[exim] Format error in spool file! Probably local_scan sa_ex…

Top Page
Delete this message
Reply to this message
Author: Sander Smeenk
Date:  
To: exim-users
Subject: [exim] Format error in spool file! Probably local_scan sa_exim.so?
Hi list!

Today, vger.kernel.org delivered another one of it's bursts of messages
to my mailserver, and one of those got stuck logging 'Format error in
spool file'. Saucy!

I captured the -D and -H files, the log doesn't show anything special
other than that message being delivered and the spool file being corrupt.
I can't see any IO-errors and this is the first time i'm seeing this.
I'm wondering if anyone is interrested in this. ;)

The corruption seems to be in the -H file, where my spam scan headers
are inserted and the corruption starts here:

| 099  X-SA-Exim-Scanned: Yes (on .index_key.desc_len     = strlen(description),
|                .cred                   = current_cred(),
| 044  
|   [..]


This header ought to look like this:
| X-SA-Exim-Scanned: Yes (on mx.freshdot.net)

and is most probably inserted by the local_scan 'sa-exim.so' which makes
me wonder if this is sa-exim.so's problem instead of Exim's... ;)

In any case, it was a public message, and i don't mind my server's IPs
going on the interwebs, they're there already, so here's the files on my
pastebin:

D file: https://8n1.org/raw/15243/e070
H file: https://8n1.org/raw/15244/d87d

Do notice that the H file has some \020 \020 bytes at the end too!
Oooooh! ;)

This is on Ubuntu 18.04, Exim 'daemon-heavy' 4.90.1-1ubuntu1.1,
and the 'sa-exim' 4.2.1-16 local_scan module on Intel 64bits.

I'll update and restart some services.
This message was more informational than me looking for help.
Currently. ;)

Have a great day,
-Sndr.
--
| At times i use words i don't fully understand to seem more coagulated.
| 4096R/20CC6CD2 - 6D40 1A20 B9AA 87D4 84C7 FBD6 F3A9 9442 20CC 6CD2