On 04/15/2010 12:21 AM, Brian Bebeau wrote:
We have a customer who sent an email through us that was a short text body with
an Excel spreadsheet attachment.
> The attachment is about 988K and the entire email is about 1.3M.
> For some reason, when ClamAV parses the Excel file,
> it winds up creating about 2300 files and
> taking up about 1.3 *gig* of space.
What is your MaxScanSize setting?
If it is the default, or below 1.3G then it is a bug.
It should stop extracting as soon as it reaches that limit.
Because there are multiple copies, it's running the tmp out if space, causing
the message to fail.
Running debug, it says it thinks it "Matched signature for file type CAB-SFX at
35233". Why would it think an Excel file is a cab file?
Because it matched the CAB-SFX signature (MSCF):
"1:*:4d534346:CAB-SFX:CL_TYPE_ANY:CL_TYPE_CABSFX"
However if this is a false match and not a real CAB, it should detect
that, and extract nothing.
Please open a bug and attach the file.
Best regards,
--Edwin
_______________________________________________
Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net
http://www.clamav.net/support/ml
