bug when invoking $message->Explode()

[Mariano Absatz]

Hi Julian,

During the weekend I noticed that there was a message that was stuck in the
MailScanner queue.

Since, thankfully, I'm running MailScanner in the foreground monitored with
supervise and its stdout+stderr being logged with multilog, I found the
culprit... looking the stderr I noticed this:

2004-06-26 21:49:32.104330500 format error: bad signature: 0x9463bcca at
offset 80337800 in file /var/spool/MailScanner/incoming/MailScanner-
MX/6461/458806/Nero 6.zip
2004-06-26 21:49:32.104334500  at
/app/MailScanner/lib/MailScanner/MessageBatch.pm line 417
2004-06-26 21:49:49.005558500 format error: bad signature: 0x9463bcca at
offset 80337800 in file /var/spool/MailScanner/incoming/MailScanner-
MX/6461/458806/Nero 6.zip
2004-06-26 21:49:49.005561500  at
/app/MailScanner/lib/MailScanner/MessageBatch.pm line 417

ad nauseam...

The 'cleaned up' message is:
format error: bad signature: 0x9463bcca at offset 80337800 in file
/var/spool/MailScanner/incoming/MailScanner-MX/6461/458806/Nero 6.zip
  at /app/MailScanner/lib/MailScanner/MessageBatch.pm line 417

The line 417 in MessageBatch.pm is
    $message->Explode();
(within MessageBatch's own Explode() function).


After some digging, the corresponding syslog entries are:

Jun 26 02:47:23 avas-mx08 MailScanner-MX[6461]: Virus and Content Scanning:
Starting
Jun 26 02:48:34 avas-mx08 MailScanner-MX[6461]: New Batch: Found 5 messages
waiting
Jun 26 02:48:34 avas-mx08 MailScanner-MX[6461]: New Batch: Scanning 1
messages, 212991965 bytes

This 212991965 bytes message is the one... but I got no other entry in syslog
for MS child 6461 until I killed MailScanner (almost 20 hours later):

Jun 26 21:53:57 avas-mx08 MailScanner-MX[6461]: MailScanner child caught a
SIGHUP
Jun 26 21:53:57 avas-mx08 MailScanner-MX[6461]: Config: calling custom end
function SplitMailForAntivirus
Jun 26 21:53:57 avas-mx08 MailScanner-MX[6461]: Config: calling custom end
function AlerceLogging
Jun 26 21:53:57 avas-mx08 MailScanner-MX[6461]: Ending Alerce Logging file:
/logs/mail/mx/alerce
Jun 26 21:53:57 avas-mx08 MailScanner-MX[6461]: Config: calling custom end
function MustPassThroughAntivirus
Jun 26 21:53:57 avas-mx08 MailScanner-MX[6461]: Config: calling custom end
function ChooseZMOutQueueDir


Regretfully, I don't have the offending message at hand (it was a 200Mb+
message... actually, a bounce, that seemed to have the complete Nero 6
package (can you believe it... people out there sending copyrighted software
via e-mail?... nah, it must have been someone licensed sending it to
himself).

The 'format error: bad signature' seems to be an 'Archive::Zip' (I'm using
the current 1.10 version of Archive::Zip)... maybe it is compressed in some
way that Archive::Zip doesn't understand?

The point is that this seems to be totally uncatched within MailScanner...
that is, if Archive::Zip can't handle it, we should be doing something... I
don't know why, but MailScanner seems to be trying to do the same thing over
and over with the same message... maybe this is invoked within a child's
child and being respawned or something...



I'm using MailScanner 4.29.7 with fedora core 1.

Any hints?


--
Mariano Absatz
El Baby
----------------------------------------------------------
Justify my text? I'm sorry but it has no excuse.

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html