Bug 1705042 - Disable IOInterposer if we detect an incompatible Symantec DLL. r=win-reviewers,gstoll

We are receiving crashes that show that our NtReadFile hook is
incompatible with a DLL from Symantec. The DLL installs its own hook
after ours has been applied, thereby breaking it. This patch is an
attempt to avoid these crashes, by disabling the IOInterposer if we
detect said DLL.

Differential Revision: https://phabricator.services.mozilla.com/D189832
This commit is contained in:
Yannis Juglaret 2023-10-03 15:14:38 +00:00
Родитель 8c8624b6dd
Коммит 5da9cebdd4
1 изменённых файлов: 3 добавлений и 1 удалений

Просмотреть файл

@ -440,7 +440,9 @@ void InitPoisonIOInterposer() {
// Bug 1679741: Kingsoft Internet Security calls NtReadFile in their thread
// simultaneously when we're applying a hook on NtReadFile.
if (::GetModuleHandleW(L"kwsui64.dll")) {
// Bug 1705042: Symantec applies its own hook on NtReadFile, and ends up
// overwriting part of ours in an incompatible way.
if (::GetModuleHandleW(L"kwsui64.dll") || ::GetModuleHandleW(L"ffm64.dll")) {
return;
}