cygstart: buffer overflow when a URI is passed (cygutils-1.4.17-[23])

[Mark Geisert]

Hi Jeremy,

On 4/24/2025 1:43 PM, Jeremy Drake via Cygwin-apps wrote:
> On Thu, 24 Apr 2025, Mark Geisert via Cygwin-apps wrote:
> 
>> Hi Jeremy,
>>
>> On 4/24/2025 11:57 AM, Jeremy Drake via Cygwin-apps wrote:
>>> On Wed, 23 Apr 2025, Mark Geisert via Cygwin wrote:
>>>
>>>> A new version 1.4.17-4 of the cygutils packages with a corrected
>>>> 'cygstart' is now making its way to the mirrors.
>>>
>>> Can I ask why patches are made in the packaging rather than applied to
>>> the cygwin-apps/cygutils git repository, given that this package is
>>> "local" to Cygwin and therefore has no other "upstream"?  How would you
>>> decide to make a 1.4.17-4 rather than a 1.4.18-1?
>>
>> A fair question.
>>
>> I think cygutils might have been the first package I ITA'd years ago.  I
>> wasn't yet up to speed on the whole package management framework.  I'm
>> (somewhat) better with the more recent adoptions I've made.  As time permits
>> all the packages I manage will be done identically and involve the cygwin-apps
>> git repository, the CI process, etc.
>>
>> I personally would probably go to 1.4.18-1 when some major packaging change
>> was made.  I went from 1.4.16 to 1.4.17 when I took over from Chuck Wilson.
>>
>> As for every maintainer here (and elsewhere), lack of time is an issue.
> 
> OK.  It made trying to update the package in MSYS2 more of a pain
> (https://github.com/msys2/MSYS2-packages/pull/5353).  I went with
> making your package revision into a 4th part of the version, so that
> the MSYS2 package could maintain its own "pkgrel".

Apologies for the extra effort needed. I didn't foresee any issues with 
how I chose to number released packages. At some point (sometime this 
year) I'll switch to 3-part versions for cygutils.

> You may be interested in the patch I just made to allow the package to
> build against older runtimes (by skipping lssparse if SEEK_HOLE is not
> defined).
[...]

Thanks very much! I've collected that and added it to the source tree 
for the next build at some future time.
Regards,

..mark