hMailServer 6.2.14: IMAP APPEND reported success for mail it never wrote
-
A message file that could not be written was treated as success. IMAP APPEND answered
OK [APPENDUID ...]for messages that were never stored, so Sent Items copies, drafts and migration uploads were lost while the client showed them saved. Anyone hitting a full volume, or a file locked by antivirus or backup, lost mail silently. A failed message copy killed the delivery task in local delivery, forwarding, Sieve redirect and mirroring, leaving the message locked in the queue to fail again on every restart.Both came from an adversarial audit that found and fixed 21 defects. No database change: schema version 6005, unchanged. The regression suite passed 1026 of 1026.
Mail loss and stability
- Every string SQL parameter on MS SQL and SQL CE was bound from freed memory.
- A failed transaction start leaked its pooled connection, and after a few occurrences SMTP, IMAP and POP3 blocked until a service restart.
- A failed IMAP folder insert was reported as success, so messages filed into it were written to disk with nothing to find them by.
Security
- DKIM test mode (
t=y) turned a failed signature into a pass, which then satisfied DMARC alignment. A failure in test mode is now neutral, per RFC 6376. - IMAP SASL credentials were logged verbatim: AUTHENTICATE PLAIN passwords and XOAUTH2/OAUTHBEARER tokens.
- Only the first DKIM key record at a selector was read, so roughly half of a rotating sender's mail failed verification.
- MTA-STS enforcement and MX failover were lost for recipients past the first batch.
Protocol and Control Panel
- SELECT/EXAMINE report a sequence number in
[UNSEEN], as RFC 3501 requires, not a UID. - Reverse-DNS lookups for the Received header moved to their own thread pool, completing the 6.2.13 fix.
- Backup would not start (#19): a Control Panel call to a method the backup interface does not have.
- Ctrl+K now searches settings, all 227 indexed by label and INI key. Logging, scanner timeout, indexing and retry settings moved to the pages that own them, which is where #16 went.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login