Hi there, On Fri, 1 May 2020, James Brown via clamav-users wrote:
Getting lots of crashes of clamd. No indication of an issue in the clamd.log. ... --> STACK GUARD 0000700000a1c000-0000700000a1d000 [ 4K] ---/rwx SM=NUL stack guard for thread 2 Stack 0000700000a1d000-0000700000b1f000 [ 1032K] rw-/rwx SM=COW thread 2 ... Thread 2 Crashed: 0 libpcre.0.dylib 0x00007fff6e41eae6 0x7fff6e40a000 + 84710 ...
I'm unfamiliar with some of the tools that you're using but many here can relate their experiences of the outstandingly good stability of clamd under what I'll call normal circumstances. Some of us have even pushed the envelope a little with no stability issues at all. Unfortunately I have no experience of anything on a Mac that's under 20 years old so you'll need to treat my guesses with caution, but it looks like a PCRE library is bashing the stack there. It's the sort of thing that a dodgy PCRE library might easily be expected to do. Where did it come from? This is the library I'm using on a Raspberry Pi4b, old but not very old by the standards of the distribution: $ pldd `pidof clamd` | grep libpcre | xargs ls -lL -rw-r--r-- 1 root root 485200 Mar 25 2019 /usr/lib/arm-linux-gnueabihf/libpcre2-8.so.0 I looked at https://www.apple.com/uk/macos/catalina/ and it gave me the impression that the OS is "for entertainment only" but I guess I'm just an old grouch.
I use a number of the third party sigs, securite.info, sanesecurity, Malware Patrol, etc. Updating those or running Freshclam does not crash clamd.
Do the clamd crashes happen at particular times, such as when clamd is reloading its databases, or is it while scanning?
Any ideas what could be causing this?
It's probably easier to say what it's likely not to be. :( My guess is that it's likely not to be a fault in clamd itself, but in something in your OS to which clamd is linking, but I think there's less testing of ClamAV on Macs generally than on e.g. Linux, so anything's possible. How much RAM is in the machine? You'll need at least 2G free before starting clamd and freshclam, likely more with many 3rd party sigs. -- 73, Ged. _______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
