Skip to content
  • Tor Lillqvist's avatar
    Link directly to GDI+ API avoiding LoadLibrary · 0f016682
    Tor Lillqvist authored
    Avoid potential DLL hijacking risks by not calling LoadLibrary() to
    load gdiplus.dll. As gdiplus.dll is a WinSxS (side-by-side) DLL we
    couldn't use the full path anyway as we don't know it.
    
    So just link to the GDI+ functions directly. Gdiplus.dll should be
    present on all Windows versions we support anyway. Some complexity
    added as MinGW doesn't come with an import library for gdiplus.dll, so
    we have to create one ourselves. But we call relatively few functions
    from gdiplus.dll so that is not a big deal.
    0f016682