On Wed, Sep 03, 2008 at 10:01:54AM +0300, Török Edwin wrote: > On 2008-09-03 04:57, Dennis Peterson wrote: > > What might have happened here: > > > > > clamdscan test > > > > /test/.split/split.clam.arjaa: Input/Output error ERROR > > ... > > There is nothing wrong here, the files in .split are split in half, so > clamd sees that it is truncated.
Please sanitize your error logic. It's pretty difficult for people to create custom libclamav applications, with random return codes popping here and there. I see no point returning a generic Input/Output error for a completely scanned file that contains no viruses. It makes no difference if it's logically a split archive, data stream is data stream. Why doesn't it return CL_EARJ instead? Why not maybe use bitfields to return multiple values so CL_CLEAN is reported also? Now there is no macro or function to check if an error is "serious". When scanning returns for example CL_ETMPFILE, I think it's important - atleast admin should see it so disk space etc can be checked. If I get CL_EIO, I have no clue what it's about - in this case there's no reason for it to be visible to admin or user (say for a http-scanner). There's not even a generic "broken archive" error, CL_ERAR etc are pointless to return alone, we can't know what new codes future versions come up with. Please make a stable interface. _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
