exim4-34 with exiscan crashes on mime messages
Daniel Tiefnig <[email protected]> Fri, 03 Dec 2004 18:27:21 +0100
| Newsgroups | gmane.mail.exim.exiscan.user |
|---|---|
| Message-ID | <[email protected]> |
Hej,
I'm using debian testing with exim 4.34 and exiscan patch version 21 on
some of my boxes here to scan and relay incoming mails, and its crashing
on some MIME mails, when I'm using smtp_acl_mime. The result is, that
messages get stored in queue, but the sending host does never get the
"250 OK" response. Mails are delivered multiple times due to that.
The problem is not easily reproduceable, as it does not crash on all
MIME messages, and it does not crash on the same message, if I change my
mime ACL a little bit, and it does not crash when I'm running exim in
debug mode...
Anyhow, my smtp_mime_acl is attached in mime_acl.txt, and i can crash it
with the following message: (pasted after the "data" command)
-----------------------------------------------------------------
X-foo: test
Content-Type: multipart/mixed;
boundary="----=_NextPart_ST_21_48_22_Wednesday_December"
X-bar: foo
------=_NextPart_ST_21_48_22_Wednesday_December
Content-Type: text/plain;charset="utf-8"
Content-Transfer-Encoding: quoted-printable
blah
------=_NextPart_ST_21_48_22_Wednesday_December
-----------------------------------------------------------------
It does _not_ crash if I omit the X-foo or X-bar header, it does _not_
crash if I change the boundaries to not match the header value.
An strace is attached as strace.txt, it shows that queue files are set
up correctly, and after that (and before sending the OK response) it fails.
With gdb I got the following backtrace (*not* the same segvault as the
strace):
| Program received signal SIGSEGV, Segmentation fault.
| [Switching to Thread 16384 (LWP 24078)]
| 0x403c51ca in mallopt () from /lib/libc.so.6
| (gdb) bt
| #0 0x403c51ca in mallopt () from /lib/libc.so.6
| #1 0x403c3faf in free () from /lib/libc.so.6
| #2 0x080aa68c in store_reset_3 ()
| #3 0x0805c2a9 in crypt16 ()
| #4 0x0805d860 in daemon_go ()
| #5 0x0806e0bc in main ()
# exim -bV
Exim version 4.34 #1 built 20-Nov-2004 11:32:14
Copyright (c) University of Cambridge 2004
Berkeley DB: Sleepycat Software: Berkeley DB 3.2.9: (May 26, 2004)
Support for: iconv() IPv6 PAM Perl GnuTLS
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb
dsearch ldap ldapdn ldapm mysql nis nis0 passwdpgsql
Authenticators: cram_md5 plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram
redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Contains exiscan-acl patch revision 21 (c) Tom Kistner
[http://duncanthrax.net/exiscan/]
Configuration file is /etc/exim4/exim4.conf
Maybe someone's able to tell what exactly is failing, I have not been
able to track the problem down in the code, I lost the trace somewhere
near the end of receive.c. Between the "signal(SIGINT, SIG_DFL);" and
"smtp_printf(...)" it should happen I thought, but there's not much in
between...
lg,
daniel
mime_acl.txt
(text/plain, 3.2 KB)
check_mime:
deny message = Possible Sober.I virus rejected
condition = ${if and{ {<{$message_size}{100K}} \
{match {$mime_filename}{\\.(?:com|scr|pif|zip|bat)\$}} \
} {1}{0}}
regex = X3IvbrZnRugfVhlzyR1SbLLvxX2b3zrLbukJ4Tsk3xF6C5I0jH1zYk9uC2nhzCycN2ti2y6lYYIZ : \
a2cLZ4PgJBNPrhthS3Ya1xxPLANbdgRHAe48Io8AMFjh7pxDaOgWSxc40zRN1x9FA1JfbHlN0zRN
deny message = Possible Bagle.AT virus rejected
condition = ${if and{ {<{$message_size}{50K}} \
{match {$mime_filename}{\\.(?:com|scr|exe|cpl)\$}} \
} {1}{0}}
regex = NE82iSO/bEdEYK52VU0AMSQcidgnFDiXVAkt6Y/3cRy5W5PXIy10yjGYasrz7n8e58jMkHXE : \
lTclQABS6A4AAADoAQAAAGmDxARaXg5Wy2CLdCQki3wkKPyygKTobAAAAHP4K8noYwAAAHMa
deny message = Possible Netsky-P / SomeFool-P virus rejected
condition = ${if and{ {<{$message_size}{50K}} \
{match {$mime_filename}{\\.(?:zip|scr|exe|pif)\$}} \
} {1}{0}}
regex = u08hwgXNThwc4jSBNNL34YlO9VN65YDb42KMlvlBR4bxNMq6Sg40UqAxv6hBqCEze37ZJtCm : \
hqVS4WR4z8LzdhVwrEMIyULWkqWFz6PBhgp2/Px0FcbmHR/Vco/JGR5fI/MdAZ2i/ODJ/oWu : \
qrXUucvnS5nZvA1rqpv5a3XoFb1rgOr3DIORtoTqJcbyiZKumdQIDmMM5GSs5g2MIwpgme3L : \
5DF0FXBK1S61RT3MvlCrJKE5y0qBc4mJ0VQqx71MSz0sn07k1WWgdWMUVrF7ovQu4kr3YAVg : \
vI40yItdgUzIIeYuYTnVnBt3neQxdBVwStUutUU9zL5QqyShOctKgXOJidFUKse9TEs9LJ9O
deny message = Possible Netsky-D / SomeFool-B virus rejected
condition = ${if and{ {<{$message_size}{40K}} \
{match {$mime_filename}{\\.pif\$}} \
} {1}{0}}
regex = d6rUage4iBa7Vbtmp6PgUUQauljiMD8BysbzEn7rIObYhKNRVLLr6zUHvpgv2XA8j1tmS/fT
deny message = Possible Erkez.B@mm / Zafi.B virus rejected
condition = ${if and{ {<{$message_size}{40K}} \
{match {$mime_filename}{\\.(?:com|exe|pif)\$}} \
} {1}{0}}
regex = /AFzExnoNwhlvp8ftL4xzg/r03QqXwAy5IvIM8CwQJNbHU8BUQPBv7OCw6qD7wKRapAVmEXVViXl
# we mark executables for later filtering
warn message = X-Inode-x: yes
condition = ${if and { \
{ def:acl_m0 } \
{!def:h_X-Exec } \
{match {$mime_filename} \
{\\.(?:bat|cmd|com|cpl|exe|hta|inf|ins|isp|js|jse|lnk|pcd|pif|\
prf|reg|scf|scr|sct|shb|shs|url|vb|vbe|vbs|wsc|wsf|wsh|xsl)\$}} \
} {yes}{no}}
accept
strace.txt
(text/plain, 1.4 KB)
..
[pid 7851] rename("/var/spool/exim4/input/q/hdr.7851", "/var/spool/exim4/input/q/1CZt2q-00022d-Op-H") = 0
[pid 7851] open("/var/spool/exim4/input/q/.", O_RDONLY|O_LARGEFILE) = 1
[pid 7851] fsync(1) = 0
[pid 7851] close(1) = 0
[pid 7851] gettimeofday({1102001940, 789392}, NULL) = 0
[pid 7851] fstat64(0, {st_mode=S_IFREG|0640, st_size=839, ...}) = 0
[pid 7851] time(NULL) = 1102001940
[pid 7851] time([1102001940]) = 1102001940
[pid 7851] getpid() = 7851
[pid 7851] rt_sigaction(SIGPIPE, {0x4030d790, [], SA_RESTORER, 0x4037c4a8}, {SIG_IGN}, 8) = 0
[pid 7851] send(5, "<22>Dec 2 16:39:00 exim[7851]: "..., 324, 0) = 324
[pid 7851] rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0
[pid 7851] time(NULL) = 1102001940
[pid 7851] close(6) = 0
[pid 7851] open("/var/spool/mail/log/mainlog", O_WRONLY|O_APPEND|O_LARGEFILE) = 1
[pid 7851] fcntl64(1, F_GETFD) = 0
[pid 7851] fcntl64(1, F_SETFD, FD_CLOEXEC) = 0
[pid 7851] fstat64(1, {st_mode=S_IFREG|0640, st_size=156647942, ...}) = 0
[pid 7851] write(1, "2004-12-02 16:39:00 1CZt2q-00022"..., 292) = 292
[pid 7851] close(0) = 0
[pid 7851] munmap(0x4001a000, 4096) = 0
[pid 7851] rt_sigaction(SIGTERM, {SIG_DFL}, {SIG_IGN}, 8) = 0
[pid 7851] rt_sigaction(SIGINT, {SIG_DFL}, {SIG_IGN}, 8) = 0
[pid 7851] --- SIGSEGV (Segmentation fault) @ 0 (0) ---