[Mimedefang] Not an ARRAY reference error

Marco Berizzi pupilla at hotmail.com
Mon Aug 23 08:53:20 EDT 2004


Hello.
I'm using this code (from Michal Jankowski) to check
virus inside zip file:

if (-s "./INPUTMSG" < 200*1024) {
    if (lc($ext) =~ /\.zip$/) {
 use Archive::Zip qw(:ERROR_CODES);
        my $path = $entity->bodyhandle->path;
        my $zip = Archive::Zip->new();
   Archive::Zip::setErrorHandler(sub {});
        if ($zip->read($path) == AZ_OK()) {
            md_syslog('debug', "Scanning zip file, Path=$path");
            #my $tfname = Archive::Zip::tempFileName('.');
            my $tfname = Archive::Zip::tempFile('.');
            my @members = $zip->members();
            foreach my $member (@members) {
                my $file = $member->fileName();
                $size = $member->uncompressedSize();
                md_syslog('debug', "Scanning zip entry $file,
size=$size");
                # approx 50Mb siz limit!
  if ($size > 50e6) {
                    md_graphdefang_log('Archive member too big ', $file,
$RelayAddr);
      action_notify_administrator("Archive member too big $file - mail
bounced");
      action_bounce("Archive member $file too big");
                    #action_discard();
                    return;
                }

                if ($member->isEncrypted()) {
                    md_syslog('debug', "scanning Encrypted ZIP member
$file");
                    my ($bad_exts, $re);
                    $bad_exts =
'(ade|adp|app|asd|asf|asx|bas|bat|chm|cmd|com|cpl|crt|dll|exe|fxp|hlp|ht
a|hto|inf|ini|ins|isp|jse?|lib|lnk|mdb|mde|msc|msi|msp|mst|ocx|pcd|pif|p
rg|reg|scr|sct|sh|shb|shs|sys|url|vb|vbe|vbs|vcs|vxd|wmd|wms|wmz|wsc|wsf
|wsh|zip|\{[^\}]+\})';
                    $re = '\.' . $bad_exts . '\.*([^-A-Za-z0-9_.,]|$)';
                    if (lc($file) =~ $re) {
                        md_graphdefang_log('Encrypted_badfile', $file,
$RelayAddr);
                        action_notify_administrator("A file called $file
was detected in an encrypted ZIP file attached to an incoming e-mail -
bounced.");
                        #action_quarantine_entire_message("An encrypted
ZIP attachment conatining $file was removed from this document as
it\nconstituted a security hazard.  If you require this document, please
contact\nIT Support to arrange for it to be released.\n");
   action_bounce("Encrypted files of this type not allowed here");
                        #action_discard();
                        return;
                    }
                    md_syslog('warning', "Encrypted file $file");
  } else {
                 $zip->extractMember($member, $tfname);
                 md_syslog('debug', "Scanning ZIP entry $file");
                 use File::Scan;
                 my $scanner = File::Scan->new;
                 my $virus = $scanner->scan($tfname);
                 unlink($tfname);
                 if ($virus) {
                        md_graphdefang_log('virus', $virus, $RelayAddr);
          action_notify_administrator("Virus $VirusName inside zip found
in mail - rejected");
          action_bounce("Virus $VirusName found in mail - rejected");
                 #action_discard();
                     return;
                 }
                 }
            }
        } else {
  # do something with broken .zip files (eg. discard)
  # action_quarantine_entire_message("broken zip");
  md_graphdefang_log('bad_file', 'broken zip', $RelayAddr);
  action_notify_administrator("broken zip named $fname - reject");
  action_bounce("broken zip - reject");
  return;
 }
    }
}


MIMEDefang die with this error:

sm-mta[1223]: i79Hfv53001223: from=<xxx>, size=8680, class=0, nrcpts=1,
msgid=<pearzprgsjmpjkqtukq>, proto=SMTP, daemon=MTA,
relay=sj-ez-63-96-164-7.bea.com [63.96.164.7] (may be forged)
mimedefang.pl[152]: Scanning zip file, Path=Work/msg-152-28.zip
mimedefang.pl[152]: Scanning zip entry price.html, size=1086
mimedefang.pl[152]: Scanning ZIP entry price.html
mimedefang.pl[152]: Scanning zip entry price/, size=0
mimedefang-multiplexor[129]: Slave 2 stderr: Not an ARRAY reference at
/usr/lib/perl5/5.8.4/File/Path.pm line 143.
mimedefang-multiplexor[129]: Slave 2 died prematurely -- check your
filter rules
mimedefang-multiplexor[129]: Reap: Idle slave 2 (pid 152) exited
normally with status 255 (SLAVE DIED UNEXPECTEDLY)
mimedefang-multiplexor[129]: Slave 2 resource usage: req=33, scans=14,
user=4.480, sys=0.310, nswap=0, majflt=1843, minflt=18178, maxrss=0,
bi=0, bo=0
mimedefang[1224]: Error from multiplexor: ERR No response from slave
mimedefang[1224]: i79Hfv53001223: Filter failed.  Message kept in
/var/spool/MIMEDefang/mdefang-i79Hfv53001223
sm-mta[1223]: i79Hfv53001223: Milter: data, reject=451 4.7.1 Please try
again later
sm-mta[1223]: i79Hfv53001223: to=<x at mydomain>, delay=00:00:01,
pri=38680, stat=Please try again later

Archive-Zip version: 1.12

Hints?



More information about the MIMEDefang mailing list