The Search service can crash when indexing certain .XLS files

Versions / Builds Affected

20150218

Status

Open

TT / JIRAID

3002

How to Identify

he event logs shows a of marc.search.exe with a reference to dtengine64.dll: Error 14/07/2015 15:22:09 Application Error 1000 "Faulting application name: MArc.Search.exe, version: 20150.219.111.14, time stamp: 0x54e6222a Faulting module name: dtengine64.dll, version: 7.78.8213.1, time stamp: 0x54242fb7 Exception code: 0xc0000005 Fault offset: 0x00000000003466d3 Faulting process id: 0x24b4 Faulting application start time: 0x01d0be405f7ce112 Faulting application path: C:\Program Files (x86)\GFI\MailArchiver\Search\bin\MArc.Search.exe Faulting module path: C:\Program Files (x86)\GFI\MailArchiver\Search\dtengine64.dll Error 14/07/2015 15:22:09 .NET Runtime 1026 None Application: MArc.Search.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.AccessViolationException Stack: at .dtssConvertFile2(dtsFileConvertJob2*, Int16*) at .dtssConvertFile2(dtsFileConvertJob2*, Int16*) at .DFileConvertJob.Execute(DFileConvertJob*) at .CInternalApiConvertJob.Execute(CInternalApiConvertJob*) at dtSearch.Engine.FileConverter.ExecuteFromInputStream(DFileConvertJob*) at dtSearch.Engine.FileConverter.Execute() at MArc.Search.Core.IndexableAttachment.ProcessAttachment(Store.Dal.Elements.Email.Attachment, MArc.Search.Core.AttachmentReader, System.IO.StreamWriter) at MArc.Search.Core.NewMessageCollection.WriteAttachmentsXml(Store.Dal.Elements.Email.DetailedMessage, System.IO.StreamWriter, MArc.Search.Core.AttachmentReader) at MArc.Search.Core.NewMessageCollection.WriteMessageXml(Store.Dal.Elements.Email.DetailedMessage, System.IO.StreamWriter, MArc.Search.Core.AttachmentReader) at MArc.Search.Core.NewMessageCollection.GetNextDoc() at .dtSearch.Engine.CNetDataSource.getNextDocImp(dtSearch.Engine.CNetDataSource*, dtsInputStream*) at .dtSearch.Engine.CNetDataSource.getNextDoc(dtSearch.Engine.CNetDataSource*, dtsInputStream*) at .DDataSourceBase.getNextDocCB(Void*, dtsInputStream*) at .dtssDoIndexJob(dtsIndexJob*, Int16*) at .dtssDoIndexJob(dtsIndexJob*, Int16*) at .DIndexJob.Execute(DIndexJob*) at .InternalApiIndexJob.CJobQueue.Execute(InternalApiIndexJob.CJobQueue*) at .CApiIndexJobForNet.Execute(CApiIndexJobForNet*) at dtSearch.Engine.NetJobBase.ExecuteJob(DJobBase*) at dtSearch.Engine.IndexJob.Execute() at MArc.Search.Core.Index.AddMessagesToIndex(Boolean) at MArc.Search.Core.Index.ApplyMessageUpdates(Store.Dal.Elements.Email.ResultSet, System.Guid) at MArc.Search.Core.Index.Synchronise() at MArc.Search.Core.IndexManager.PollStore() at MArc.Search.Core.IndexManager.PollIndices() at MArc.Common.Utilities.Threading.ProcessingThread.Run() at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) at System.Threading.ThreadHelper.ThreadStart() This is caused by the dtSearch engine while trying to index certain .XLS files. Notes - The email triggering this in the original case in which this was reported was a XLS file created by Crystal Decisions or Crystal Reports - the file looked normal and did not contain obvious characteristics which might indicate that processing it might be problematic - Not all XLS files cause a crash

Workaround / Fix Details

Workaround #1 Pause the index which contains the email which triggers the crash Workaround #2 Disable indexing of XLS attachments (or attachment indexing in full) Workaround #3 Delete the email in question from the archive

Required Actions

1. Isolate the email / attachment triggering the crash (consult PSG if need be) 2. Archive the email in your test VM environment to see if we can reproduce the crash in-house 3. Provide the sample to PSG 4. Escalate the case after reviewing it together with PSG