vmime/src, branch master

fix(parsing): limit MIME nesting depth

2026-09-12T21:46:25Z

- bound recursive multipart parsing to prevent stack exhaustion - preserve part bounds without descending past the configured limit - apply the limit to malformed-message recovery paths - expose configurable depth limits through parsingContext - preserve the limit when copying parsing contexts

fix(imap): prevent Windows TEXT macro collision

2026-09-12T20:50:52Z

- undefine the Windows TEXT macro before declaring the IMAP SEARCH key - avoid macro expansion errors when including winsock2.h on Windows

fix(tls): enforce minimum TLS 1.2 protocol version

2026-09-12T18:21:19Z

- prevent negotiation of deprecated SSLv3 and TLS 1.0/1.1 - use the minimum protocol API on newer OpenSSL versions - provide legacy OpenSSL fallback through protocol disable options

feat(smtp): add AUTH LOGIN support

2026-09-12T18:21:12Z

- support servers that offer LOGIN without other mechanisms - encode username and password as base64 prompt responses - restrict LOGIN authentication to secured connections - mark the connection authenticated after a successful exchange

fix: must init raw pointer *bodyPart

2024-12-01T18:26:23Z

feat: remember boundary from parsing

2024-11-28T11:00:39Z

Fix a test failure in pathTest::testGenerate (#312)

2024-06-11T18:49:10Z

* Fix a test failure in testNewFromString Fixes an oversight in d296c2d1. * Fix a test failure in pathTest::testGenerate Partially revert v0.9.2-183-g9b65b4de. As per RFC 5322 §3.4.1, an email address must always have a @. As per RFC 5321 §4.1.2, a path is similar to an email address (always @), with "" (<>) being the only other special value. Fixes #294, #301.

contrib: update utfcpp to v4.0.5 (#309)

2024-06-11T18:45:51Z

Download a new version from https://github.com/nemtrif/utfcpp/ which explicitly supports C++17.

build: resolve a -Wunused-function compiler warning (#308)

2024-06-11T18:44:18Z

posixSocket.cpp:67:7: warning: ‘char* {anonymous}::vmime_strerror_r_result(int, char*)’ defined but not used [-Wunused-function] 67 | char* vmime_strerror_r_result(int /* res */, char* buf) { It is to be expected that one of the two r_result functions is going unused, depending on whichever platform we are currently building on.

asciiPercent computation: another potential multiplication overflow (#307)

2024-05-21T18:48:08Z

* build: resolve a -Wconversion compiler warning wordEncoder.cpp:312:91: warning: conversion from ‘std::__cxx11::basic_string::size_type’ {aka ‘long unsigned int’} to ‘double’ may change value [-Wconversion] 312 | buffer.length() == 0 ? 1 : static_cast(asciiCount) / buffer.length(); | ~~~~~~~~~~~~~^~ * wordEncoder: replace value 100 for asciiPercent asciiPercent is a ratio, and not counting in units of hundredths anymore. The maximum value therefore should be 1 not 100. * vmime: avoid integer multiply wraparound in text::createFromString The change from commit v0.9.2-194-gb447adbe needs to be applied to one more function that replicates the same code. (If the input string is 42949673 characters long or larger, there will be integer overflow on 32-bit platforms when multiplying by 100. Switch that one computation to floating point.)