exim4-34 with exiscan crashes on mime messages

Daniel Tiefnig <[email protected]> Fri, 03 Dec 2004 18:27:21 +0100
Newsgroups gmane.mail.exim.exiscan.user
Message-ID <[email protected]>
Hej,

I'm using debian testing with exim 4.34 and exiscan patch version 21 on 
some of my boxes here to scan and relay incoming mails, and its crashing 
on some MIME mails, when I'm using smtp_acl_mime. The result is, that 
messages get stored in queue, but the sending host does never get the 
"250 OK" response. Mails are delivered multiple times due to that.

The problem is not easily reproduceable, as it does not crash on all 
MIME messages, and it does not crash on the same message, if I change my 
mime ACL a little bit, and it does not crash when I'm running exim in 
debug mode...

Anyhow, my smtp_mime_acl is attached in mime_acl.txt, and i can crash it 
with the following message: (pasted after the "data" command)

-----------------------------------------------------------------
X-foo: test
Content-Type: multipart/mixed;
         boundary="----=_NextPart_ST_21_48_22_Wednesday_December"
X-bar: foo

------=_NextPart_ST_21_48_22_Wednesday_December
Content-Type: text/plain;charset="utf-8"
Content-Transfer-Encoding: quoted-printable

blah
------=_NextPart_ST_21_48_22_Wednesday_December
-----------------------------------------------------------------

It does _not_ crash if I omit the X-foo or X-bar header, it does _not_ 
crash if I change the boundaries to not match the header value.

An strace is attached as strace.txt, it shows that queue files are set 
up correctly, and after that (and before sending the OK response) it fails.

With gdb I got the following backtrace (*not* the same segvault as the 
strace):

| Program received signal SIGSEGV, Segmentation fault.
| [Switching to Thread 16384 (LWP 24078)]
| 0x403c51ca in mallopt () from /lib/libc.so.6
| (gdb) bt
| #0  0x403c51ca in mallopt () from /lib/libc.so.6
| #1  0x403c3faf in free () from /lib/libc.so.6
| #2  0x080aa68c in store_reset_3 ()
| #3  0x0805c2a9 in crypt16 ()
| #4  0x0805d860 in daemon_go ()
| #5  0x0806e0bc in main ()


# exim -bV
Exim version 4.34 #1 built 20-Nov-2004 11:32:14
Copyright (c) University of Cambridge 2004
Berkeley DB: Sleepycat Software: Berkeley DB 3.2.9: (May 26, 2004)
Support for: iconv() IPv6 PAM Perl GnuTLS
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb 
dsearch ldap ldapdn ldapm mysql nis nis0 passwdpgsql
Authenticators: cram_md5 plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram 
redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Contains exiscan-acl patch revision 21 (c) Tom Kistner 
[http://duncanthrax.net/exiscan/]
Configuration file is /etc/exim4/exim4.conf


Maybe someone's able to tell what exactly is failing, I have not been 
able to track the problem down in the code, I lost the trace somewhere 
near the end of receive.c. Between the "signal(SIGINT, SIG_DFL);" and 
"smtp_printf(...)" it should happen I thought, but there's not much in 
between...


lg,
daniel
mime_acl.txt (text/plain, 3.2 KB)
check_mime:
        deny    message         = Possible Sober.I virus rejected
                condition       = ${if and{ {<{$message_size}{100K}} \
                                            {match {$mime_filename}{\\.(?:com|scr|pif|zip|bat)\$}} \
                                          } {1}{0}}
                regex   = X3IvbrZnRugfVhlzyR1SbLLvxX2b3zrLbukJ4Tsk3xF6C5I0jH1zYk9uC2nhzCycN2ti2y6lYYIZ : \
                          a2cLZ4PgJBNPrhthS3Ya1xxPLANbdgRHAe48Io8AMFjh7pxDaOgWSxc40zRN1x9FA1JfbHlN0zRN

        deny    message         = Possible Bagle.AT virus rejected
                condition       = ${if and{ {<{$message_size}{50K}} \
                                            {match {$mime_filename}{\\.(?:com|scr|exe|cpl)\$}} \
                                          } {1}{0}}
                regex   = NE82iSO/bEdEYK52VU0AMSQcidgnFDiXVAkt6Y/3cRy5W5PXIy10yjGYasrz7n8e58jMkHXE : \
                          lTclQABS6A4AAADoAQAAAGmDxARaXg5Wy2CLdCQki3wkKPyygKTobAAAAHP4K8noYwAAAHMa

        deny    message         = Possible Netsky-P / SomeFool-P virus rejected
                condition       = ${if and{ {<{$message_size}{50K}} \
                                            {match {$mime_filename}{\\.(?:zip|scr|exe|pif)\$}} \
                                          } {1}{0}}
                regex   = u08hwgXNThwc4jSBNNL34YlO9VN65YDb42KMlvlBR4bxNMq6Sg40UqAxv6hBqCEze37ZJtCm : \
                          hqVS4WR4z8LzdhVwrEMIyULWkqWFz6PBhgp2/Px0FcbmHR/Vco/JGR5fI/MdAZ2i/ODJ/oWu : \
                          qrXUucvnS5nZvA1rqpv5a3XoFb1rgOr3DIORtoTqJcbyiZKumdQIDmMM5GSs5g2MIwpgme3L : \
                          5DF0FXBK1S61RT3MvlCrJKE5y0qBc4mJ0VQqx71MSz0sn07k1WWgdWMUVrF7ovQu4kr3YAVg : \
                          vI40yItdgUzIIeYuYTnVnBt3neQxdBVwStUutUU9zL5QqyShOctKgXOJidFUKse9TEs9LJ9O

        deny    message         = Possible Netsky-D / SomeFool-B virus rejected
                condition       = ${if and{ {<{$message_size}{40K}} \
                                            {match {$mime_filename}{\\.pif\$}} \
                                          } {1}{0}}
                regex   = d6rUage4iBa7Vbtmp6PgUUQauljiMD8BysbzEn7rIObYhKNRVLLr6zUHvpgv2XA8j1tmS/fT

        deny    message         = Possible Erkez.B@mm / Zafi.B virus rejected
                condition       = ${if and{ {<{$message_size}{40K}} \
                                            {match {$mime_filename}{\\.(?:com|exe|pif)\$}} \
                                          } {1}{0}}
                regex   = /AFzExnoNwhlvp8ftL4xzg/r03QqXwAy5IvIM8CwQJNbHU8BUQPBv7OCw6qD7wKRapAVmEXVViXl

        # we mark executables for later filtering
        warn    message         = X-Inode-x: yes
                condition       = ${if and { \
                                             { def:acl_m0 } \
                                             {!def:h_X-Exec } \
                                             {match {$mime_filename} \
                                                    {\\.(?:bat|cmd|com|cpl|exe|hta|inf|ins|isp|js|jse|lnk|pcd|pif|\
                                                     prf|reg|scf|scr|sct|shb|shs|url|vb|vbe|vbs|wsc|wsf|wsh|xsl)\$}} \
                                           } {yes}{no}}

        accept
strace.txt (text/plain, 1.4 KB)
..
[pid  7851] rename("/var/spool/exim4/input/q/hdr.7851", "/var/spool/exim4/input/q/1CZt2q-00022d-Op-H") = 0
[pid  7851] open("/var/spool/exim4/input/q/.", O_RDONLY|O_LARGEFILE) = 1
[pid  7851] fsync(1)                    = 0
[pid  7851] close(1)                    = 0
[pid  7851] gettimeofday({1102001940, 789392}, NULL) = 0
[pid  7851] fstat64(0, {st_mode=S_IFREG|0640, st_size=839, ...}) = 0
[pid  7851] time(NULL)                  = 1102001940
[pid  7851] time([1102001940])          = 1102001940
[pid  7851] getpid()                    = 7851
[pid  7851] rt_sigaction(SIGPIPE, {0x4030d790, [], SA_RESTORER, 0x4037c4a8}, {SIG_IGN}, 8) = 0
[pid  7851] send(5, "<22>Dec  2 16:39:00 exim[7851]: "..., 324, 0) = 324
[pid  7851] rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0
[pid  7851] time(NULL)                  = 1102001940
[pid  7851] close(6)                    = 0
[pid  7851] open("/var/spool/mail/log/mainlog", O_WRONLY|O_APPEND|O_LARGEFILE) = 1
[pid  7851] fcntl64(1, F_GETFD)         = 0
[pid  7851] fcntl64(1, F_SETFD, FD_CLOEXEC) = 0
[pid  7851] fstat64(1, {st_mode=S_IFREG|0640, st_size=156647942, ...}) = 0
[pid  7851] write(1, "2004-12-02 16:39:00 1CZt2q-00022"..., 292) = 292
[pid  7851] close(0)                    = 0
[pid  7851] munmap(0x4001a000, 4096)    = 0
[pid  7851] rt_sigaction(SIGTERM, {SIG_DFL}, {SIG_IGN}, 8) = 0
[pid  7851] rt_sigaction(SIGINT, {SIG_DFL}, {SIG_IGN}, 8) = 0
[pid  7851] --- SIGSEGV (Segmentation fault) @ 0 (0) ---