Postfix heap memory over-read while formatting a malformed multiline Milter reply. milter8_event() indexed bytes 0 through 4 of the reply buffer with no length check and did not validate each line of a multiline reply, so a malicious Milter or an attacker-in-the-middle on the Milter connection could trigger a null-terminated heap over-read in the SMTP daemon. Fixed by the new milter8_valid_smtp_reply() validator in src/milter/milter8.c and by line-length guards in src/smtpd/smtpd_chat.c.