Sealwax 1.0.6

A security update. Please update.

• A mail server can't fill Sealwax's memory with an answer that never ends: when Sealwax asked an incoming mail server something, it read the answer until the server said it was done, however long that took, and kept what it was told. A server could keep answering one question until memory ran short. Sealwax now stops far above any honest answer, at two million responses or 256 MiB (1 GiB when downloading messages), drops the connection and connects again a little later (GHSA-f9g6-hwxr-7v96).
• A mail server can't make Sealwax set aside memory for data it never sends: a server says how long a message is before sending it, and Sealwax set aside that much memory at once, up to 512 MiB, on the server's word alone. On port 143, anyone on the network could also say it in the server's place before the connection is encrypted. Now Sealwax takes memory as the message arrives (GHSA-f9g6-hwxr-7v96).
• POP3 accounts hold the server to its word: a message may now be at most about twice the size the server gave for it, and the list of messages at most 128 MiB, and it must keep coming. A server that sends a line now and then can't keep Sealwax waiting any more; Sealwax gives up and tries again later.

---

Install, update or uninstall: see INSTALL.md, in plain words.