TNEF problem

[Patterson, S R]

Hi,

I've identified the TNEF problem, it seems to be some very oddly
behaved winmail.dat file.  From the number we're getting I'd be
surprised if it's some deliberate "attack", perhaps it's more a mail
client somewhere which incorrectly creates the tnef format.  The
problem lies not with the "len: 0" property but with the following
property.  This claims to be a MAPI binary type with 750 000 000+
entries, presumably each of at least "len: 1".  TNEF goes through the
headers and MALLOCs memory sufficient to store the entire expanded
TNEF based upon the values reported in the TNEF header (the
properties).  Naturally this causes a problem!

Right now I've kludged in a solution which makes tnef abort if any
expansion would require more than 20 megabytes of memory (since we
limit the maximum size of our email messages to 20 megabytes we can be
sure than no genuine TNEF should ever extract to more than this).
That circumvents the immediate problem on our site.

Ideally the solution is for someone (me?  The author of tnef?) to size
up the memory requirements but not malloc() them until it's actually
reading in each individual chunk of the archive and to free them as
soon as the output goes onto disk, rather than malloc()ing everything
at the start.  That's a pretty hefty rewrite, though, and I don't know
off the top of my head whether or not the TNEF structure makes it
impossible to work that way.  I'm certainly not planning to fix it
myself in the near future!

If anybody experiences problems with odd winmail.dat files causing
TNEF to eat up processor and memory out of all proportion to the real
file sizes and requires the kludge, I'll happily pass it on.

Steve
--
Steven Patterson, MSci ----------------------------------------------+
|       Electronic Information Systems Support and Development       |
|         Computing Services, University of Southampton, UK.         |
+-------------------------------------------- Tel: +44 (0) 2380 595810
......                                                          ......
..       Conviction is a bigger enemy of the truth than lies.       ..
......                                                          ......

-------------- next part --------------
A non-text attachment was scrubbed...
Name: Steven Patterson (E-mail).vcf
Type: application/octet-stream
Size: 867 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20010910/730332dd/StevenPattersonE-mail.obj