clamdscan not properly indicating file exceeding limits

[stheine]

Describe the bug

When I'm scanning a large file (hundreds of MB), the scanner exceeds the configured limit and skips the file from being scanned.

In clamd.conf, I have configured AlertExceedsMax yes, and this results in a bad error message:

$ clamdscan large.zip
/path/to/large.zip: Can't allocate memory ERROR

----------- SCAN SUMMARY -----------
Infected files: 0
Total errors: 1
Time: 0.001 sec (0 m 0 s)
Start Date: 2022:08:05 12:40:30
End Date:   2022:08:05 12:40:30

That error handling seems broken. I guess it shouldn't report Can't allocate memory ERROR, but instead it should point to Heuristics.Limits.Exceeded.MaxFileSize.

How to reproduce the problem

In clamd.conf set the MaxFileSize to a limit and send a file via clamdscan, that exceeds the limit.

[ragusaa]

Hi,

Thank you for the report, and I am sorry for the delay in responding. I'll take a look.

Thanks, Andy

[jsinghnahal]

@ragusaa Any updates on this?

The problem can be reproduced consistently by setting the MaxFileSize to any reasonable limit, setting AlertExceedsMax to yes, and then running clamdscan against any file that exceeds that limit. This does not happen when using clamscan with similar options passed via CLI, so it looks like the bug is specific to the daemon.

[ragusaa]

Sorry for the delay. The fix for this didn't make it into the release candidate, but we are planning on having it in our next release.

[jsinghnahal]

Thank you! Looking forward to it :-)