Re: sophie: sig_exit() callable by child, causes weird hangs

Chris Stromsoe <[email protected]> Wed, 11 Aug 2004 10:59:10 -0700 (PDT)
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
On Wed, 11 Aug 2004, Vanja Hrustic wrote:

> On Tue, 10 Aug 2004 12:07:44 -0700 (PDT) Chris Stromsoe 
> <[email protected]> wrote:
>
>>> As to why it was SEGV'ing in the first place, though....
>>
>> Yup.  I had a few groups of segfaults yesterday, prompting the bughunt. 
>> Usually they're far more sporadic.  I'm waiting to see if they start up 
>> again so I can try to figure out what's causing them.
>
> Which engine version are you using? 2.20 is out, and new SAVI SDK is out 
> as well, and I didn't have time yet to look at it.

I'm using the current engine (2.20).  The segfaults were happening with 
the 3.83 libsavi release; I'm not sure which version of the engine it has. 
They've happened in the past sporadically with other versions.

I'm pretty certain that the most recent round of segfaults happened after 
updating IDEs with libsavi 3.83 for either agobotlt, mydoom-r, or 
padodorl.  Since updating to libsavi 3.84 I haven't seen any segfaults.

I process ~2 million emails a day on a cluster of 9 machines.  On the 9th 
I had somewhere in the neighborhood of 15 segfaults during a 12 hour 
period.  Then I patched sophie and updated libsavi.  I haven't seen any 
since then and hadn't seen any for at least a week or two before-hand. 
It's possible that the segfaults were specific to the new IDE files and 
libsavi 3.83, or that they occur during normal operation and were bunched 
together for some other reason.


-Chris

> As a sidenote - is there anyone familiar enough with CVS/SourceForge, who
> would be able to setup project there, so that more people could contribute
> directly (and Sophie wouldn't depend on me anymore)?
>
> Thanks.
>
> Vanja
>