On Tue, May 24, 2016 at 12:01:37AM +0200, Sebastian Andrzej Siewior wrote: > After "clamdscan /usr/share/clamav-testfiles/*" (from the > clamav-testfiles package) it remains at nine. I bet that you have one > test file which keeps the number of descriptors growing. Could you > please figure out which one it is?
After a fresh start, it's steady at 9 until I scan the file at <https://nhmu.utah.edu/sites/default/files/attachments/2015.NHMU_.AccessionForm_distributed-2.pdf>, after which it increases. Scanning other PDFs from <https://nhmu.utah.edu/collections/policies-forms> also makes clamd leak file descriptors, as do all the PDFs from outside sources that I've tried. The second time I scan a file, the number of file descriptors does not increase. This explains why it was crashing even before we included one of these PDFs in the test corpus: clamav-milter presumably gets enough PDFs that trigger this in routine e-mail traffic that clamd falls over after a few days.
