dll - Possible security hole using SetDllDirectory? -

I have found a DLL that calls in my DllMain () function. Logic for SetDllDirectory () is the directory that contains the DLL, returned by the function. The effect of this is that if DLL is placed in the form of c: /foo/bar.dll , then loading bar.dll c: / Foo in the DLL search path of the calling process.

My question is: does it open any security hole? Is it safe to call the Settleal Directory () call in a function, which should be explicitly called by the library loading process? It is not really a new one, since the application path is windows in the first place, so for anyone DLS keep malicious DLL in this folder. So your SetDll directory () is a security hole without a call.