From: Wietse Z Venema <wietse@porcupine.org>
Date: Fri, 15 May 2026 05:00:00 +0000 (-0500)
Subject: postfix-3.10.10
X-Git-Tag: v3.10.10^0
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=fc079fe2fb6014715d54a9a72083be08b4ba816a;p=thirdparty%2Fpostfix.git

postfix-3.10.10
---

diff --git a/postfix/HISTORY b/postfix/HISTORY
index 393849d85..6c372d611 100644
--- a/postfix/HISTORY
+++ b/postfix/HISTORY
@@ -29328,3 +29328,31 @@ Apologies for any names omitted.
 	Cleanup: log a fatal error instead of dereferencing a null
 	pointer after a first/next cursor initialization failure.
 	Fedor Vorobev. File: util/dict_db.c.
+
+20260507
+
+	Fix for 'uninitialized value' error. Viktor Dukhovni. File:
+	auxiliary/collate/collate.pl.
+ 
+20260508
+
+	Claude AI finding: signed integer overshift (util/vstring.h).
+	Brought to our attention by Robert Sayre.
+
+20260513
+
+	Bitrot: builds with musl libc were using the obsolete
+	NO_SNPRINTF code path in vbuf_print.c. File: util/sys_defs.h.
+
+20260514
+
+	Bitrot: the obsolete NO_SNPRINTF code path in vbuf_print.c
+	wasn't updated for Claude Code findings. File: util/vbuf_print.c.
+
+20250515
+
+	Portability: The __MAXINT__(T) macro, to determine the
+	maximal signed value for objects of type T, was using
+	implementation-defined behavior (shift one bit into the
+	sign position). This works today but may break later.
+	Reported by Kamil Frankowicz. File: util/sys_defs.h.
diff --git a/postfix/auxiliary/collate/collate.pl b/postfix/auxiliary/collate/collate.pl
index 62d08b972..e00284ec1 100755
--- a/postfix/auxiliary/collate/collate.pl
+++ b/postfix/auxiliary/collate/collate.pl
@@ -122,8 +122,7 @@ while (<>) {
 			if (defined($transaction{$qid})) {
 				$transaction{$qid} .= $_;
 			}
-			$transaction{$newid} =
-				$_ . $transaction{$newid};
+			$transaction{$newid} = $_ . ($transaction{$newid} // "");
 			$seqno{$newid} = ++$i if (! exists $seqno{$newid});
 		}
 		next;
diff --git a/postfix/src/global/mail_version.h b/postfix/src/global/mail_version.h
index a610e22e5..42e7d9713 100644
--- a/postfix/src/global/mail_version.h
+++ b/postfix/src/global/mail_version.h
@@ -20,8 +20,8 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20260501"
-#define MAIL_VERSION_NUMBER	"3.10.9"
+#define MAIL_RELEASE_DATE	"20260515"
+#define MAIL_VERSION_NUMBER	"3.10.10"
 
 #ifdef SNAPSHOT
 #define MAIL_VERSION_DATE	"-" MAIL_RELEASE_DATE
diff --git a/postfix/src/util/sys_defs.h b/postfix/src/util/sys_defs.h
index 74319f29d..5c7e2a772 100644
--- a/postfix/src/util/sys_defs.h
+++ b/postfix/src/util/sys_defs.h
@@ -797,8 +797,6 @@ extern int initgroups(const char *, int);
 #if HAVE_GLIBC_API_VERSION_SUPPORT(2, 1)
 #define SOCKADDR_SIZE	socklen_t
 #define SOCKOPT_SIZE	socklen_t
-#else
-#define NO_SNPRINTF
 #endif
 #ifndef NO_IPV6
 #define HAS_IPV6
@@ -1701,13 +1699,15 @@ typedef int pid_t;
 
  /*
   * Bit banging!! There is no official constant that defines the INT_MAX
-  * equivalent for off_t, ssize_t, etc. Wietse came up with the following
-  * macro that works as long as off_t, ssize_t, etc. use one's or two's
-  * complement logic (that is, the maximum value is binary 01...1). Don't use
-  * right-shift for signed types: the result is implementation-defined.
+  * equivalent for off_t, ssize_t, etc. Decades ago, Wietse came up with a
+  * macro that worked on one's or two's complement logic (that is, the
+  * maximum value is binary 01...1). As Kamil Frankowicz pointed out, that
+  * code relied on shifting into the sign bit, which is not defined in the
+  * language standard. The current version still works on one's and two's
+  * complement logic, but avoids the undefined behavior.
   */
 #include <limits.h>
-#define __MAXINT__(T) ((T) ~(((T) 1) << ((sizeof(T) * CHAR_BIT) - 1)))
+#define __MAXINT__(T) ((((T) 1 << (sizeof(T) * CHAR_BIT - 2)) - 1) * 2 + 1)
 #ifndef OFF_T_MAX
 #define OFF_T_MAX __MAXINT__(off_t)
 #endif
diff --git a/postfix/src/util/vbuf_print.c b/postfix/src/util/vbuf_print.c
index 0b8fe6bd4..38ec9b452 100644
--- a/postfix/src/util/vbuf_print.c
+++ b/postfix/src/util/vbuf_print.c
@@ -123,8 +123,11 @@
 	VBUF_SKIP(bp); \
     } while (0)
 #else
-#define VBUF_SNPRINTF(bp, sz, fmt, arg) do { \
-	if (VBUF_SPACE((bp), (sz)) != 0) \
+#define VBUF_SNPRINTF(bp, width_or_prec, type_space, fmt, arg) do { \
+	if ((width_or_prec) > INT_MAX - (type_space)) \
+	    msg_panic("vbuf_print: field width (%d + %lu) > INT_MAX", \
+		(width_or_prec), (unsigned long) (type_space)); \
+	if (VBUF_SPACE((bp), (width_or_prec) + (type_space)) != 0) \
 	    return (bp); \
 	sprintf((char *) (bp)->ptr, (fmt), (arg)); \
 	VBUF_SKIP(bp); \
diff --git a/postfix/src/util/vstring.h b/postfix/src/util/vstring.h
index 49fd960aa..c478d02af 100644
--- a/postfix/src/util/vstring.h
+++ b/postfix/src/util/vstring.h
@@ -62,7 +62,7 @@ CHECK_VAL_HELPER_DCL(VSTRING_CTL, ssize_t);
 
 /* Flags 24..31 are reserved for VSTRING. */
 #define VSTRING_FLAG_EXACT	(1<<24)	/* exact allocation for tests */
-#define VSTRING_FLAG_MASK	(255 << 24)
+#define VSTRING_FLAG_MASK	(255U << 24)
 
  /*
   * Macros. Unsafe macros have UPPERCASE names.