Project

General

Profile

Actions
Copy link

Bug #6023

closed
TW PA

smtp: Attachment not being md5 matched

Bug #6023: smtp: Attachment not being md5 matched

Added by Thomas Winter about 3 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
7.0.0
Affected Versions:
7.0.0-rc1
Effort:
Difficulty:
Label:

Description

Previously we were using 4.0.6 and are in the process of upgrading due to EOL. Currently testing using 7.0.0-rc1.

EICAR file is 68 bytes and md5 is 44d88612fea8a8f36de82e1278abb02f but is not being matched.
Debug shows that the mime-decoder is using 70 bytes and including the \r\n delimiter, resulting in md5 of e7e5fa40569514ec442bbdf755d89c2f.
When retrieved via HTTP then the file is md5 matched.

I believe this to be caused by some of the recent mime and smtp fixes which included refactoring delimiter handling.
I have attached a small diff which makes the md5 get matched by excluding the delimiter when copying over to the buffer but I don't how valid this. This line was changed in commit b82b8825e79 (part of #5316 fix).

I've attached a packet capture of the smtp transaction, packet number 17 is the smtp packet with the attachment.

Files

Download all files
delim_diff.txt (502 Bytes) delim_diff.txt Thomas Winter, 04/25/2023 10:27 PM
smtp_eicar.pcapng (3.73 KB) smtp_eicar.pcapng Thomas Winter, 04/25/2023 10:27 PM
old_smtp_diff.txt (1.19 KB) old_smtp_diff.txt Thomas Winter, 04/27/2023 11:39 PM
verify_failures.txt (1.46 KB) verify_failures.txt Thomas Winter, 05/15/2023 12:44 AM

Subtasks 1 (0 open — 1 closed)

Bug #6193: smtp: Attachment not being md5 matched (6.0.x backport)ClosedPhilippe AntoineActions
Actions
Copy link

Also available in: PDF Atom