dying children?

Thu Jul 31 10:11:54 IST 2008

Jon Dustin wrote:
>>>> On 7/29/2008 at 5:07 PM, in message <488F867C.1000102 at fsl.com>, Steve Freegard
>>>>         
> <steve.freegard at fsl.com> wrote:
>   
>> That would seem to indicate a problem with a Perl module that uses XS 
>> (e.g. C functions into Perl) and not with MailScanner itself.
>>
>> You would have to install 'strace' and run the message through again 
>> like so:
>>
>> strace MailScanner --debug --debug-sa
>>
>> And then look at around the last 25-50 lines or so for clues.
>>
>> I've seen this happen before; mainly with Mail::ClamAV (which is why I 
>> prefer clamd now); but I've seen it happen with other modules too.
>>     
>
> As I imagined, there is a BUNCH of output from strace. I will try to find the relevant sections at the bottom of the output:
>
> (from MailScanner output)
> 22:43:39 [16217] dbg: check: tests=MISSING_DATE,MISSING_HEADERS,MISSING_SUBJECT,NO_RECEIVED,NO_RELAYS
> 22:43:39 [16217] dbg: check: subtests=__HAS_MSGID,__MISSING_REF,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__MSOE_MID_WRONG_CASE,__NONEMPTY_BODY,__SANE_MSGID,__SARE_WHITELIST_FLAG,__TVD_BODY,__UNUSABLE_MSGID
> 22:43:39 [16217] dbg: bayes: untie-ing
> 22:43:39 Building a message batch to scan...
> 22:43:39 Have a batch of 1 message.
> max message size is '100k'
>
> (from strace)
> 16217 open("/usr/lib/perl5/5.8.8/Text/ParseWords.pm", O_RDONLY|O_LARGEFILE) = 11
> <snip>
> 16217 open("/usr/lib/perl5/5.8.8/i586-linux-thread-multi/auto/PerlIO/scalar/scalar.so", O_RDONLY) = 11
> <snip>
> read(12, "<html><!--**********************"..., 4096) = 4096
> read(12, "T size=2><FONT size=2><FONT size"..., 4096) = 4096
> write(11, "<html><!--**********************"..., 4096) = 4096
> read(12, " size=2><FONT size=2><FONT size="..., 4096) = 4096
> write(11, "T size=2><FONT size=2><FONT size"..., 4096) = 4096
> read(12, "size=2><FONT size=2><FONT size=2"..., 4096) = 4096
> write(11, " size=2><FONT size=2><FONT size="..., 4096) = 4096
> read(12, "ize=2><FONT size=2><FONT size=2>"..., 4096) = 4096
> write(11, "size=2><FONT size=2><FONT size=2"..., 4096) = 4096
> read(12, "=2><FONT size=2><FONT size=2><FO"..., 4096) = 4096
> read(12, "2><FONT size=2><FONT size=2><FON"..., 4096) = 4096
> read(12, "><FONT size=2><FONT size=2><FONT"..., 4096) = 4096
> read(12, "/FONT></FONT></FONT></FONT></FON"..., 4096) = 4096
> read(12, "FONT></FONT></FONT></FONT></FONT"..., 4096) = 4096
> brk(0xb93f000)                          = 0xb93f000
> --- SIGSEGV (Segmentation fault) @ 0 (0) ---
> +++ killed by SIGSEGV +++
> Process 16009 detached
>
> The original mailfile had *many* of the "<FONT size=2>" in a row. Not sure if that is causing issues.
>
> Any other testing? Or if anyone would like a copy of this mailfile, I'm happy to send it along.
>   
Someone else showed me a message that suffered the same problem a few 
weeks ago. Unfortunately I don't think there's anything I can do about 
it, sorry. It's to do with nesting in the HTML analysis code. Once it 
gets too nested up, Perl segfaults.

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.