Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package fetchmail for openSUSE:Factory checked in at 2026-10-23 20:26:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/fetchmail (Old) and /work/SRC/openSUSE:Factory/.fetchmail.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "fetchmail" Fri Oct 23 20:26:55 2026 rev:124 rq:1387170 version:6.6.9 Changes: -------- --- /work/SRC/openSUSE:Factory/fetchmail/fetchmail.changes 2026-10-13 17:48:39.822660415 +0200 +++ /work/SRC/openSUSE:Factory/.fetchmail.new.2252680/fetchmail.changes 2026-10-23 20:26:59.232244822 +0200 @@ -1,0 +2,21 @@ +Sun Oct 11 16:34:39 UTC 2026 - ecsos <[email protected]> + +- Update to 6.6.9 + * When fetchmail was built with NTLM support, and a POP3 server send + a malformed challenge to the authentication request, + fetchmail would call strtok() on an uninitialized stack buffer and + could in extreme cases read off the end of the buffer if it did not + contain 0x00 or 0x20 bytes, and corrupt the first 0x20 character to 0x00. + This will not allow remote code injection but can cause undefined + behavior including crashes of fetchmail or corrupting one bit of memory. + This is a regression introduced by commit 09f95921 that also became + part of all fetchmail-6.6.7.rc1 and later release candidates and the + 6.6.7 and 6.6.8 releases. It is separate from CVE-2026-94184 and + just happened to be introduced anew in the same releases that fixed + the mentioned CVE. + Reported by Jakub Kulik, Gitlab Issue #98. + * Fix missing CR when sending multi-line warning messages from + daemon mode. Reported by Andrea Venturoli, Gitlab Issue #99. +- Correct source URLs in spec by using branch 6.6 + +------------------------------------------------------------------- Old: ---- fetchmail-6.6.8.tar.xz fetchmail-6.6.8.tar.xz.asc New: ---- fetchmail-6.6.9.tar.xz fetchmail-6.6.9.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ fetchmail.spec ++++++ --- /var/tmp/diff_new_pack.uUwzk1/_old 2026-10-23 20:27:00.430294974 +0200 +++ /var/tmp/diff_new_pack.uUwzk1/_new 2026-10-23 20:27:00.431295016 +0200 @@ -21,7 +21,7 @@ %define _fillupdir %{_localstatedir}/adm/fillup-templates %endif Name: fetchmail -Version: 6.6.8 +Version: 6.6.9 Release: 0 Summary: Full-Featured POP and IMAP Mail Retrieval Daemon License: GPL-2.0-or-later ++++++ fetchmail-6.6.8.tar.xz -> fetchmail-6.6.9.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/NEWS new/fetchmail-6.6.9/NEWS --- old/fetchmail-6.6.8/NEWS 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/NEWS 2026-10-03 13:30:10.000000000 +0200 @@ -110,6 +110,26 @@ systems that are not safe beyond the year 2038. ------------------------------------------------------------------------------- +fetchmail-6.6.9 (released 2026-10-03, 31262 LoC): + +## BUGFIXES: +* When fetchmail was built with NTLM support, and a POP3 server send + a malformed challenge to the authentication request, + fetchmail would call strtok() on an uninitialized stack buffer and + could in extreme cases read off the end of the buffer if it did not + contain 0x00 or 0x20 bytes, and corrupt the first 0x20 character to 0x00. + This will not allow remote code injection but can cause undefined + behavior including crashes of fetchmail or corrupting one bit of memory. + This is a regression introduced by commit 09f95921 that also became + part of all fetchmail-6.6.7.rc1 and later release candidates and the + 6.6.7 and 6.6.8 releases. It is separate from CVE-2026-94184 and + just happened to be introduced anew in the same releases that fixed + the mentioned CVE. + Reported by Jakub Kulik, Gitlab Issue #98. +* Fix missing CR when sending multi-line warning messages from + daemon mode. Reported by Andrea Venturoli, Gitlab Issue #99. + +------------------------------------------------------------------------------- fetchmail-6.6.8 (released 2026-09-22, 31232 LoC): ## SECURITY ADVISORY: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/configure new/fetchmail-6.6.9/configure --- old/fetchmail-6.6.8/configure 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/configure 2026-10-03 13:30:10.000000000 +0200 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.72 for fetchmail 6.6.8. +# Generated by GNU Autoconf 2.72 for fetchmail 6.6.9. # # Report bugs to <[email protected]>. # @@ -604,8 +604,8 @@ # Identity of this package. PACKAGE_NAME='fetchmail' PACKAGE_TARNAME='fetchmail' -PACKAGE_VERSION='6.6.8' -PACKAGE_STRING='fetchmail 6.6.8' +PACKAGE_VERSION='6.6.9' +PACKAGE_STRING='fetchmail 6.6.9' PACKAGE_BUGREPORT='[email protected]' PACKAGE_URL='https://www.fetchmail.info/' @@ -1417,7 +1417,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -'configure' configures fetchmail 6.6.8 to adapt to many kinds of systems. +'configure' configures fetchmail 6.6.9 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1488,7 +1488,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of fetchmail 6.6.8:";; + short | recursive ) echo "Configuration of fetchmail 6.6.9:";; esac cat <<\_ACEOF @@ -1642,7 +1642,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -fetchmail configure 6.6.8 +fetchmail configure 6.6.9 generated by GNU Autoconf 2.72 Copyright (C) 2023 Free Software Foundation, Inc. @@ -2198,7 +2198,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by fetchmail $as_me 6.6.8, which was +It was created by fetchmail $as_me 6.6.9, which was generated by GNU Autoconf 2.72. Invocation command line was $ $0$ac_configure_args_raw @@ -3764,7 +3764,7 @@ # Define the identity of the package. PACKAGE='fetchmail' - VERSION='6.6.8' + VERSION='6.6.9' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -15197,7 +15197,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by fetchmail $as_me 6.6.8, which was +This file was extended by fetchmail $as_me 6.6.9, which was generated by GNU Autoconf 2.72. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -15266,7 +15266,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -fetchmail config.status 6.6.8 +fetchmail config.status 6.6.9 configured by $0, generated by GNU Autoconf 2.72, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/fetchmail-FAQ.pdf new/fetchmail-6.6.9/fetchmail-FAQ.pdf --- old/fetchmail-6.6.8/fetchmail-FAQ.pdf 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/fetchmail-FAQ.pdf 2026-10-03 13:30:10.000000000 +0200 @@ -1,6 +1,6 @@ %PDF-1.4 %���� -1 0 obj<</Producer(htmldoc 1.9.17 Copyright 2011-2022 by Michael R Sweet)/CreationDate(D:2026092221173600000)/Title(The Fetchmail FAQ)/Keywords(fetchmail, POP3, IMAP, remote mail)>>endobj +1 0 obj<</Producer(htmldoc 1.9.17 Copyright 2011-2022 by Michael R Sweet)/CreationDate(D:2026100311301000000)/Title(The Fetchmail FAQ)/Keywords(fetchmail, POP3, IMAP, remote mail)>>endobj 2 0 obj<</Type/Encoding/Differences[ 32/space/exclam/quotedbl/numbersign/dollar/percent/ampersand/quotesingle/parenleft/parenright/asterisk/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/asciicircum/underscore/grave/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/braceleft/bar/braceright/asciitilde 128/endash 160/space/exclamdown/cent/sterling/currency/yen/brokenbar/section/dieresis/copyright/ordfeminine/guillemotleft/logicalnot/minus/registered/macron/degree/plusminus/twosuperior/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior/ordmasculine/guillemotright/onequarter/onehalf/threequarters/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis/multiply/O slash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis]>>endobj 3 0 obj<</Type/Font/Subtype/Type1/BaseFont/Courier/Encoding 2 0 R>>endobj 4 0 obj<</Type/Font/Subtype/Type1/BaseFont/Courier-Bold/Encoding 2 0 R>>endobj @@ -7701,7 +7701,7 @@ 0000349208 00000 n 0000349364 00000 n trailer -<</Size 733/Root 732 0 R/Info 1 0 R/ID[<391a7cc81d992db1582be908433c2eea><391a7cc81d992db1582be908433c2eea>]>> +<</Size 733/Root 732 0 R/Info 1 0 R/ID[<9b25a0fb59bf2527b614fc65c7b09c9b><9b25a0fb59bf2527b614fc65c7b09c9b>]>> startxref 349872 %%EOF diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/fetchmail-SA-2026-01.txt new/fetchmail-6.6.9/fetchmail-SA-2026-01.txt --- old/fetchmail-6.6.8/fetchmail-SA-2026-01.txt 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/fetchmail-SA-2026-01.txt 2026-10-03 13:30:10.000000000 +0200 @@ -9,8 +9,8 @@ conventions, and compiler flags. Author: Matthias Andree -Version: 1.2 -Announced: 2026-06-27, revised 2026-09-22 +Version: 1.3 +Announced: 2026-06-27, revised 2026-09-23 Type: failure to validate network input in certain configurations Impact: attacker may write a few dozen bytes on stack Severity: - high if built with NTLM enabled, depending on build details @@ -40,9 +40,10 @@ fetchmail release 6.6.7 Context: https://bugzilla.redhat.com/show_bug.cgi?id=2531984 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1117136 + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148731 -History: 1.2 2026-09-22 added CVE Id, CVSS v3.1, revised +History: 1.3 2ß26-09-23 corrected Debian Bug reference + 1.2 2026-09-22 added CVE Id, CVSS v3.1, revised 2026-09-11 removed SMTP-related part from section 3. 1.1 2026-09-11 revised, vulnerable with certain compilers 1.0 2026-07-23 revised announcement, revoked vulnerability @@ -163,19 +164,21 @@ Use the information herein at your own risk. END of fetchmail-SA-2026-01 + + -----BEGIN PGP SIGNATURE----- -iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmqy51cACgkQ5BKxVu/z -hVqbHg//QOcxhFVz93MgYiABJKSnE9w2psHQAq6nWdXVKk4JIgQNG6HIt7bD5I7c -9kQXqhM5W0dRKbEzOANuu5aNd4wnW/D6p1m96zYNSzV+v09ZwvEKPIKK/aupDhaz -OIKA9iCzcJL8GuEoS+TNudD/VioBYQRJcTOXhxRP3syNf/5p+H6gCgnn36TtVhDM -YjOytozVE1SkXN+xJ2hZmu/rWIZ+TcnKDbQ6/vKGcIsn+Z4QkG1cndSu4ARz/+ba -Jf21dkIsP2YNgQPt21gQLS5OsewpuPZZsdPt9AL7a+WE8V9GfcH7CkZt5GnktNVv -7+wOHMrrSASgf60FLoeExp7TPtofWmlGMkXFlbwFok+O6oeRCyqtWBsmOGk32oxA -0Lr4wxMnBoFydTJAVRm87GCuU+FE+KhnOnkirfjnBZvUTiG4mHtPE0dA0LLi8ZFW -esBWpIGDaKJTdVQas8xzuVZH7yQRihu1IRgl5pHXmLpVN+bs34d5dmDoigt6k+zq -OKgqRCTwbPyqsNTCvUc6TKfhAlKPuhzYW63a+WOe7Jh0OfDS480aA4PViz78NMd6 -Q0XSmlfDVDGI+JGwoqHwzhVLDgXeZzu3UHHZN9xVDEbbjbIjmhMKfNHDJ17JdZE8 -is9oew9QIL1yEWy54GQhTCCNKuWMxbzvSoplM4YrGiJjSpPheL0= -=frBn +iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmq0L6oACgkQ5BKxVu/z +hVqN7A//QOXKimKMZ8HLiu4MCxn6/rgXkLVkksEtH5FvfGN73ZZxcefswoGbqMDv +jG4U+DDmVWjXeHRx9nlBU69ReXKTA74GPY4EdweqXzvzrq134A004yJhgrfyCnU1 +hyw7KtFcx/70+ONega1838Nt3crWXH0tOhnpoJOYSXBnteuhlf6CQjasn3Sa1ehw +ague1iyojJFrr4KO/nNdI8uOlEDRx7o3AqU2Z4a0OA4EXF0RDTLHM1yF7IRO+I0H +6e8BueMP61UKByrAQIRIN0ZZZ2n0Duy7efMIrkVYF1whhLzWNqGDdWjX5ez36b5Z +6bLBGkXiQBmlevM3WxsGO1PuOL0ZIjINjnpzUOjG1Mcc677n3NeTpK11oKKCAJhq +Qja/qfvdlJ/QKuRIZhP1nJLMns47X6/gLBIGagZXp3U72PNp59klF4GdWmgmJXVV +On74/O+LhfHyLLCSk7QsBLz3ybJ6sXCbWWV1TPUEt4MWOnXR8nMK8yg14K1WCYSq +Lcebr/O/70tdeVT5vWRVGi6le4XHglfHEVkDJOPzWpCuu4rif8FBf3mmua8ZWuTh +SWIUHloioL1Xtw2T6AS9qSYWheLI0klAe/wzGCdYy4JwoNg6JoA3LnUetpPljExA +tmRx3UnR/1EQF3JXmu5Ze68x6VDIaupEMdZf2T1B3tZCzhkGDEM= +=XF5O -----END PGP SIGNATURE----- diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/fetchmail.c new/fetchmail-6.6.9/fetchmail.c --- old/fetchmail-6.6.8/fetchmail.c 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/fetchmail.c 2026-10-03 13:30:10.000000000 +0200 @@ -201,7 +201,7 @@ */ static void y2038_check_or_warn(void) { - const int epoch_ts_2028_01_01 = 1830297600 / 2; /* 2028-01-01T00:00Z */ + const int epoch_ts_2028_01_01 = 1830297600L; /* 2028-01-01T00:00Z */ time_t t; errno = 0; if (time(&t) == (time_t)-1 && errno == EOVERFLOW) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/fetchmail.man new/fetchmail-6.6.9/fetchmail.man --- old/fetchmail-6.6.8/fetchmail.man 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/fetchmail.man 2026-10-03 13:30:10.000000000 +0200 @@ -10,7 +10,7 @@ .\" .\" The date is the last change of actual content, the version should match .\" the distribution (configure.ac). -.TH FETCHMAIL 1 2025-10-10 "fetchmail 6.6.8" "fetchmail reference manual" +.TH FETCHMAIL 1 2025-10-10 "fetchmail 6.6.9" "fetchmail reference manual" .SH NAME fetchmail \- fetch mail from a POP, IMAP, ETRN, or ODMR-capable server diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/fetchmail.spec new/fetchmail-6.6.9/fetchmail.spec --- old/fetchmail-6.6.8/fetchmail.spec 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/fetchmail.spec 2026-10-03 13:30:10.000000000 +0200 @@ -4,7 +4,7 @@ %define have_python 1 Name: fetchmail -Version: 6.6.8 +Version: 6.6.9 Release: 1 Vendor: The Community Fetchmail Project Packager: Fetchmail Developers <[email protected]> @@ -205,5 +205,5 @@ %endif %changelog -* Tue Sep 22 2026 <[email protected]> 6.6.8 +* Sat Oct 03 2026 <[email protected]> 6.6.9 - See the project NEWS file for recent changes. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/imap.c new/fetchmail-6.6.9/imap.c --- old/fetchmail-6.6.8/imap.c 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/imap.c 2026-10-03 13:30:10.000000000 +0200 @@ -399,7 +399,7 @@ gen_send(sock, "AUTHENTICATE NTLM"); result = ntlm_helper(sock, ctl, "IMAP", &dontread); - if (result && PS_AUTHFAIL != result && NTLM_BUFFER_TOO_SMALL != result) + if (result && PS_AUTHFAIL != result) return result; if (result) failed = true; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/meson.build new/fetchmail-6.6.9/meson.build --- old/fetchmail-6.6.8/meson.build 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/meson.build 2026-10-03 13:30:10.000000000 +0200 @@ -1,5 +1,5 @@ project('fetchmail', 'c', - version: '6.6.8', # align with fetchmail.man - and don't remove, configure.ac greps for this! + version: '6.6.9', # align with fetchmail.man - and don't remove, configure.ac greps for this! default_options : ['warning_level=2', 'c_std=gnu99'], meson_version : '>=1.3.0') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/ntlm.h new/fetchmail-6.6.9/ntlm.h --- old/fetchmail-6.6.8/ntlm.h 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/ntlm.h 2026-10-03 13:30:10.000000000 +0200 @@ -1,5 +1,6 @@ /* ntlm.h -- interface declarations for SMB authentication code */ +#include <stdio.h> // for FILE type below #include "smbtypes.h" /* @@ -71,6 +72,4 @@ extern int buildSmbNtlmAuthRequest(tSmbNtlmAuthRequest *request, char *user, char *domain); /**< returns 0 for success */ extern int buildSmbNtlmAuthResponse(tSmbNtlmAuthChallenge *challenge, tSmbNtlmAuthResponse *response, char *user, char *password); /**< returns 0 for success */ -#define NTLM_BUFFER_TOO_SMALL ((int)-2) // must not overlap PS_SUCCESS, PS_AUTHFAIL or any other PS_* - /* ntlm.h ends here */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/ntlmsubr.c new/fetchmail-6.6.9/ntlmsubr.c --- old/fetchmail-6.6.8/ntlmsubr.c 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/ntlmsubr.c 2026-10-03 13:30:10.000000000 +0200 @@ -11,7 +11,10 @@ int ntlm_helper(int sock, struct query *ctl, const char *proto, bool *dontread) { -/** returns 0 for success or if SASL authentication was cancelled with a * line +/** returns 0 for success, or PS_* values on error. + * + * Bug fixes by Matthias Andree. + * * NTLM support by Grant Edwards. * * Handle MS-Exchange NTLM authentication method. This is the same @@ -131,7 +134,7 @@ if (outlevel >= O_MONITOR) report(stdout, "%s> *\n", proto); (void)SockWrite(sock, "*\r\n", 3); - return NTLM_BUFFER_TOO_SMALL; + return result ? result : PS_AUTHFAIL; } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/pop3.c new/fetchmail-6.6.9/pop3.c --- old/fetchmail-6.6.8/pop3.c 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/pop3.c 2026-10-03 13:30:10.000000000 +0200 @@ -98,19 +98,20 @@ gen_send(sock, msn_instead ? "AUTH MSN" : "AUTH NTLM"); result = ntlm_helper(sock, ctl, "POP3", &dontread); - if (result && PS_AUTHFAIL != result && NTLM_BUFFER_TOO_SMALL != result) + if (result && PS_AUTHFAIL != result) return result; if (result) failed = true; - if (!dontread) { - if ((result = gen_recv (sock, msgbuf, sizeof msgbuf))) - return result; - } else { - if (result < 0) - result = PS_AUTHFAIL; + if (dontread) { + // ntlm_helper already consumed server replies + // so we don't read anything more. + return PS_AUTHFAIL; } + if ((result = gen_recv (sock, msgbuf, sizeof msgbuf))) + return result; + (void)strtok(msgbuf, " "); if (!failed && 0 == strcmp (msgbuf, "+OK")) return PS_SUCCESS; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/sink.c new/fetchmail-6.6.9/sink.c --- old/fetchmail-6.6.8/sink.c 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/sink.c 2026-10-03 13:30:10.000000000 +0200 @@ -1711,13 +1711,39 @@ buf[MSGBUFSIZE+2] = '\n'; buf[MSGBUFSIZE+3] = '\0'; - stuffline(ctl, rfc2047charset != NULL ? rfc2047e(buf, rfc2047charset) : buf); + // split buf at \n so we can have stuffline fill in CR as needed, + // use case is if a multi-line "fmt" or interpolation contains LF only + size_t bufsiz = 128; + char *outbuf = (char *)xmalloc(bufsiz); + size_t linelen = 0; + for (char *line = buf; *line; line += linelen) { + linelen = strcspn(line, "\n"); + int has_lf = ('\n' == line[linelen]); + size_t needlen = linelen + 3; // +3 for CRLF and null terminator + if (needlen > bufsiz) { + bufsiz = needlen; + outbuf = (char *)xrealloc(outbuf, bufsiz); + } + memcpy(outbuf, line, linelen); + outbuf[linelen] = '\0'; + size_t lineidx = linelen; + if (lineidx == 0 || outbuf[lineidx - 1] != '\r') { + outbuf[lineidx++] = '\r'; // Add CR if not present + } + outbuf[lineidx++] = '\n'; // Add LF + outbuf[lineidx] = '\0'; // Null terminate + stuffline(ctl, rfc2047charset != NULL ? rfc2047e(outbuf, rfc2047charset) : outbuf); + linelen += has_lf; + } + xfree(outbuf); } void close_warning_by_mail(struct query *ctl, struct msgblk *msg) /* sign and send mailed warnings */ { - stuff_warning(NULL, ctl, "-- \n", GT_("The Fetchmail Daemon")); + stuff_warning(NULL, ctl, "", "%s", ""); + stuff_warning(NULL, ctl, "", "-- "); + stuff_warning(NULL, ctl, "", GT_("The Fetchmail Daemon")); close_sink(ctl, msg, TRUE); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/fetchmail-6.6.8/util.c new/fetchmail-6.6.9/util.c --- old/fetchmail-6.6.8/util.c 2026-09-22 23:17:36.000000000 +0200 +++ new/fetchmail-6.6.9/util.c 2026-10-03 13:30:10.000000000 +0200 @@ -53,7 +53,7 @@ char **ary = (char **)xmalloc(sizeof(char *) * maxsplit); char *remainder = 0; size_t got = str_split(argv[i], argv[i+1], ary, maxsplit, &remainder); - printf("str_split(\"%s\", \"%s\", ARRAY, %zu) returned %zu, remainder \"%s\"\n", + printf("str_split(\"%s\", \"%s\", ARRAY, %lu) returned %zu, remainder \"%s\"\n", argv[i], argv[i+1], maxsplit, got, remainder ? remainder : "(NULL)"); for (size_t j = 0; j < got; j++) printf(" %3zu %s\n", j, ary[j]); xfree(ary);
