DMARC-Filter: OpenDMARC Filter v1.4.2 delorie.com 63NG5qG3949318
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 10BE44B8E077
Content-Type: multipart/mixed; boundary="------------sWx0ymBeouHhdVrYALioCBk2"
Message-ID: <be3fd48f-3e5b-4890-bf4d-ad6ac239f022@rackwareinc.com>
Date: Thu, 23 Apr 2026 10:04:40 -0600
User-Agent: Mozilla Thunderbird
Subject: Re: cygrunsrv CWE-428
To: cygwin@cygwin.com
References: <ee2370b2-34d7-4501-8a4c-49f0b1abd13f@rackwareinc.com>
 <aee5_xG7tKyT_-9k@calimero.vinschen.de>
 <SJ1PR10MB6003CBA95C1292F7CBB8D963F82C2@SJ1PR10MB6003.namprd10.prod.outlook.com>
 <CANV9t=Qy3e-J0Oz0dgmoXkr4gz9_GrXiDGYzuegqmF5b5Weu+Q@mail.gmail.com>
 <cc86af0d-fcaf-4bcd-9261-b3f738e548b0@rackwareinc.com>
 <aeiG74ROxwfRwucq@calimero.vinschen.de>
Content-Language: en-US
In-Reply-To: <aeiG74ROxwfRwucq@calimero.vinschen.de>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?V0g4cG12aHNWM0NKSlpqSDljZGNuNHRycE5XTUFaUUtQMGhwRWZ3dW1ETnF4?=
 =?utf-8?B?eW5TSFpLOHp4NGpreDZZVTg0dlc5OTJ0L21iVmV6UndRRjFHMWV1Z1FsN2k4?=
 =?utf-8?B?VjJlQWZTWHFKM1RUcEhjd0I3UUhiOFV1UDBiNzJrUVMvUEdyaUxmWWhGbGRw?=
 =?utf-8?B?a3BqUHc5Sm5YTmxzUUx1STZlanJ3UEw3YWJoVEt4bXBjZnQ0Smpzck9OaVpo?=
 =?utf-8?B?MnlpZGV1dytWdlE1U0Vxb0hiL09LVllIOVRPMGVlN1hITFVRNTRvMlBUYXJG?=
 =?utf-8?B?VzNFdUZraWorWUoxNWZneUlKQlJyL1dwaVRWODhYYmZDNHI4emVUb1NBZExw?=
 =?utf-8?B?QTE2UGxsSy9wdFM1dnFUcUMzUlVZZC9PLyswRHRBZnVzbDJUemcvcWk5NzRY?=
 =?utf-8?B?Q0d2dTduRy93YmxrOXlHSWZkZjFidDNPcFhkc29mbjQzUVhHUjlpSmFHZ1VE?=
 =?utf-8?B?ZVRURlVqZ1VhWVUxeU82cGM5cGl3ZGFSRDAvSHduWjZDbFgrYkcrQjlJQ21C?=
 =?utf-8?B?L1V4dy81LzdVeHNDV2FLNzBwRVpBa0M1YVBXRmVqWEtKdC84ODNqd1dUcHhp?=
 =?utf-8?B?WWloSlVtNVZFVi8vWXdWSUZLZEZuc1dTNExhRmx5b3VNS1p4eTRIKzMzSVJS?=
 =?utf-8?B?YWVCTk1kbUZuUWtvTU9QVVpMNnpVMUF0d2EzQ3lEVDIxQVdaaW1BS01uRXR3?=
 =?utf-8?B?Z0wrQmdUVnRoZXhMWm5nOWxTVVoyeklNV3VBUEt1d2JwdVFJeDZFUEx1NUZp?=
 =?utf-8?B?R0FnbWpNN3Y0OCtFeFJNZkp2NFZraE4wZzlQeWU4TXRLajR2Vnk1Ym5UQTFE?=
 =?utf-8?B?QUcwbDVHWnBBa0hzTCtMMEhRZmIvUTFvZ1hORmVKM2YwcE5QMUZTNXZBdmJF?=
 =?utf-8?B?aXY3RU9NOVRjOHRVdUlwQThyK3dpZEZMMWVtdnZxQXNIbzEvQmZYQzBDbjBr?=
 =?utf-8?B?T045SUs0K2VudDdvdHNuSCtTSlYvc3oxU0Evc3BYbldnb2plbW5nZ0dpQjlJ?=
 =?utf-8?B?RnhIcXNVNVlpbkYvczIyNEtnNXhBd2pwTnJtaEQ4WWc3WU1rc0owZHQ5MmFy?=
 =?utf-8?B?Y1F4NGRCRkdGOHZkL1lURGJDQW9rVEZSc3NYUjdxYzBRYTlzK3FXdkgydy9I?=
 =?utf-8?B?aXZTTUFDczJZc2pwVW1DOHc1WE5qRDZqK1ZYQmhXbytyMEdNSi9MZEJYUXBU?=
 =?utf-8?B?czg2azJaY1ZaQVkzZ01iU092b21TUWo3YmIwbEIzQ2Q3cjNuUGx1aXQybWdY?=
 =?utf-8?B?UnprdDRWd2tZZlg1Zk13VGhZWWcrRXR0WVAwdW5nL20vMWdJbUZUY2ZyYUxS?=
 =?utf-8?B?eWEzQXIyaUFnaFl1QkVURGtpaGxTc3pkdnl2aVA1cVpTUjM5YmVDYk1qWXhS?=
 =?utf-8?B?dzhXQTFPU2F2QVh1THhDUXNNSThLY3pjT2FJRUxob2Q3MlFPNUQ4VWQwV010?=
 =?utf-8?B?R0xFM0tDbHIzY0FFKy9keUpRNHFQUERyTDdnOW5ucWw2djUvU09WdEltWkJR?=
 =?utf-8?B?ZUd4K0FvcmE5TkZkZlNidnFWcS96M0xnMWtaeGUvTGVEWjMxTHNOSnBka2JI?=
 =?utf-8?B?SldESlo4Z0k1MjZVRFBaVG13RDl3dHJXYlBYMVVkb2xIZlRHbzZCd1ZVUnVt?=
 =?utf-8?B?ejhuSWg3MFp4aE0rVDF0MktPb0RwUk9UWndHRzRIK2J2blJKckM5dlg4ZVdk?=
 =?utf-8?B?dlhLeU8zanV4M1BTUERuSytkVXEwM1NFUGg3OXBuRFB5UXhYT1B5SklrbkdE?=
 =?utf-8?B?UHJMcFNPemNxRWNWQzZVaFJxYnpvdVdtUHBPajk4UU1xZWtnRC9KaWZvb1dT?=
 =?utf-8?B?OVo2MXQ1UFJURTdOMWc2YVA2YUY2QWx1T3h5aUowbUExcGc1dURGbVovRVlp?=
 =?utf-8?B?TDFvblVNZkxGbnQ2Q3BuYXkrZE1nbTVxVFZqaEFCVmFiRzZFd0h1Z1FPVExC?=
 =?utf-8?B?c3BvK0xGSUc5TWZRKzRUNmZSWk8rMFB0UTFFanQwdjJTZG5ac0ZaNlRERHNk?=
 =?utf-8?B?TVcwZGpxZm9SVmRuUHFhNWMzNVcxOVlYYlYzMUF5RG9nTlphclpzaGdkbUov?=
 =?utf-8?B?eVE2WVU0ek5KaVIwby8rREh4Y1RYNVFGTGcwT0xYUG8rK2VYK2ovZHQ0YVU1?=
 =?utf-8?B?NWpqVnQyM3dRRy9iWVZjWGJIcnN5dnBhT1VvYVo1UW5xM04yS2hnTi9iRE92?=
 =?utf-8?B?L2VJd0VNR0x5WTc2MmxjUlI1dUNBdVBWOG1Xd09IQ0ZSK2ErNzdhdmhKczhE?=
 =?utf-8?B?Q3dYaWttdUNCN21xSnY3U1pXckEvR1JHUG9UOE9uaGVSRmROY1NHbWlIY01z?=
 =?utf-8?B?WXBNVCsvUktWK1Vmdm1QMDhWU0lNZ09ZZjNGbWhyTkY4UC91M1c4eXU4T3JD?=
 =?utf-8?Q?6MHjt2c4DEBwf82Y=3D?=
X-OriginatorOrg: rackwareinc.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b745f8f6-8d93-4d5a-83c7-08dea152073a
X-MS-Exchange-CrossTenant-AuthSource: SJ1PR10MB6003.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Apr 2026 16:04:42.1257 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: acce4151-9118-4e3b-8141-9a6210dbb561
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: tdUU7996pQKjYvT5PFlZA+VeQet/8xlL7U0blOflxueeqpJey1YdFfmgkvci9CyCp/3gYvCfvX560uIsIdGskzl4Jt9a+0jQWbUXonfcfMA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB6578
X-BeenThere: cygwin@cygwin.com
X-Mailman-Version: 2.1.30
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request@cygwin.com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin@cygwin.com>
List-Help: <mailto:cygwin-request@cygwin.com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request@cygwin.com?subject=subscribe>
From: James Warnock via Cygwin <cygwin@cygwin.com>
Reply-To: James Warnock <james.warnock@rackwareinc.com>
Errors-To: cygwin-bounces~archive-cygwin=delorie.com@cygwin.com
Sender: "Cygwin" <cygwin-bounces~archive-cygwin=delorie.com@cygwin.com>

--------------sWx0ymBeouHhdVrYALioCBk2
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 4/22/26 02:29, Corinna Vinschen via Cygwin wrote:

> Most of the time it's just a permission issue.  You have to have
> (domain) admin perms on the remote machine and you have to run in an
> elevated shell.

I didn't have a domain set up so I had to do that. Once I got it all
up and running, The remote service install progressed further but
failed to open the key. When I checked what key it was opening it was:

"SOFTWARE\\Cygnus Solutions\\Cygwin\\mounts v2\\/"

After some research, it appears that might be an old key. I changed it
to:

"SOFTWARE\\Cygwin\\setup"

And changed the value name from "native" to "rootdir". With those
changes, the remote install worked. I don't know if I did something
wrong and that necessitated those extra changes, but I think my test
still counts.

My changes are based on master with the commit hash
bfc6c36a052914cd4aa93d883e73a2964969e4e5. Maybe I'm on the wrong
repository or commit and that is why I am seeing the old key.
Hopefully I'm not working from the wrong place and just wasting your
time.

Anyway, the new version of the patch is attached (hopefully correctly).
It increases the buffer size to include the quotes rather than limiting
the path size to accommodate the quotes. I thought about trying to
handle buffer overflows, but since none of the other strcat calls did
that, I decided to hold off.

Thanks,
James

--------------sWx0ymBeouHhdVrYALioCBk2
Content-Type: text/x-patch; charset=UTF-8; name="cwe-428.patch"
Content-Disposition: attachment; filename="cwe-428.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL2N5Z3J1bnNydi5jYyBiL2N5Z3J1bnNydi5jYwppbmRleCBkYWI4NzkwLi42
OTUxMjQ0IDEwMDY0NAotLS0gYS9jeWdydW5zcnYuY2MKKysrIGIvY3lncnVuc3J2LmNjCkBAIC04
MDksNyArODA5LDggQEAgaW5zdGFsbF9zZXJ2aWNlIChjb25zdCBjaGFyICpuYW1lLCBjb25zdCBj
aGFyICpjcnNwYXRoLCBjb25zdCBjaGFyICpkaXNwLAogCQkgdHlwZV90IHR5cGUsIGNoYXIgKnVz
ZXIsIGNoYXIgKnBhc3MsIGNoYXIgKipkZXBzLAogCQkgaW50IGludGVyYWN0aXZlKQogewotICBj
aGFyIG15cGF0aFtNQVhfUEFUSF07CisgIGNoYXIgbXlwYXRoW01BWF9QQVRIKzJdOworICBjaGFy
KiBteXBhdGhfcCA9IG15cGF0aDsKICAgU0NfSEFORExFIHNtID0gKFNDX0hBTkRMRSkgMDsKICAg
U0NfSEFORExFIHNoID0gKFNDX0hBTkRMRSkgMDsKICAgY2hhciB1c2VyYnVmW0lOVEVSTkVUX01B
WF9IT1NUX05BTUVfTEVOR1RIICsgVU5MRU4gKyAyXTsKQEAgLTgyNCw5ICs4MjUsMTEgQEAgaW5z
dGFsbF9zZXJ2aWNlIChjb25zdCBjaGFyICpuYW1lLCBjb25zdCBjaGFyICpjcnNwYXRoLCBjb25z
dCBjaGFyICpkaXNwLAogICBpZiAoIXNhbi5zZXJ2ZXIgKCkpCiAgICAgY2hlY2tfc3lzdGVtX21v
dW50cyAoKTsKIAorICBteXBhdGhbMF0gPSAnIic7CisgIG15cGF0aF9wKys7CiAgIGlmIChjcnNw
YXRoKQkJICAvKiBHb3QgcGF0aCwgbm90aGluZyB0byBkby4gKi8KICAgICB7Ci0gICAgICBjeWd3
aW5fY29udl9wYXRoIChDQ1BfUE9TSVhfVE9fV0lOX0EsIGNyc3BhdGgsIG15cGF0aCwgTUFYX1BB
VEgpOworICAgICAgY3lnd2luX2NvbnZfcGF0aCAoQ0NQX1BPU0lYX1RPX1dJTl9BLCBjcnNwYXRo
LCBteXBhdGhfcCwgTUFYX1BBVEgpOwogICAgICAgaWYgKHN0cmNhc2VjbXAgKG15cGF0aCArIHN0
cmxlbiAobXlwYXRoKSAtIDQsICIuZXhlIikgIT0gMCkKICAgICAgICAgc3RyY2F0IChteXBhdGgs
ICIuZXhlIik7CiAgICAgfQpAQCAtODM3LDE1ICs4NDAsMTYgQEAgaW5zdGFsbF9zZXJ2aWNlIChj
b25zdCBjaGFyICpuYW1lLCBjb25zdCBjaGFyICpjcnNwYXRoLCBjb25zdCBjaGFyICpkaXNwLAog
CQkJICAgICAgIEtFWV9SRUFELCAmY3lnX3Jvb3Rfa2V5KSkgIT0gRVJST1JfU1VDQ0VTUykKIAll
cnJfb3V0X3NldF9lcnJvciAoUmVnT3BlbktleUV4LCByZXQpOwogICAgICAgaWYgKChyZXQgPSBS
ZWdRdWVyeVZhbHVlRXggKGN5Z19yb290X2tleSwgKFBDSEFSKSBDWUdfUk9PVF9WQUwsIDAsICZ0
eXBlLAotCQkJCSAgKEJZVEUgKikgbXlwYXRoLCAmc2l6ZSkpICE9IEVSUk9SX1NVQ0NFU1MpCisJ
CQkJICAoQllURSAqKSBteXBhdGhfcCwgJnNpemUpKSAhPSBFUlJPUl9TVUNDRVNTKQogCWVycl9v
dXRfc2V0X2Vycm9yIChSZWdRdWVyeVZhbHVlRXgsIHJldCk7Ci0gICAgICBzdHJjYXQgKG15cGF0
aCwgIlxcYmluXFxjeWdydW5zcnYuZXhlIik7CisgICAgICBzdHJjYXQgKG15cGF0aF9wLCAiXFxi
aW5cXGN5Z3J1bnNydi5leGUiKTsKICAgICB9CiAgIGVsc2UJCQkgIC8qIEdldCBvd24gZnVsbCBw
YXRoLiAqLwogICAgIHsKLSAgICAgIGlmICghR2V0TW9kdWxlRmlsZU5hbWUgKE5VTEwsIG15cGF0
aCwgTUFYX1BBVEgpKQorICAgICAgaWYgKCFHZXRNb2R1bGVGaWxlTmFtZSAoTlVMTCwgbXlwYXRo
X3AsIE1BWF9QQVRIKSkKIAllcnJfb3V0IChHZXRNb2R1bGVGaWxlTmFtZSk7CiAgICAgfQorICBz
dHJjYXQgKG15cGF0aF9wLCAiXCIiKTsKICAgLyogT3BlbiBzZXJ2aWNlIG1hbmFnZXIgZGF0YWJh
c2UuICovCiAgIGlmICghKHNtID0gT3BlblNDTWFuYWdlciAoc2FuLnNlcnZlciAoKSwgTlVMTCwK
IAkJCSAgICBTQ19NQU5BR0VSX0NPTk5FQ1QgfCBTQ19NQU5BR0VSX0NSRUFURV9TRVJWSUNFKSkp
Cg==

--------------sWx0ymBeouHhdVrYALioCBk2
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

--------------sWx0ymBeouHhdVrYALioCBk2--