unable to process certain attachments

[Julian Field]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



Dominik L. Borkowski wrote:
> Hello,
> Recently we've encountered a few e-mails which were 'stuck' in our queues for 
> a few days, mailscanner was never able to process them fully. Below you'll 
> find a description of one of those e-mails. We would appreciate any insight 
> as to how we may be able to fix this problem.
>
>
> Each message would have the innocent log error (from address hashed out):
>
> May  2 12:49:03 almaren MailScanner[21605]: Message m41GREcK020606 from
>          198.82.162.213 (XXXXX at XXXXXX.XXX) to vbi.vt.edu is too big for spam 
> checks (4715006 > 2000000 bytes)
>
> The issue was that it would never go through, and mailscanner would attempt to 
> process it for days, every few minutes. When running Mailscanner with --debug 
> option, we got this error:
>
> Negative length at /opt/MailScanner/lib/MailScanner/Message.pm line 3168
>   
Download the very latest version of 4.69.9-3 and you will find this 
problem has gone away.

> I guess we have few questions:
>
> 1) How come there are so many additional files in the mailscanner's spool dir
>   
A docx file is actually a zip file containing all the bits that make up 
the document, so MailScanner has unpacked it like any other zip file. 
All the OleNative files are the embedded files extracted from the OLE 
document structure which can be used in there.
> 2) What can we do to replicate the expansion of all the attachments
>   
You can't, there aren't any command-line utilities that do all the work 
of MailScanner in this extraction. You can see a lot of it with "unzip 
- -v blahblah.docx".
> 3) What causes mailscanner to break in Message.pm
>   
A bug which I have already fixed.
>
> Our setup includes:
> - MailScanner 4.69.8
> - Sendmail 8.13.7
> - tnef 1.4.3
> - perl 5.8.5 (modules up to date)
>
> Any hints/suggestions would be greatly appreciated.
>   

Jules

- -- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.8.2 (Build 3005)
Comment: Use Enigmail to decrypt or check this message is legitimate
Charset: ISO-8859-1

wj8DBQFIIH2FEfZZRxQVtlQRAqn5AJ9t0D6VOAZ4StC7jMRdAJa9I1DGMwCgjKN2
pe4RcDFmVc7RO/OmFTBO0Z8=
=mEG7
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.