postfix: upgrade 3.10.8 -> 3.10.9

Security fix: CVE-2026-43964

Add a patch to fix build with musl.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

2 files changed, 52 insertions, 1 deletions

diff --git a/meta-networking/recipes-daemons/postfix/files/0001-Fix-build-with-musl.patch b/meta-networking/recipes-daemons/postfix/files/0001-Fix-build-with-musl.patch
new file mode 100644
index 0000000000..d09418eaac
--- /dev/null
+++ b/meta-networking/recipes-daemons/postfix/files/0001-Fix-build-with-musl.patch
@@ -0,0 +1,50 @@
+From cbe5ba0deeba6329eed63eade06bb8c062d0d445 Mon Sep 17 00:00:00 2001
+From: Yi Zhao <yi.zhao@windriver.com>
+Date: Fri, 8 May 2026 22:39:54 +0800
+Subject: [PATCH] Fix build with musl
+
+Guard glibc-specific version check with __GLIBC__ macro. When building
+with musl, __GLIBC__ is not defined, so the preprocessor previously fell
+through to the #else branch and defined NO_SNPRINTF, causing a build
+error:
+
+vbuf_print.c: In function 'vbuf_print':
+vbuf_print.c:208:46: error: macro 'VBUF_SNPRINTF' passed 5 arguments, but takes just 4
+  208 |                     VSTRING_ADDNUM(fmt, width);
+      |                                              ^
+vbuf_print.c:126:9: note: macro 'VBUF_SNPRINTF' defined here
+  126 | #define VBUF_SNPRINTF(bp, sz, fmt, arg) do { \
+      |         ^~~~~~~~~~~~~
+
+Wrap the entire block in #ifdef __GLIBC__ so that neither branch
+is entered on musl.
+
+Upstream-Status: Pending
+
+Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
+---
+ src/util/sys_defs.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/util/sys_defs.h b/src/util/sys_defs.h
+index 74319f2..6d3c7d2 100644
+--- a/src/util/sys_defs.h
++++ b/src/util/sys_defs.h
+@@ -794,12 +794,14 @@ extern int initgroups(const char *, int);
+ #define NATIVE_NEWALIAS_PATH "/usr/bin/newaliases"
+ #define NATIVE_COMMAND_DIR "/usr/sbin"
+ #define NATIVE_DAEMON_DIR "/usr/libexec/postfix"
++#ifdef __GLIBC__
+ #if HAVE_GLIBC_API_VERSION_SUPPORT(2, 1)
+ #define SOCKADDR_SIZE  socklen_t
+ #define SOCKOPT_SIZE   socklen_t
+ #else
+ #define NO_SNPRINTF
+ #endif
++#endif
+ #ifndef NO_IPV6
+ #define HAS_IPV6
+ #if HAVE_GLIBC_API_VERSION_SUPPORT(2, 4)
+-- 
+2.34.1
+
diff --git a/meta-networking/recipes-daemons/postfix/postfix_3.10.8.bb b/meta-networking/recipes-daemons/postfix/postfix_3.10.9.bb
index 6b82c04fbe..633e4a7a0d 100644
--- a/meta-networking/recipes-daemons/postfix/postfix_3.10.8.bb
+++ b/meta-networking/recipes-daemons/postfix/postfix_3.10.9.bb
@@ -27,9 +27,10 @@ SRC_URI = "http://ftp.porcupine.org/mirrors/postfix-release/official/postfix-${P
            file://0004-Fix-icu-config.patch \
            file://0005-makedefs-add-lnsl-and-lresolv-to-SYSLIBS-by-default.patch \
            file://0001-makedefs-Account-for-linux-7.x-version.patch \
+           file://0001-Fix-build-with-musl.patch \
            "
 
-SRC_URI[sha256sum] = "31d4b3eb8093d823b5a151f571719ff7c0462571bc95e6440d87ca525bfb096c"
+SRC_URI[sha256sum] = "d4b4daab0af2e0c16c0d2d5ac3c7680d5ebd2001ea054f7f2a601c759801bc13"
 
 UPSTREAM_CHECK_URI = "https://www.postfix.org/announcements.html"
 UPSTREAM_CHECK_REGEX = "postfix-(?P<pver>\d+(\.\d+)+)"