unable to process certain attachments

[Dominik L. Borkowski]

Hello,
Recently we've encountered a few e-mails which were 'stuck' in our queues for 
a few days, mailscanner was never able to process them fully. Below you'll 
find a description of one of those e-mails. We would appreciate any insight 
as to how we may be able to fix this problem.


Each message would have the innocent log error (from address hashed out):

May  2 12:49:03 almaren MailScanner[21605]: Message m41GREcK020606 from
         198.82.162.213 (XXXXX at XXXXXX.XXX) to vbi.vt.edu is too big for spam 
checks (4715006 > 2000000 bytes)

The issue was that it would never go through, and mailscanner would attempt to 
process it for days, every few minutes. When running Mailscanner with --debug 
option, we got this error:

Negative length at /opt/MailScanner/lib/MailScanner/Message.pm line 3168

Upon closer inspection, we found the message in our sendmail's mqueue.in:

s -la mqueue.in/
total 4608
drwxr-xr-x 2 root root       52 May  2 13:56 ./
drwxr-xr-x 5 root root       67 May  2 14:04 ../
-rw------- 1 root smmsp 4711318 May  1 12:27 dfm41GREcK020606
-rw------- 1 root smmsp    3688 May  1 12:27 qfm41GREcK020606

The message seems to contain only 8 attachments:

# grep filename dfm41GREcK020606
Content-disposition: attachment; filename=Figure1.jpg
Content-disposition: attachment; filename="Measkit Draft_latest.doc"
Content-disposition: attachment; filename=Table1.doc
Content-disposition: attachment; filename=Figure2.pdf
Content-disposition: attachment; filename=Figure3.pdf
Content-disposition: attachment; filename=Figure4.pdf
Content-disposition: attachment; filename=Figure5.pdf
Content-disposition: attachment; filename="Measkit Supplementary Material.doc"


While looking at the mailscanner's spool directory (thread responsible for 
processing this given message), we found a bit more:

# ls -la mailscanner/
total 3696
drwxr-xr-x 2 root root    4096 May  2 13:56 ./
drwxr-xr-x 5 root root      67 May  2 14:04 ../
-rw------- 1 root root     310 Jan  1  1980 .rel
-rw------- 1 root root     310 Jan  1  1980 .rels
-rw------- 1 root root     540 Jan  1  1980 .xml
-rw------- 1 root root     540 Jan  1  1980 1.xml
-rw------- 1 root root   34423 May  2 12:47 Figure1.jpg
-rw------- 1 root root  326283 May  2 12:47 Figure2.pdf
-rw------- 1 root root  273733 May  2 12:47 Figure3.pdf
-rw------- 1 root root  281037 May  2 12:47 Figure4.pdf
-rw------- 1 root root  259256 May  2 12:47 Figure5.pdf
-rw------- 1 root root  774144 May  2 12:47 Measkit\ Draft_latest.doc
-rw------- 1 root root 1026048 May  2 12:47 Measkit\ Supplementary\ 
Material.doc
-rw------- 1 root root   27108 May  2 12:47 Ole10Native
-rw------- 1 root root   52548 May  2 12:47 Ole10Native1
-rw------- 1 root root   12708 May  2 12:47 Ole10Native2
-rw------- 1 root root   57028 May  2 12:47 Ole10Native3
-rw------- 1 root root   53828 May  2 12:47 Ole10Native4
-rw------- 1 root root    3044 May  2 12:47 Ole10Native5
-rw------- 1 root root   11556 May  2 12:47 Ole10Native6
-rw------- 1 root root  507392 May  2 12:47 Table1.doc
-rw------- 1 root root    2023 May  2 12:47 msg-22314-1.txt
-rw------- 1 root root    2870 May  2 12:47 msg-22314-2.html
-rw------- 1 root root    6992 Jan  1  1980 theme1.xml
-rw------- 1 root root    6992 Jan  1  1980 theme11.xml
-rw------- 1 root root     283 Jan  1  1980 themeManager.x.rel
-rw------- 1 root root     138 Jan  1  1980 themeManager.xml
-rw------- 1 root root     283 Jan  1  1980 themeManager.xml.rels
-rw------- 1 root root     138 Jan  1  1980 themeManager1.xml
-rw------- 1 root root       0 May  2 12:47 \336i

I guess we have few questions:

1) How come there are so many additional files in the mailscanner's spool dir
2) What can we do to replicate the expansion of all the attachments
3) What causes mailscanner to break in Message.pm


Our setup includes:
- MailScanner 4.69.8
- Sendmail 8.13.7
- tnef 1.4.3
- perl 5.8.5 (modules up to date)

Any hints/suggestions would be greatly appreciated.
-- 
Dominik L. Borkowski - Senior Systems Administrator
Virginia Bioinformatics Institute - www.vbi.vt.edu