DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 63LJZSWc1648493
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E297F4BA23DF
MIME-Version: 1.0
References: <ee2370b2-34d7-4501-8a4c-49f0b1abd13f@rackwareinc.com>
 <aee5_xG7tKyT_-9k@calimero.vinschen.de>
 <SJ1PR10MB6003CBA95C1292F7CBB8D963F82C2@SJ1PR10MB6003.namprd10.prod.outlook.com>
In-Reply-To: <SJ1PR10MB6003CBA95C1292F7CBB8D963F82C2@SJ1PR10MB6003.namprd10.prod.outlook.com>
Date: Tue, 21 Apr 2026 13:34:40 -0600
Message-ID: <CANV9t=Qy3e-J0Oz0dgmoXkr4gz9_GrXiDGYzuegqmF5b5Weu+Q@mail.gmail.com>
Subject: Re: cygrunsrv CWE-428
To: "cygwin@cygwin.com" <cygwin@cygwin.com>
From: William Stewart via Cygwin <cygwin@cygwin.com>
Reply-To: bstewart@iname.com
Cc: William Stewart <abqbill@gmail.com>
Content-Type: text/plain; charset="utf-8"
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>
Content-Transfer-Encoding: 8bit

On Tue, Apr 21, 2026 at 12:04 PM James Warnock wrote:

You are probably right. I'm not a very experienced Windows developer. I
> believe MAX_PATH is a constant provided by Windows, right? So, I guess I
> was thinking that was a hard limit that shouldn't be exceeded. But since
> this is being written to a registry value, maybe it is okay to exceed that.
>

The real issue, I think, is whether the string that is quoting the
executable fits in MAX_PATH.

The quotation marks are there for the parser; they are not part of the file
name itself. (Another way to say this: Command lines need to be quoted;
paths don't[1].)

The registry value for a service command is a command line, not a filename
path.

[Also just FYI: This mailing list prefers inline quoting rather than
top-posting]

Bill

[1] https://devblogs.microsoft.com/oldnewthing/20070515-00/?p=26863

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple