On Tue, 31 Aug 2004, David Champion wrote:
; * On 2004.08.31, in <[EMAIL PROTECTED]>,
; * "Andy Fiddaman" <[EMAIL PROTECTED]> wrote:
; >
; > Since the latest daily update, ClamAV has been crashing here with every
; > email it scans, has anyone else seen this ?
; > It appears to be related to the new .hdb file containing an EICAR signature.
;
; Yes. I get almost the same backtrace as you. I've had to disable clam
; to get mail through -- I've been fighting with this one since 14:47
; GMT-0500, but since I couldn't receive mail, I didn't know I wasn't
; alone.
;
; I'm running today's CVS on Solaris 9/SPARC -- haven't made much progress
; on it, as I was making other major changes in my mail system at the time
; this struck. Red herrings galore.
Same here, Solaris 9.
I've temporarily disabled hdb file loads to get it to work:
buckk# (1363) diff libclamav/readdb.c.orig libclamav/readdb.c
561c561
< ret = cli_loadhdb(fd, root, virnum);
---
> ret = 0; /*cli_loadhdb(fd, root, virnum);*/
I haven't had much time to investigate it fully, but it's happening in
md5_process_block() when the pointer into the buffer is dereferenced. I've
expanded out the OP macro for the first operation to the following to get
some granularity, the line which is causing the crash is indicated with a
*. It's odd because this same code is used to verify the MD5 on the cvd
file and doesn't have any problems. Also, the *words in this case seems to
be valid.
{
md5_uint32 tmp;
A += FF(B, C, D);
* tmp = *words;
tmp = SWAP(tmp);
*cwp = tmp;
A += *cwp;
cwp++;
A += 0xd76aa478;
++words;
CYCLIC(A, 7);
A += B;
}
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Clamav-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/clamav-users
