On 2008-10-15 20:00, Sturgeon, Brian (CL Tech Sv) wrote: > We are using clamav .94 on solaris 10. > > We are having problems scanning large hqx files using clamscan. I define > large as over 1 Gig. The error we are receiving is > LibClamAV Error: cli_malloc(): Can't allocate memory (8 bytes). >
Hi, I would need a way to reproduce the problem, but sending us that 1 Gig file is out of the question. Can you show me how to create such large create hqx files out of files I already have? (I can find / create 1G+ files, no problem). Please open a bugreport so that we can further track this issue. Some info to get started with: - how much memory do you have? - your 'ulimit -a' settings - use truss to get a system call trace, and attach it to the bugreport - if you know how to use gdb, put a breakpoint at cli_errmsg, and show us a stacktrace (see http://clamav.net/bugs) Why do you need to scan such large files? Does it have some sort of an archive inside it? > The root cause is the server runs out of memory and then generates the error, > but the process never ends and server is starved for memory. The same thing > happens when running clamdscan where we direct the file to clamd. > > This does not happen when scanning large tar.gz or simple tar files. This is > only happening with large hqx files. Smaller hqx files work fine. > > We are able to skip the files by limiting the size to scan using > --max-filesize=, but then we will be skipping other large files that we would > like to scan such as large zip files. We tried setting --max-scansize, but > it does not seem to work in solaris 10. > > I tested the -max-scansize on a tar.gz file. > Here is the size of compress file 242916 Oct 15 12:35 text.gz > Here is the size of uncompressed file 4436290 Oct 15 12:35 text.gz > > /opt/clam/bin/clamscan -v /test/text.gz -i --tempdir=/tmp/clam/tmp > --move=/tmp/clam/infected --max-files=1000 > 00 --max-filesize=999999 --max-scansize=999999 --max-recursion=25 > --max-dir-recursion=50 > > /opt/clam/bin/clamscan -v /test/text.gz -i --tempdir=/tmp/clam/tmp > --move=/tmp/clam/infected --max-files=1000 > 00 --max-filesize=4096m --max-scansize=4096m --max-recursion=25 > --max-dir-recursion=50 > > Here is the summary I see when that indicates the entire file was scanned. > The --max-scansize argument is in units of kilobytes, so --max-scansize=999999 is equivalent to --max-scansize=976M, there is no bug here. > I also tried testing using the debug option. Not much additional information > was provided. Most of the debug output involves reading the virus > definition. Once the scan of the file occurs, there is the line indicating a > file is larger than 400kb. Not quite sure where the 400kB came from. The 400kb is the limit for the generic text scanner, and it doesn't limit scanning the file itself. The file was still scanned, but not with type-7 signatures. Best regards, --Edwin _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
