On 04/08/2010 10:02 PM, Royce Williams wrote:
> 2010/4/8 Török Edwin <edwinto...@gmail.com>:
>> On 04/08/2010 08:04 PM, Royce Williams wrote:
>>> First time poster, in a bind. We're running ClamAV 0.95.3 on FreeBSD
>>> 7.3.
>> Does this still occur with 0.96?
>
> Not yet known. I'm unable to test it because I can't upgrade to 0.96.
> I think that this is because of the LLVM issue in bug 1934 reported
> by Chuck Swigert.
>
>>> We're getting this error in our sendmail logs:
>>>
>>> /var/spool/MIMEDefang/mdefang-o38GNjZv088151/Work/msg-81178-1234.pdf:
>>> Can't map file into memory ERROR
>> That error is probably coming from here (in pdf.c):
>> p = buf = mmap(NULL, size, PROT_READ, MAP_PRIVATE, desc, offset);
>> if(buf == MAP_FAILED) {
>> cli_errmsg("cli_pdf: mmap() failed\n");
>> return CL_EMAP;
>> }
>>
>> Please change that code to be:
>> p = buf = mmap(NULL, size, PROT_READ, MAP_PRIVATE, desc, offset);
>> if(buf == MAP_FAILED) {
>> perror("mmap failed");
>> cli_errmsg("cli_pdf: mmap() failed\n");
>> return CL_EMAP;
>> }
>>
>> So that we see the actual error.
>
> Because I am using clamav as installed from the FreeBSD ports systems,
> I will need to retrofit a standalone install to incorporate any
> compile changes or patches added by the port. I haven't done this
> level of modification before, so that will take a little time.
>
>> Does this occur every time you scan that file?
>
> Further analysis reveals that it is quite consistent, and it is
> related to the size of the file - unencoded somewhere between 1.4MiB
> and 2.2MiB.
>
>> If so, please open a bugreport, and attach the log from this command:
>> $ strace clamscan
>> /var/spool/MIMEDefang/mdefang-o38GNjZv088151/Work/msg-81178-1234.pdf 2>log
>>
>> Assuming you run a FreeBSD that supports strace, if not use ktrace
>> instead of strace, and attach the output from kdump.
>
> I do have strace. I am having trouble recreating the problem. I first
> uploaded the file to the server, but it scanned clean. I then
> configured MIMEDefang to leave its files behind after processing, sent
> myself a PDF that triggered the error, and then manually scan ned the
> left-behind file. This scan succeeded.
>
> I am not sure what failure mode would make this succeed with clamscan
> on the command line but fail when called by MIMEDefang.
Does MIMEDefang use clamdscan or clamscan?
>
> I will also drop back to 0.95.2 to see if the problem was the OS
> upgrade or the clamav upgrade.
OK.
Best regards,
--Edwin
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
