Re: [Clamav-users] Deferred=451 4.7.1 Please try again later - HELP

[Joe Maimon]

With respect for your  considerably greater experience and skill set 
than mine.....

Tomasz Kojm wrote:

On Tue, 30 Mar 2004 16:03:07 -0500
Joe Maimon <[EMAIL PROTECTED]> wrote:
 

by..... 2) clamd does not scan anything if the stream is larger than 
StreamMaxLength - sizeof(buff).
   

That's not true.
 

from clamd/scanner.c, function scanstream

char buff[32768];
...
...
...
...
if(maxsize && (size + sizeof(buff)) > maxsize) {
...
...
...
    return -1;
 

In my book thats a bug. It should read up to the max.
   

It does.

 

It does not. Any stream that is larger than (maxsize - sizeoff(buf)) 
does not get scanned. Which means that StreamMaxLength is effectively 
the user's value minus an internal number.

Old syslog entries:

ScanStream: Size exceeded (stopped at 10453272, max: 10485760)

While patching Debug syslog entries:

Mar 30 17:59:30 nameserver2 clamd[13267]: ScanStream: btread 32768
Mar 30 17:59:30 nameserver2 clamd[13267]: ScanStream: btread now 32341
Mar 30 17:59:30 nameserver2 clamd[13267]: ScanStream: btread 32341
Mar 30 17:59:30 nameserver2 clamd[13267]: ScanStream: btread now 0
Mar 30 17:59:30 nameserver2 clamd[13267]: ScanStream: Size exceeded 
(stopped at 10485760, max: 10485760)

With patch syslog:

ScanStream: Size limit reached (max: 10485760

What did I miss?

-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users