Re: "sophie -f 42.zip" vs "scan_file /var/run/sophie 42.zip"

Hi Juergen, 

no sulotion just the same problem with amavisd-new:

when sending 42.zip through amavisd-new I must wait for the timeout
(timeout: 60). amavis tries this 3 times.
but when scanning with scan_file processing stops after ca. 10s with
loop_decompr_limit reached. many month ago I asked this on the
amavis-user-ml, but no one answerd.

Sascha.


> I realized, that sophie (3.0.4rc2, Sophos 3.78, Solaris) cannot
> cope with compression bombs like 42.zip when invoked with
> "-f <42.zip>". It runs at high CPU load until "timeout" is
> reached , filling up /tmp with large files. The same applies
> to my MIMEdefang/sophie installation, where sophie does not
> finish cleanly on 42.zip, thus causing a temporary SMTP error.
> 
> However, sophie has no problems when scanning the 42.zip file via
> socket connection. When fed by sock.pl or scan_file, it correctly
> stops with "loop_decompr_limit reached".
> 
> My savi settings for ZIP handling are
> 
> | GrpArchiveUnpack                  |    9 |   2 |
> | ZipDecompression                  |    3 |   1 |
> | ZipUseChd                         |    3 |   1 |
> 
> What needs to be done such that MIMEdefang/sophie and "sophie -f"
> no longer fail on 42.zip?
> 
> Regards,
> 
> -Juergen