Change usage of DEPENDENTLOADFLAG

README.md

@@ -450,6 +450,8 @@ CMake:
   - `OIDN_INSTALL_DEPENDENCIES`: Enable installing the dependencies
     (e.g. TBB, SYCL runtime) as well.
 
+  - `OIDN_DEPENDENTLOADFLAG`: Value for DEPENDENTLOADFLAG linker flag on Windows. For more information, see [SECURITY.md](SECURITY.md#security-considerations)
+
   - `TBB_ROOT`: The path to the TBB installation (autodetected by
     default).
 

SECURITY.md

@@ -1,5 +1,20 @@
-# Security Policy
-Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation. 
-
-## Reporting a Vulnerability
-Please report any security vulnerabilities in this project utilizing the guidelines [here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).
+# Security Policy
+Intel is committed to rapidly addressing security vulnerabilities affecting our customers and providing clear guidance on the solution, impact, severity and mitigation. 
+
+## Reporting a Vulnerability
+Please report any security vulnerabilities in this project utilizing the guidelines [here](https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html).
+
+
+## Security Considerations
+When integrating this library into your application, you are responsible for ensuring overall application security. If you are building and using the **Open Image Denoise (OIDN) library** from source, be aware of potential security risks, including **DLL planting attacks** and other dynamic library loading vulnerabilities.
+
+To help mitigate such risks, we provide the `OIDN_DEPENDENTLOADFLAG` CMake option. This allows you to specify the appropriate **Windows linker flag** based on your security requirements. By default, this option is not set, and you should configure it according to your deployment needs. See the official Microsoft documentation for more details: [DEPENDENTLOADFLAG Linker Option](https://learn.microsoft.com/en-us/cpp/build/reference/dependentloadflag?view=msvc-170).
+
+To enable and set this flag, configure your build with:
+
+cmake -DOIDN_DEPENDENTLOADFLAG=<value> ..
+
+For more information on securing dynamic library loading, refer to Microsoft's official documentation on:  
+
+- [Safe DLL Search Mode](https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order)  
+- [Dynamic-Link Library Security](https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-security)  

cmake/oidn_platform.cmake

@@ -226,21 +226,31 @@ endif()
 ## Security
 ## -------------------------------------------------------------------------------------------------
 
+
+if(WIN32)
+  set(OIDN_DEPENDENTLOADFLAG "" CACHE STRING "Set DEPENDENTLOADFLAG linker option")
+  if(OIDN_DEPENDENTLOADFLAG)
+    if(CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
+      append(CMAKE_EXE_LINKER_FLAGS    "/DEPENDENTLOADFLAG:${OIDN_DEPENDENTLOADFLAG}")
+      append(CMAKE_SHARED_LINKER_FLAGS "/DEPENDENTLOADFLAG:${OIDN_DEPENDENTLOADFLAG}")
+    elseif(CMAKE_CXX_COMPILER_ID STREQUAL "IntelLLVM")
+      append(CMAKE_EXE_LINKER_FLAGS    "/Qoption,link,/DEPENDENTLOADFLAG:${OIDN_DEPENDENTLOADFLAG}")
+      append(CMAKE_SHARED_LINKER_FLAGS "/Qoption,link,/DEPENDENTLOADFLAG:${OIDN_DEPENDENTLOADFLAG}")
+    elseif(CMAKE_CXX_COMPILER_ID STREQUAL "Clang" AND CMAKE_CXX_COMPILER_VERSION VERSION_GREATER_EQUAL 19)
+      append(CMAKE_EXE_LINKER_FLAGS    "-Xlinker /DEPENDENTLOADFLAG:${OIDN_DEPENDENTLOADFLAG}")
+      append(CMAKE_SHARED_LINKER_FLAGS "-Xlinker /DEPENDENTLOADFLAG:${OIDN_DEPENDENTLOADFLAG}")
+    else()
+      message(WARNING "The current compiler does not support DEPENDENTLOADFLAG.")
+    endif()
+  endif()
+endif()
+
 if(MSVC)
   # Enable buffer security check
   append(OIDN_C_CXX_FLAGS "/GS")
   # Enable control flow guard
   append(OIDN_C_CXX_FLAGS "/guard:cf")
 
-  if(WIN32)
-    if(CMAKE_CXX_COMPILER_ID STREQUAL "MSVC")
-      append(CMAKE_EXE_LINKER_FLAGS    "/DEPENDENTLOADFLAG:0x2000")
-      append(CMAKE_SHARED_LINKER_FLAGS "/DEPENDENTLOADFLAG:0x2000")
-    elseif(CMAKE_CXX_COMPILER_ID STREQUAL "IntelLLVM")
-      append(CMAKE_EXE_LINKER_FLAGS    "/Qoption,link,/DEPENDENTLOADFLAG:0x2000")
-      append(CMAKE_SHARED_LINKER_FLAGS "/Qoption,link,/DEPENDENTLOADFLAG:0x2000")
-    endif()
-  endif()
 else()
   append(OIDN_C_CXX_FLAGS_RELEASE "-fstack-protector")
 

scripts/build.py

@@ -170,6 +170,10 @@ if cfg.target in {'install', 'package'}:
 if cfg.target == 'package':
   config_cmd += ' -D OIDN_ZIP_MODE=ON'
 
+if cfg.target == 'package' and OS == 'windows':
+  # LOAD_LIBRARY_SEARCH_DLL_LOAD_DIR (0x00000100) | LOAD_LIBRARY_SEARCH_DEFAULT_DIRS (0x00001000) = 0x00001100
+  config_cmd += ' -D OIDN_DEPENDENTLOADFLAG=0x00001100'
+
 if cfg.target == 'install':
   config_cmd += f' -D CMAKE_INSTALL_PREFIX={cfg.install_dir}'