On Mon, 18 Mar 2002, Gary Palmer wrote:
> I've noticed this a couple of times, and managed to take a better look
> at this one. Sometimes spam comes in with one header repeated
> thousands of times. In this particular case, the message came in with
> 7377 headers saying:
>
> Content-Type: text/x-aol
>
> This causes the exim process which is processing the message to eat
> LOTS (tm) of memory (as much as 2GB, which I believe may be the limit
> on this box) and causes complete havoc with the rest of the machine
> due to memory contention.
Exim is supposed by default to limit the amount of memory it uses for a
message's header to 1 MB. This is controlled by the value of
HEADER_MAXSIZE at build time. I don't think that 7377 of those header
lines adds up anything even close to 1 MB, however. However, if a lot of
messages arrived at once...
> If I truss the process (exim -v -M <msg-id>), then immediately before
> the malloc() bomb, it reads in the sytem filter file.
Aha! What is in your system filter? Do you refer to any variables that
use the headers? Exim 3 has some lousy code for doing this job. I
rewrote it for Exim 4 after previous incidents of a similar nature.
--
Philip Hazel University of Cambridge Computing Service,
ph10@??? Cambridge, England. Phone: +44 1223 334714.
