Re: [Bug-gnubg] Win32 builds - new set of DLL

[Nardy Pillards]

From: "Holger" <address@hidden>
Sent: Tuesday, July 01, 2003 2:49 PM
> At 01:05 01.07.2003 +0200, Nardy Pillards wrote:
> >From: "Holger" <address@hidden>
> >Sent: Monday, June 30, 2003 6:40 PM
> > > >gnubg (or maybe rather libpng) wants zlib.dll. It does not recognize
> > > >zlib-1.dll. Renaming zlib-1.dll to zlib.dll works however as
expected.
> > > >How do we want to deal with this?
> > >
> > > zlib.dll was included in zlib-1.1.4-bin.zip from
> > > http://sourceforge.net/project/showfiles.php?group_id=23617 , but is
not
> > > available for download anymore.
> > > As of zlib-1.1.4-1-bin.zip they have changed the name to zlib-1.dll.
>
> >Reason for the zlib-1.dll:
> >This version fixes a potential security problem, see details here. Any
> >software that is linked against or derived from an earlier version of
zlib
> >should be upgraded immediately. A partial list of over 500 applications
>
> I'm fine with using the new version. The question remains: How do we
> accomplish this?
>
> (Probably) libpng is linked against zlib.dll, so with the current setup we
> have to use the Z library with this name. A work-around, that I don't like
> however, is to rename the dll. Recompiling every and all libraries I
> neither like, though, as it is not as easy like on Unix.
>
> Regards,
>
>          Holger

Yes, libpng is linked with zlib.dll.
There is a new (secure) version of libpng. Binaries for FreeBSD and Mac OS.
I emailed the maintainers of Win32 libpng yesterday, asking if they are
planning on updating their binaries.

Since zlib.dll is used by several other applications (also on Win OS), there
might be a zlib.dll in windows/system (or another paht specified in the
system paths), causing gnubg to crash when libpng calls zlib (or invoke an
insecure call using that version of zlib).
So keeping the 'old' zlib.dll (insecure) or leaving it out isn't a solution.

For the time being, I propose to copy zlib-1.dll to zlib.dll and put it in
the gnubg directory.
That way the libpng calls to zlib within gnubg will be made to that
zlib(-1).dll.
(and thus: replace zlib.dll with that copied zlib-1.dll in the Installation
Archive also)

BTW: I don't think it is needed to put -zl in makefile, since gnubg is
independent of zlib. (Can someone confirm this? If not, I will check one of
those days).

Nardy