Re: [PATCH] Greedy regexps cause false hits on Hi virus

[Jerry D. Hedden]

Some of my emails to the p5p mailing list have been
rejected.  I traced it to 'greedy' regexps in the hi virus
plugin in qpsmtpd.  The following is a portion of an email
that is rejected.

    ------=_Part_18_16555135.1190821850397
    ConXent-Type: application/octet-stream; name="ellipsis.patch"
    ConXent-Transfer-Encoding: base64
    ConXent-Disposition: attachment; filename="ellipsis.patch";
filename="ellipsis.patch"; filename="ellipsis.patch"
    X-Attachment-Id: f_f720j3cf

(I changed it slightly to keep this message itself from
being rejected.)

The patch below should fix the trouble:

--- qpsmtpd-0.40/plugins/virus/check_for_hi_virus
+++ qpsmtpd-patched/plugins/virus/check_for_hi_virus
@@ -15,14 +15,14 @@
         last if $line_number++ > 40;
         if (/^Content-Type: (.*)/) {
             my $val = $1;
-            if ($val =~ /name="(.*)"/) {
+            if ($val =~ /name="(.*?)"/) {
                 $seen_file = 1;
                 $ct_filename = $1;
             }
         }
         if (/^Content-Disposition: (.*)/) {
             my $val = $1;
-            if ($val =~ /filename="(.*)"/) {
+            if ($val =~ /filename="(.*?)"/) {
                 $seen_file = 1;
                 $cd_filename = $1;
             }


# End of patch

I hope you'll incorporate this patch and issue a new release
quickly so my emails will stop being rejected.  Thanks.

(BTW, I'm using gmail for my email client.)