Priority: P1: Critical
Affects Version/s: 5.11
Fix Version/s: None
Component/s: Network: SSL
The main issue that qt tries to load non-system libs (libeay32.dll and ssleay32.dll) with QSystemLibrary instead of QLibrary.
This causes lots of issues in the case if distributed dlls are in the different directory that exe.
For example :
- some process laucher which do SetDllDirectory and launche sub modules
- module1.exe and module1 data
- moduleN.exe and moduleN data
1) if there no other openssl binaries in the PATH then Qt will not load openssl binares!
2) if there other openssl binaries in the PATH (if some stupid 3rdpatry program modifies PATH env variable) then 2 problems may occurs:
2.1) Qt will load ssleay32.dll from PATH, but libeay32.dll will be loaded (by Windows from the standard DLL search paths) from the GetDllDirectory path!!!! The mix of binaries of different version may cause a crashes in a lots of scenarions.
2.1) Qt will load ssleay32.dll and libeay32.dll from PATH, so qt will try to work with other version that one the qt will be compiled. Usually it causes that some functioanality is not working. (for example^ we found what wss is not working)
3) Even if there are openssl binaries already loaded in the process then Qt still loading a binaries from the other location! It seems crazy then we have 2 different version libeay32.dll/ssleay32.dll loaded at the same time.
Not to use QSystemLibrary to load non-system dlls (dlls which are not shiped with OS. but shiped with program).
There is alternate solution which is seems to be logical for me:
QSystemLibrary should also try to load from the GetDllDirectory before PATH directories.
Solution for the problem #3:
QSystemLibrary should check if binary with the same name is already loaded to the process. (on Windows it is possible check with GetModuleHandle)
So there 3 bugs in Qt code:
1) QSystemLibrary tries to load dll even if dll with the same name already loaded in the process
2) QSystemLibrary is not trying to find library in the GetDllDirectory directory
3) qtnetwork uses QSystemLibrary to load non-system libraries