Merge branch 'master' into ytaka

ffi · Oct 19, 2018 · 879c93e · 879c93e
2 parents dee0d86 + 0ee4f79
commit 879c93e
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,10 @@ Changed:
 1.9.24 / 2018-06-02
 -------------------
 
+Security Note:
+
+This update addresses vulnerability CVE-2018-1000201: DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String. Found by Matthew Bush.
+
 Added:
 * Added a CHANGELOG file
 * Add mips64(eb) support, and mips r6 support. (#601)

diff --git a/lib/ffi/library.rb b/lib/ffi/library.rb
@@ -126,7 +126,7 @@ def ffi_lib(*names)
               else
                 # TODO better library lookup logic
                 unless libname.start_with?("/") || FFI::Platform.windows?
-                  path = ['/usr/lib/','/usr/local/lib/'].find do |pth|
+                  path = ['/usr/lib/','/usr/local/lib/','/opt/local/lib/'].find do |pth|
                     File.exist?(pth + libname)
                   end
                   if path