9, 2026
@codspeed-hq

codspeed-hq Bot commented Apr 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 30 untouched benchmarks
⏩ 64 skipped benchmarks1

Comparing CAI-8608/dll-hijacking-vuln (37ef04f) with main (1c65e75)

Open in CodSpeed

Footnotes

  1. 64 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@codecov

codecov Bot commented Apr 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 65.92885% with 431 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.60%. Comparing base (1982f5e) to head (37ef04f).
⚠️ Report is 107 commits behind head on main.

Files with missing lines Patch % Lines
cli/src/main.rs 37.34% 297 Missing ⚠️
cli/src/signer.rs 2.27% 43 Missing ⚠️
sdk/src/assertions/actions.rs 26.92% 19 Missing ⚠️
sdk/src/asset_handlers/jpegxl_io.rs 45.45% 18 Missing ⚠️
c2pa_c_ffi/src/c_api.rs 83.82% 11 Missing ⚠️
sdk/src/asset_handlers/bmff_io.rs 88.37% 10 Missing ⚠️
sdk/src/asset_handlers/jpeg_io.rs 92.24% 10 Missing ⚠️
sdk/src/asset_handlers/png_io.rs 92.38% 8 Missing ⚠️
sdk/src/asset_handlers/gif_io.rs 89.74% 4 Missing ⚠️
sdk/src/assertions/bmff_hash.rs 97.98% 3 Missing ⚠️
... and 5 more
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #2031      +/-   ##
==========================================
+ Coverage   77.70%   78.60%   +0.90%     
==========================================
  Files         176      176              
  Lines       44645    46361    +1716     
==========================================
+ Hits        34691    36443    +1752     
+ Misses       9954     9918      -36

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

tmathern
tmathern approved these changes Apr 10, 2026
View reviewed changes
Comment thread cli/src/main.rs Outdated
#[cfg(windows)]
// SAFETY: no invariants to uphold; the argument is a valid constant.
unsafe {
windows_sys::Win32::System::LibraryLoader::SetDefaultDllDirectories(

@tmathern tmathern Apr 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-setdefaultdlldirectories

SetDefaultDllDirectories has a return value, a bool indicating success. Shouldn't the result of this call be checked then?

Should not fail, but while hardening...

@scouten-adobe
If SetDefaultDllDirectories returns 0 (failure), main() exits imm…
9f4f49e 
…ediately with an error rather than silently continuing with an insecure DLL search path
@scouten-adobe
Merge branch 'main' into CAI-8608/dll-hijacking-vuln
cfef630
@scouten-adobe scouten-adobe requested a review from tmathern April 10, 2026 16:51
@scouten-adobe scouten-adobe merged commit ee1afa1 into main Jun 9, 2026
45 of 46 checks passed
@scouten-adobe scouten-adobe deleted the CAI-8608/dll-hijacking-vuln branch June 9, 2026 17:05
@caiopensrc caiopensrc mentioned this pull request Jun 9, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpeacock gpeacock gpeacock approved these changes

@tmathern tmathern Awaiting requested review from tmathern

Assignees

@scouten-adobe scouten-adobe

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@scouten-adobe @gpeacock @tmathern