2010/4/8 Török Edwin <edwinto...@gmail.com>:
> On 04/08/2010 08:04 PM, Royce Williams wrote:
>> First time poster, in a bind. We're running ClamAV 0.95.3 on FreeBSD
>> 7.3.
>
> Does this still occur with 0.96?
Not yet known. I'm unable to test it because I can't upgrade to 0.96.
I think that this is because of the LLVM issue in bug 1934 reported
by Chuck Swigert.
>> We're getting this error in our sendmail logs:
>>
>> /var/spool/MIMEDefang/mdefang-o38GNjZv088151/Work/msg-81178-1234.pdf:
>> Can't map file into memory ERROR
>
> That error is probably coming from here (in pdf.c):
> p = buf = mmap(NULL, size, PROT_READ, MAP_PRIVATE, desc, offset);
> if(buf == MAP_FAILED) {
> cli_errmsg("cli_pdf: mmap() failed\n");
> return CL_EMAP;
> }
>
> Please change that code to be:
> p = buf = mmap(NULL, size, PROT_READ, MAP_PRIVATE, desc, offset);
> if(buf == MAP_FAILED) {
> perror("mmap failed");
> cli_errmsg("cli_pdf: mmap() failed\n");
> return CL_EMAP;
> }
>
> So that we see the actual error.
Because I am using clamav as installed from the FreeBSD ports systems,
I will need to retrofit a standalone install to incorporate any
compile changes or patches added by the port. I haven't done this
level of modification before, so that will take a little time.
> Does this occur every time you scan that file?
Further analysis reveals that it is quite consistent, and it is
related to the size of the file - unencoded somewhere between 1.4MiB
and 2.2MiB.
> If so, please open a bugreport, and attach the log from this command:
> $ strace clamscan
> /var/spool/MIMEDefang/mdefang-o38GNjZv088151/Work/msg-81178-1234.pdf 2>log
>
> Assuming you run a FreeBSD that supports strace, if not use ktrace
> instead of strace, and attach the output from kdump.
I do have strace. I am having trouble recreating the problem. I first
uploaded the file to the server, but it scanned clean. I then
configured MIMEDefang to leave its files behind after processing, sent
myself a PDF that triggered the error, and then manually scan ned the
left-behind file. This scan succeeded.
I am not sure what failure mode would make this succeed with clamscan
on the command line but fail when called by MIMEDefang.
I will also drop back to 0.95.2 to see if the problem was the OS
upgrade or the clamav upgrade.
Royce
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
