runtime: dll injection vulnerabilities on Windows [1.12 backport]

[gopherbot]

@bradfitz requested issue #30642 to be considered for backport to the next 1.12 minor release.

@gopherbot, please backport to Go 1.12.

[julieqiu]

@bradfitz - there isn't a reason provided in the gopherbot message. Would you mind providing one for this backport?

[bradfitz]

Windows security issue. From the title: "dll injection vulnerabilities on Windows"

[julieqiu]

Thanks! I'll mark this as CherryPickApproved since this is a security issue, per our policy at https://golang.org/wiki/MinorReleases.

[zx2c4]

This appears to have missed 1.12.1. What's up?

[bradfitz]

@zx2c4, because we screwed up yet again. Last time we did this I filed #30422 to fix it in our release automation, but nobody's implemented that yet.

/cc @andybons @dmitshur @ianlancetaylor @katiehockman @FiloSottile @julieqiu

[gopherbot]

Change https://golang.org/cl/168339 mentions this issue: [release-branch.go1.12] runtime: safely load DLLs

[gopherbot]

Closed by merging fc6457d to release-branch.go1.12.