Re: "sophie -f 42.zip" vs "scan_file /var/run/sophie 42.zip"

Hi,
 I too had this problem. sophie will hang on 42.zip if
 sophie -f 42.zip,
 sophie -d <directory containing 42.zip>
 send name of a directory containing 42.zip through the socket to sophie.
 I guess the problem is that sophie is not registering the call back 
functions provided by SAVI library before scanning, in these cases.
 savi library will call the callback functions provided by sophie before 
unzipping each file in the archive, so that sophie can enforce these 
limits, i think.
Thanks,
Jerrin
Juergen Georgi wrote:

>Hi,
>
>I realized, that sophie (3.0.4rc2, Sophos 3.78, Solaris) cannot 
>cope with compression bombs like 42.zip when invoked with 
>"-f <42.zip>". It runs at high CPU load until "timeout" is 
>reached , filling up /tmp with large files. The same applies 
>to my MIMEdefang/sophie installation, where sophie does not 
>finish cleanly on 42.zip, thus causing a temporary SMTP error. 
>
>However, sophie has no problems when scanning the 42.zip file via
>socket connection. When fed by sock.pl or scan_file, it correctly 
>stops with "loop_decompr_limit reached".
>
>My savi settings for ZIP handling are
>
>| GrpArchiveUnpack                  |    9 |   2 |
>| ZipDecompression                  |    3 |   1 |
>| ZipUseChd                         |    3 |   1 |
>
>
>What needs to be done such that MIMEdefang/sophie and "sophie -f"
>no longer fail on 42.zip?
>
>Regards,
>
>-Juergen
>_______________________________________________
>vtools mailing list
>[email protected]
>http://www.vanja.com/list/listinfo.cgi/vtools
>
>  
>