On Thu, 2006-11-02 at 17:50 +0100, Tomasz Kojm wrote:
> > > if(limits->maxfilesize && ((unsigned int) zdirent.st_size >
> > > limits->maxfilesize)) { cli_dbgmsg("Zip: %s: Size exceeded (%d, max:
> > > %ld)\n", zdirent.d_name, zdirent.st_size, limits->maxfilesize); /* ret =
> > > CL_EMAXSIZE; */ if(BLOCKMAX) {
> > > *virname = "Zip.ExceededFileSize";
> > > ret = CL_VIRUS;
> > > break;
> > > }
> > > continue; /* continue scanning */
>
> ^-- the archive scanning is continued but the file is
> skipped
>
> > > }
Apologies - upon closer inspection, I see what you mean. :)
So one basically ends up with "partially scanned" archives, yes? As in
some of the files within the archive scanned, and some not?
> You're posting to the wrong mailing list.
>
Sorry, I should probably be posting to a C beginner's list with
oversights like that one ;) My tone may have come across as accusatory,
but it wasn't meant that way; it was meant more as a "what's going on
here then?" type of post.
I think I see the source of my confusion - looking at the BZip2 and GZip
scanners, the decompression loop is separate from the actual scanning; I
was applying the same assumption to the Zip code, but this isn't
correct, as the decompression methods differ (bzip/gzip being
stream-oriented instead of extracting discrete files). Is a .tar.gz file
that hits the archive limits also "partially" scanned (assuming the
answer to my earlier question is yes) if ArchiveBlockMax is disabled? In
my experience, ClamD certainly takes a long time doing something in this
case, it's just never been entirely clear to me exactly what.
(I'll happily take this to the devel list if you like, but I'm not
subscribed to it at time of writing.)
--
Philip Allison
Developer
SmoothWall Ltd. - http://www.smoothwall.net/
This email and any attachments transmitted with it are confidential to
the intended recipient(s) and may not be communicated to any other
person or published by any means without the express permission of
SmoothWall Ltd. Any views expressed in this message are solely those of
the author. See http://www.smoothwall.net/emailnotice.html for the full
text of this notice.
This email has been processed by SmoothZap - www.smoothwall.net
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
