https://gitlab.synchro.net/main/sbbs/-/commit/92ae6263408f0ddd5d05d802
Modified Files:
src/sbbs3/mailsrvr.cpp
Log Message:
mailsrvr: bound sockmimetext line scan with strnlen (CID 639931)

The inner while-loop walks (*np + len) up to RFC822_MAX_LINE_LEN bytes
relying on the embedded NUL test to stop early. When np points at the
"\r\n" literal used as the empty-body fallback (issue #822), Coverity
loses track of the literal's length and reports a 997-byte OVERRUN.
Compute the scan length up-front with strnlen so the bound is explicit; behavior is unchanged but the OVERRUN false-positive is silenced.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/52099548d7f5782b818bdbe7
Modified Files:
src/sbbs3/mailsrvr.cpp
Log Message:
mailsrvr: POP3 reply -ERR (not !UNSUPPORTED) to USER/PASS in TRANSACTION state

Some clients (e.g. Thunderbird) reuse an already-authenticated TCP socket
and re-issue USER/PASS. Per RFC 1939 these are AUTHORIZATION-state-only commands, so respond with a plain -ERR and keep the session alive,
matching Dovecot/Courier behavior and suppressing the misleading
"!UNSUPPORTED COMMAND" log notice.

Refs main/sbbs#1123

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/7e492e0eeb8e9cd553fb6a2f
Modified Files:
src/sbbs3/mailsrvr.cpp
Log Message:
mail: only auto-detect an IPv4 DNS server address

dns_getmx() takes the server as a DWORD, so an IPv6 address cannot reach
it: resolve_ip() returns INADDR_NONE, the send is abandoned with the
message left for a later attempt, and "INVALID DNS server address" is
logged. get_dns_server() picked at random from every address getNameServerList() reported, so a host with resolvers of both families
failed on some sends and not others -- and on Windows the list can now
include IPv6 servers where it never could before.

Filter to the addresses the look-up can use, and say so when a detected
list holds none of them, rather than leaving the caller to report an empty address as invalid.

The precision on the adjacent sprintf() was one greater than the room the buffer has for text.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/b19bdde0674b55673b4d1005
Modified Files:
src/sbbs3/mailsrvr.cpp
Log Message:
mailsrvr: log the offending command on invalid POP3 message numbers

The POP3 LIST/UIDL, RETR/TOP, and DELE handlers logged only the parsed
message number when rejecting an out-of-range argument. When the argument
is missing or non-numeric, strtoul() yields 0, so the log always reads
"INVALID message #0" with no indication of what the client actually sent
-- exactly the case where the command text is needed to diagnose it.

Log the command line and the mailbox message count, matching the detail
already present in the successful-retrieval log message.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/e0b7043e35c210a67ec71999
Modified Files:
src/sbbs3/mailsrvr.cpp
Log Message:
mailsrvr: don't mistake a quoted address local-part for a display name

A QWKnet reply sent via SMTP failed to import at the destination BBS:

QWK NetMail from VERT to EOTLBBS!nelgin
!QWK NetMail from VERT to UNKNOWN USER: EOTLBBS!nelgin

smtp_netmailaddr() renders a QWKnet sender as qwkid!user@host, so a
reply is addressed to e.g. <EOTLBBS!nelgin@vert.synchro.net> -- and a
mail client may quote the local part, which RFC 5322 allows:

To: nelgin <"EOTLBBS!nelgin"@vert.synchro.net>

parse_mail_address() took the first quote anywhere in the string as the
start of a display name, so it returned "EOTLBBS!nelgin" as the name.
The SMTP envelope had been parsed correctly (recipient "nelgin", routed
to QWKnet node EOTLBBS), but the To: header re-parse overwrites the same buffer, and that name is what gets stored as the message recipient. The
QWK packer writes it verbatim, and the receiving system finds no such
user.

Treat a quote as a display-name delimiter only where a display name can
appear -- before the '<' of the address -- and, for a QWKnet recipient,
take the name from the envelope rather than the To: header, as the
FidoNet case already does. The header parse also feeds the sender name
of unauthenticated mail, so an odd From: address was mangled the same
way.

The quoted/parenthesized display-name handling dates to cbcda654b4 (2002-08-22).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net