cygrunsrv CWE-428

[William Stewart]

On Tue, Apr 21, 2026 at 12:04 PM James Warnock wrote:

You are probably right. I'm not a very experienced Windows developer. I
> believe MAX_PATH is a constant provided by Windows, right? So, I guess I
> was thinking that was a hard limit that shouldn't be exceeded. But since
> this is being written to a registry value, maybe it is okay to exceed that.
>

The real issue, I think, is whether the string that is quoting the
executable fits in MAX_PATH.

The quotation marks are there for the parser; they are not part of the file
name itself. (Another way to say this: Command lines need to be quoted;
paths don't[1].)

The registry value for a service command is a command line, not a filename
path.

[Also just FYI: This mailing list prefers inline quoting rather than
top-posting]

Bill

[1] https://devblogs.microsoft.com/oldnewthing/20070515-00/?p=26863