From: Wietse Z Venema <wietse@porcupine.org>
Date: Tue, 4 Aug 2026 05:00:00 +0000 (-0500)
Subject: postfix-3.12-20260804
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6b3ee9d95adfb230da31adbb0dc675e8658a3ba3;p=thirdparty%2Fpostfix.git

postfix-3.12-20260804
---

diff --git a/postfix/HISTORY b/postfix/HISTORY
index f1de3aeec..f30d0ad8e 100644
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -31826,10 +31826,11 @@ Apologies for any names omitted.
 20260724
 
 	Bug (defect introduced: Postfix 3.4, date: 20180805): missing
-	RCPT TO state reset after a BDAT command error. The Postfix
-	SMTP server then accepted a DATA command and crashed with
-	a null pointer read error. Reported by OpenAI Security.
-	File: smtpd/smtpd.c.
+	SMTP server reset of RCPT TO state after a BDAT command
+	error. A crafted remote SMTP client could then send a DATA
+	command without MAIL FROM or RCPT TO, and crash the Postfix
+	SMTP server with a null pointer read error. Reported by
+	OpenAI Security. File: smtpd/smtpd.c.
 
 20260802
 
@@ -31840,14 +31841,16 @@ Apologies for any names omitted.
 
 20260803
 
-	Bug (introduced: Postfix 2.2, date: 20041102): missing
-	resets of MAIL FROM and RCPT TO command state, after
-	smtpd_end_of_data_restrictions processing rejected a message.
+	Bug (introduced: Postfix 2.2, date: 20041102): missing SMTP
+	server resets of MAIL FROM and RCPT TO command state after
+	smtpd_end_of_data_restrictions rejected a message. This
+	resulted in SMTP protocol state desynchronization between
+	the remote SMTP client and the Postfix SMTP server.
 
-	The Postfix SMTP server then accepted RCPT TO and DATA
-	without MAIL FROM, and skipped smtpd_end_of_data_restrictions
-	for the second message (smtpd_end_of_data_restrictions is
-	always skipped when a recipient counter is > 1). Reported
+	A crafted remote SMTP client could then send RCPT TO and
+	DATA without MAIL FROM, and deliver a second message. Then,
+	smtpd_end_of_data_restrictions skipped check_recipient_access
+	constraints, because a recipient counter was > 1. Reported
 	by OpenAI Security. File: smtpd/smtpd.c.
 
 	As reported by OpenAI Security, the failure to reset MAIL
@@ -31856,9 +31859,10 @@ Apologies for any names omitted.
 	this message" based on the message envelope, and
 	smtpd_end_of_data_restrictions rejected the message, the
 	Postfix SMTP server as before accepted RCPT TO and DATA
-	without MAIL FROM and skipped smtpd_end_of_data_restrictions
-	for the second message. But in this case, the Postfix Milter
-	client was still in the "accept this message" state, skipping
+	without MAIL FROM, and smtpd_end_of_data_restrictions as
+	before skipped check_recipient_access constraints for the
+	second message. Under these conditions, the Postfix Milter
+	client remained in the "accept this message" state, skipping
 	Milter policy enforcement for the second message.
 
 TODO
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index 01d25434d..3267bc3b9 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20260803"
+#define MAIL_RELEASE_DATE	"20260804"
 #define MAIL_VERSION_NUMBER	"3.12"
 
 #ifdef SNAPSHOT
diff --git a/postfix/src/postscreen/postscreen_dnsbl_test.c b/postfix/src/postscreen/postscreen_dnsbl_test.c
index 379ac115c..67b63c1ce 100644
--- a/postfix/src/postscreen/postscreen_dnsbl_test.c
+++ b/postfix/src/postscreen/postscreen_dnsbl_test.c
@@ -649,7 +649,7 @@ static void test_parallel_client_early_disc(PTEST_CTX *t, const PTEST_CASE *tp)
     event_loop(2);
 
     /*
-     * Simulate disconneting the connections with index {0, 2} by calling
+     * Simulate disconnecting the connections with index {0, 2} by calling
      * psc_dnsbl_retrieve() before receiving the DNSBL response. Their dnsbl
      * scores should be zero.
      */
diff --git a/postfix/src/smtpd/smtpd.c b/postfix/src/smtpd/smtpd.c
index 738575871..56b947e9f 100644
--- a/postfix/src/smtpd/smtpd.c
+++ b/postfix/src/smtpd/smtpd.c
@@ -4080,6 +4080,7 @@ static int skip_bdat(SMTPD_STATE *state, off_t chunk_size,
      * Reset state, or drop subsequent BDAT payloads until BDAT LAST or RSET.
      */
     if (final_chunk) {
+	chat_reset(state, var_smtpd_hist_thrsh);
 	mail_reset(state);
 	/* 202607 OpenAI: also reset recipient state. */
 	rcpt_reset(state);