postfix-3.12-20260804

diff --git a/postfix/HISTORY b/postfix/HISTORY
index f1de3aeeccb0511c5f575d5386e1be32907278ee..f30d0ad8e5d2a066075999a9f926c31aa7f23d8d 100644 (file)
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -31826,10 +31826,11 @@ Apologies for any names omitted.
 20260724
 
        Bug (defect introduced: Postfix 3.4, date: 20180805): missing
-       RCPT TO state reset after a BDAT command error. The Postfix
-       SMTP server then accepted a DATA command and crashed with
-       a null pointer read error. Reported by OpenAI Security.
-       File: smtpd/smtpd.c.
+       SMTP server reset of RCPT TO state after a BDAT command
+       error. A crafted remote SMTP client could then send a DATA
+       command without MAIL FROM or RCPT TO, and crash the Postfix
+       SMTP server with a null pointer read error. Reported by
+       OpenAI Security. File: smtpd/smtpd.c.
 
 20260802
 
@@ -31840,14 +31841,16 @@ Apologies for any names omitted.
 
 20260803
 
-       Bug (introduced: Postfix 2.2, date: 20041102): missing
-       resets of MAIL FROM and RCPT TO command state, after
-       smtpd_end_of_data_restrictions processing rejected a message.
+       Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP
+       server resets of MAIL FROM and RCPT TO command state after
+       smtpd_end_of_data_restrictions rejected a message. This
+       resulted in SMTP protocol state desynchronization between
+       the remote SMTP client and the Postfix SMTP server.
 
-       The Postfix SMTP server then accepted RCPT TO and DATA
-       without MAIL FROM, and skipped smtpd_end_of_data_restrictions
-       for the second message (smtpd_end_of_data_restrictions is
-       always skipped when a recipient counter is > 1). Reported
+       A crafted remote SMTP client could then send RCPT TO and
+       DATA without MAIL FROM, and deliver a second message. Then,
+       smtpd_end_of_data_restrictions skipped check_recipient_access
+       constraints, because a recipient counter was > 1. Reported
        by OpenAI Security. File: smtpd/smtpd.c.
 
        As reported by OpenAI Security, the failure to reset MAIL
@@ -31856,9 +31859,10 @@ Apologies for any names omitted.
        this message" based on the message envelope, and
        smtpd_end_of_data_restrictions rejected the message, the
        Postfix SMTP server as before accepted RCPT TO and DATA
-       without MAIL FROM and skipped smtpd_end_of_data_restrictions
-       for the second message. But in this case, the Postfix Milter
-       client was still in the "accept this message" state, skipping
+       without MAIL FROM, and smtpd_end_of_data_restrictions as
+       before skipped check_recipient_access constraints for the
+       second message. Under these conditions, the Postfix Milter
+       client remained in the "accept this message" state, skipping
        Milter policy enforcement for the second message.
 
 TODO

diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 01d25434d4033cda172e61e2ceb2d10f9d254c3e..3267bc3b98487e82c11736668642dfe991e6a668 100644 (file)
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE      "20260803"
+#define MAIL_RELEASE_DATE      "20260804"
 #define MAIL_VERSION_NUMBER    "3.12"
 
 #ifdef SNAPSHOT

diff --git a/postfix/src/postscreen/postscreen_dnsbl_test.c b/postfix/src/postscreen/postscreen_dnsbl_test.c
index 379ac115ca18a005cd6c1f8383df461f459978ce..67b63c1ce13964358c3d940fe4f3ffcd06fbe9f0 100644 (file)
--- a/postfix/src/postscreen/postscreen_dnsbl_test.c
+++ b/postfix/src/postscreen/postscreen_dnsbl_test.c
@@ -649,7 +649,7 @@ static void test_parallel_client_early_disc(PTEST_CTX *t, const PTEST_CASE *tp)
     event_loop(2);
 
     /*
-     * Simulate disconneting the connections with index {0, 2} by calling
+     * Simulate disconnecting the connections with index {0, 2} by calling
      * psc_dnsbl_retrieve() before receiving the DNSBL response. Their dnsbl
      * scores should be zero.
      */

diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c
index 738575871b7528dd336d843af0192cfe695755be..56b947e9f342bb93391581098e906b7fbac2db52 100644 (file)
--- a/postfix/src/smtpd/smtpd.c
+++ b/postfix/src/smtpd/smtpd.c
@@ -4080,6 +4080,7 @@ static int skip_bdat(SMTPD_STATE *state, off_t chunk_size,
      * Reset state, or drop subsequent BDAT payloads until BDAT LAST or RSET.
      */
     if (final_chunk) {
+       chat_reset(state, var_smtpd_hist_thrsh);
        mail_reset(state);
        /* 202607 OpenAI: also reset recipient state. */
        rcpt_reset(state);