CHANGES: document ARC/ARC-Seal crash fixes (trusteddomainproject#296)

Author: thegushi

CHANGES-develop.md

@@ -118,6 +118,7 @@ CREATE TABLE IF NOT EXISTS suppressions (
 - **ADMD-less `Authentication-Results` headers**: Some MTAs (notably Office 365) generate AR headers that omit the authserv-id entirely. The parser now recovers gracefully rather than discarding the result. (#329, issue #73)
 - **AR header with no-result rejected as invalid**: RFC 8601 §2.2 permits `Authentication-Results: example.com; none` as a valid header indicating no methods were evaluated. The parser treated this as a syntax error. (#267)
 - **ARC-Authentication-Results parser rewritten using shared state machine**: The bespoke `strsep`-based AAR parser was replaced with the unified `authres_parse()` function that handles both AR and AAR headers. The old parser was fragile against whitespace and quoting variations and could not correctly extract client-IP from `remote-ip` properties. `struct arcares` now carries a `struct authres payload` rather than individual string fields. `MAXARESULTS` doubled to 32. (#355, issue #305)
+- **Multiple ARC/ARC-Seal parser crashes**: Fixed SIGSEGV (large RSA signatures exceeding the 512-byte token limit), SIGABRT (malformed tokens with no `=` sign hitting `assert()` in `strip_whitespace`), memory leaks, and NULL pointer dereferences in ARC header parsing. Also fixed a memory leak where `as_hdr_new` was allocated but not freed on the invalid-header path. Unknown auth methods in AAR headers (e.g. `dara=` from Gmail) are now skipped rather than rejecting the entire header. CRLF line folding in AAR headers is now handled correctly. Adds `test_arcares` unit tests covering all these cases. (#296, issues #183, #186, #222, #236, #238, #241, #242)
 
 **Open question**: The `dmarc=` and `spf=` results are currently emitted as separate `Authentication-Results` headers, which is what most downstream consumers (Rspamd, SpamAssassin, etc.) expect. RFC 8601 permits combining them into a single header, and a future `CombinedAuthservHeader` option could allow operators to opt in once they have verified their downstream software handles it. Worth coordinating with those projects before implementing.