bytedeco/javacpp

dll hijeck

Open

#818 opened on Sep 8, 2025

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Java (620 forks)batch import
enhancementhelp wanted

Repository metrics

Stars
 (4,279 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Loader.java has a DLL hijacking risk at line 1832. When creating an FFmpegFrameGrabber object in ffmpeg within bytedec/javacv, it tries to load non-existent classes (avutil.class, swresample.class, avcodec.class, avformat.class, swscale.class, avdevice.class), resulting in a "dll not found" error.

Contributor guide

Research direction
Investigate the DLL loading mechanism in Loader.java line 1832. Check if the paths to native libraries are properly sanitized and if absolute paths are used instead of system dependent search paths. Consider using LoadLibrary with full paths or validating library sources.
Tech stack
javac
Domain
security
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Needs investigation
Prerequisites
JavaC++
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40