[Clamav-devel] More issues with 0.99.3 beta 1

Tom Judge tjudge at sourcefire.com
Wed Aug 16 04:28:35 EDT 2017


Mark,

> On Aug 15, 2017, at 12:34 PM, Mark Allan <markjallan at gmail.com <mailto:markjallan at gmail.com>> wrote:
> 
> 2) It specifies a length of 1 byte, but also has :73 at the end which means "file size unknown".


This is not quite correct, the 1 here should be interpreted as a file size of 1 byte.  The trailing :73 is a engine version restriction based on engine functional level, restrictions can have a minimum and maximum version and for HSB sigs are optional trailing fields in the form :F-Min:F-Max.  The 73 here refers to an internal test engine release that included this functionality for wildcard size that first appeared in ClamAV 0.98 (which has functional level 74).


Tom


More information about the clamav-devel mailing list