Hello all, This may be somewhat off topic as I think the problem may lie more with simscan then clamav but people on this list probably have the most experience with the interaction of the two.
I am trying to get simscan working on Solaris 10 (sparc) but I am having issues when clamav finds a virus and only when it finds a virus. When clamav finds a virus simscan segfaults and then the qq crashes but it works fine when clamav does not find a virus. Here are some examples: When it works fine(no virus detected): simscan: starting: work dir: /var/spool/simscan/work/1202913185.9446.9006 simscan: calling clamdscan simscan: normal clamdscan return code: 0 simscan: done, execing qmail-queue simscan: qmail-queue exited 0 When it breaks(virus detected): simscan: starting: work dir: /var/spool/simscan/work/1202912843.280724.5576 simscan: calling clamdscan simscan: Putting the message in quarantine: /var/spool/simscan/quarantine/clamav.msg.1202912843.280724.5576 simscan: Message recorded in quarantine successful simscan: clamdscan detected a virus simscan: qmail-inject: fatal: qq crashed (#4.3.0) More information from truss when it breaks: simscan: clamdscan detected a virus 5852: write(2, " s i m s c a n : c l a".., 36) = 36 5852: getpid() = 5852 [5851] simscan: 5852: write(2, " s i m s c a n : ", 9) = 9 5852: Incurred fault #6, FLTBOUNDS %pc = 0xFF2B1D50 5852: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000 5852: Received signal #11, SIGSEGV [default] 5852: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000000 5851: waitid(P_PID, 5852, 0xFFBFFA78, WEXITED|WTRAPPED) = 0 qmail-inject: fatal: qq crashed (#4.3.0) To me it looks like simscan is getting a signal 11 from trying to access invalid memory. I have tried this with clamav version 0.92 and 0.92.1, with simscan versions 1.1 and 1.4, and with gcc versions 3.4.6 and 4.0.4 all with the same results. It almost looks like clamav is doing something when it finds a virus to anger simscan but I can't say for sure. The problem could just be a bug in simscan. I have had simscan/clamav working happy together in many x86 environments so it may also be an interaction problem with Solaris/sparc. Has anyone seen this or better yet, found a workaround? If not, it isn't a huge deal. I can probably just use qmail-scanner(assuming that works) or just ditch qmail altogether. Thanks, Steven _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://lurker.clamav.net/list/clamav-users.html
