Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Uneven size in DecodeToStream?  What causes this error?
  FAQ FAQ  Forum Search   Register Register  Login Login

Uneven size in DecodeToStream? What causes this error?

 Post Reply Post Reply
Author
Alan View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote Alan Quote  Post ReplyReply Direct Link To This Post Topic: Uneven size in DecodeToStream? What causes this error?
    Posted: 09 September 2003 at 1:36pm

These spams are not able to be scanned and get passed though.  What the the cause for this error?  The emails are only 4kb in size so I don't see that as an issue.

09/09/03 10:28:13:125 -- (201) Connection from: 199.181.164.63  -  Originating country : United States
09/09/03 10:28:13:265 -- (201) Resolving 199.181.164.63 - milkyway.seanet.com
09/09/03 10:28:13:343 -- (201) Mail from: name@yahoo.com
09/09/03 10:28:13:968 -- (201) - MAPS search done... .
09/09/03 10:28:13:968 -- (201) RCPT TO: name@domain.com accepted
09/09/03 10:28:14:234 -- (201) Warning: Unable to scan email content for keywords - Uneven size in DecodeToStream.
09/09/03 10:28:14:328 -- (201) EMail from name@yahoo.com to name@domain.com was queued. Size: 2 KB
09/09/03 10:28:14:343 -- (201) Disconnect

Back to Top
JimMeredith View Drop Down
Guest Group
Guest Group
Post Options Post Options   Thanks (0) Thanks(0)   Quote JimMeredith Quote  Post ReplyReply Direct Link To This Post Posted: 09 September 2003 at 7:55pm

Roberto,

Noticed that this DecodeToStream issue has been raised before on this forum, and you have asked for message samples where this error occurred... if it will help, I've got a sample message where this error occurred on our system.

I've saved the message as a text file on the server, so the full headers and unmodified message content is still there.  I'll attach this text file to an email message and send it your way.  Lots of interesting things about this message... a corrupted Message-ID field (intentionally corrupted, you can be sure), a pipe character in the subject line, and the old base64 with content-type=text/html trick.  Easy to see how the keyword filter might find something in this message that it can't digest.

I will also attach the section of the SpamFilter log showing where the DecodeToStream error occurred.  As you can see, SpamFilter did stop the message based on blacklist, but the keyword search didn't happen.

One other note... I am using the INI file setting FilterBase64html=1 on my server.  Not certain whether this is relevant to your research, but since this is one of the characteristics of this message, I figured that you should know.

Jim

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 10 September 2003 at 11:12pm

Jim,

Thank you very much for the source of the email you provided.

The problem was caused by invalid/corrupt encoding of the email body (the subject was fine), which caused our decoder to skip it since it would be unreliable.

We've patched the decoder so that it now converts all the valid data it finds, without erroring out. We'll include the fix in the next build that will be released within a few days.

Roberto F.
LogSat Software

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 10 September 2003 at 11:18pm

Thanks to JimMeredith we received a copy of a full email message that caused the error. The problem was caused by invalid/corrupt encoding of the email, which caused our decoder to skip it since it would be unreliable.

We've patched the decoder so that it now converts all the valid data it finds, without erroring out. We'll include the fix in the next build that will be released within a few days.

Roberto F.
LogSat Software

Back to Top
Robby View Drop Down
Newbie
Newbie


Joined: 16 January 2007
Location: Netherlands
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote Robby Quote  Post ReplyReply Direct Link To This Post Posted: 16 January 2007 at 3:37am
Hello everybody,

I am programming in Delphi. Retrieving the emails one by one in the server, this error occurs: Uneven size in DecodeToStream.
I feel that there is something wrong with the email. But I did not know what. It is almost impossible that it lies on my Delphi code.

Now I have an idea what the causes could be. Thank you so much to all of you for these information.

Kind regards,

Robby Tosasi,
a Surinamese living in the Netherlands.



Edited by Robby
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4104
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 16 January 2007 at 5:05pm
If one of the attachments is not encoded correctly, your Indy library may cause the whole message to fail.
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.176 seconds.