3 files changed, 156 insertions, 2 deletions
diff --git a/src/corelib/plugin/plugin.pri b/src/corelib/plugin/plugin.pri
index c05ff48..ba86353 100644
--- a/src/corelib/plugin/plugin.pri
+++ b/src/corelib/plugin/plugin.pri
@@ -7,7 +7,8 @@ HEADERS += \
 	plugin/qlibrary_p.h \
 	plugin/qplugin.h \
 	plugin/quuid.h \
-	plugin/qfactoryloader_p.h 
+	plugin/qfactoryloader_p.h \
+	plugin/qsystemlibrary_p.h
 
 SOURCES += \
 	plugin/qpluginloader.cpp \
@@ -16,7 +17,9 @@ SOURCES += \
 	plugin/qlibrary.cpp
 
 win32 {
-	SOURCES += plugin/qlibrary_win.cpp
+	SOURCES += \
+		plugin/qlibrary_win.cpp \
+		plugin/qsystemlibrary.cpp
 }
 
 unix {
diff --git a/src/corelib/plugin/qsystemlibrary.cpp b/src/corelib/plugin/qsystemlibrary.cpp
new file mode 100644
index 0000000..7e9fdde
--- /dev/null
+++ b/src/corelib/plugin/qsystemlibrary.cpp
@@ -0,0 +1,90 @@
+#include "qsystemlibrary_p.h"
+#include <QtCore/qvarlengtharray.h>
+#include <QtCore/qstringlist.h>
+#include <QtCore/qfileinfo.h>
+
+/*!
+
+    \internal
+    \class QSystemLibrary
+
+    The purpose of this class is to load only libraries that are located in
+    well-known and trusted locations on the filesystem. It does not suffer from
+    the security problem that QLibrary has, therefore it will never search in
+    the current directory.
+
+    The search order is the same as the order in DLL Safe search mode Windows,
+    except that we don't search:
+    * The current directory
+    * The 16-bit system directory. (normally c:\windows\system)
+    * The Windows directory.  (normally c:\windows)
+
+    This means that the effective search order is:
+    1. Application path.
+    2. System libraries path.
+    3. Trying all paths inside the PATH environment variable.
+
+    Note, when onlySystemDirectory is true it will skip 1) and 3).
+
+    DLL Safe search mode is documented in the "Dynamic-Link Library Search
+    Order" document on MSDN.
+
+    Since library loading code is sometimes shared between Windows and WinCE,
+    this class can also be used on WinCE. However, its implementation just
+    calls the LoadLibrary() function. This is ok since it is documented as not
+    loading from the current directory on WinCE. This behaviour is documented
+    in the documentation for LoadLibrary for Windows CE at MSDN.
+    (http://msdn.microsoft.com/en-us/library/ms886736.aspx)
+*/
+#if !defined(QT_BOOTSTRAPPED)
+extern QString qAppFileName();
+#endif
+
+static QString qSystemDirectory()
+{
+    QVarLengthArray<wchar_t, MAX_PATH> fullPath;
+
+    UINT retLen = ::GetSystemDirectory(fullPath.data(), MAX_PATH);
+    if (retLen > MAX_PATH) {
+        fullPath.resize(retLen);
+        retLen = ::GetSystemDirectory(fullPath.data(), retLen);
+    }
+    // in some rare cases retLen might be 0
+    return QString::fromWCharArray(fullPath.constData(), int(retLen));
+}
+
+HINSTANCE QSystemLibrary::load(const wchar_t *libraryName, bool onlySystemDirectory/*= true*/)
+{
+#if defined(Q_OS_WINCE)
+    return ::LoadLibrary(lpFileName);
+#else
+    QStringList searchOrder;
+
+#if !defined(QT_BOOTSTRAPPED)
+    if (!onlySystemDirectory)
+        searchOrder << QFileInfo(qAppFileName()).path();
+#endif
+    searchOrder << qSystemDirectory();
+
+    if (!onlySystemDirectory) {
+        const QString PATH(QLatin1String(qgetenv("PATH").constData()));
+        searchOrder << PATH.split(QLatin1Char(';'), QString::SkipEmptyParts);
+    }
+    QString fileName = QString::fromWCharArray(libraryName);
+    fileName.append(QLatin1String(".dll"));
+
+    // Start looking in the order specified
+    for (int i = 0; i < searchOrder.count(); ++i) {
+        QString fullPathAttempt = searchOrder.at(i);
+        if (!fullPathAttempt.endsWith(QLatin1Char('\\'))) {
+            fullPathAttempt.append(QLatin1Char('\\'));
+        }
+        fullPathAttempt.append(fileName);
+        HINSTANCE inst = ::LoadLibrary((const wchar_t *)fullPathAttempt.utf16());
+        if (inst != 0)
+            return inst;
+    }
+    return 0;
+#endif
+}
+
diff --git a/src/corelib/plugin/qsystemlibrary_p.h b/src/corelib/plugin/qsystemlibrary_p.h
new file mode 100644
index 0000000..60c59e2
--- /dev/null
+++ b/src/corelib/plugin/qsystemlibrary_p.h
@@ -0,0 +1,61 @@
+#ifndef QSYSTEMLIBRARY_P_H
+#define QSYSTEMLIBRARY_P_H
+
+#include <QtCore/qglobal.h>
+#ifdef Q_OS_WIN
+#include <qt_windows.h>
+#include <QtCore/qstring.h>
+
+class QSystemLibrary
+{
+public:
+    explicit QSystemLibrary(const QString &libraryName)
+    {
+        m_libraryName = libraryName;
+        m_handle = 0;
+        m_didLoad = false;
+    }
+
+    explicit QSystemLibrary(const wchar_t *libraryName)
+    {
+        m_libraryName = QString::fromWCharArray(libraryName);
+        m_handle = 0;
+        m_didLoad = false;
+    }
+
+    bool load(bool onlySystemDirectory = true)
+    {
+        m_handle = load((const wchar_t *)m_libraryName.utf16(), onlySystemDirectory);
+        m_didLoad = true;
+        return (m_handle != 0);
+    }
+
+    bool isLoaded()
+    {
+        return (m_handle != 0);
+    }
+
+    void *resolve(const char *symbol)
+    {
+        if (!m_didLoad)
+            load();
+        if (!m_handle)
+            return 0;
+        return (void*)GetProcAddress(m_handle, symbol);
+    }
+
+    static void *resolve(const QString &libraryName, const char *symbol)
+    {
+        return QSystemLibrary(libraryName).resolve(symbol);
+    }
+
+    static Q_CORE_EXPORT HINSTANCE load(const wchar_t *lpFileName, bool onlySystemDirectory = true);
+private:
+    HINSTANCE m_handle;
+    QString m_libraryName;
+    bool m_didLoad;
+};
+
+#endif  //Q_OS_WIN
+
+#endif  //QSYSTEMLIBRARY_P_H