I don’t exactly consider Drew Devault a reliable or unbiased judge of character

Perfect example of a (part of a) security vulnerability being fixed in a commit that doesn’t immediately seem security related and would never be back ported to a stablestale distro

The code which parses the binary MaxMind database after decompression is well guarded as of 2024 but used to look different, potentially providing more attack surface. There is also an interesting commit where a contributor makes adjustments to the gzip::decompress() function which hints at a stack overflow, as the destination buffer was changed from static allocation on the stack to dynamic allocation on the heap, though it was not exploitable due to checks before it is written to

The article on theregister stated

Also inside the uploaded source code was some GPL 2 source code, which renders the not-very-open WCL moot.

Winamp published their code as “open source”. Problem is…

1. It wasn’t open source, it was proprietary but you can see the source code.
2. Their custom license didn’t even allow forks, which is against GitHub TOS
3. The codebase apparently contains proprietary code from third parties that they don’t have the right to relicense.
4. The codebase apparently contains GPL code from third parties that they probably didn’t have the right to make proprietary in the first place