[clamav-users] clamdscan big files problem

[SR]

2014-04-25 10:58 GMT-04:00 Shawn Webb <swebb at sourcefire.com>:
> Hey Stephen,
>
> How big is that file? How much RAM (physical and swap separate, please) is
> installed on the scanning machine? Currently, ClamAV has a hard file limit
> of around 2.17GB. Because we're mapping the file into memory, if you don't
> have enough memory available to map the whole file, the memory mapping code
> (as currently implemented) will fail and the file won't be scanned.
>
> One of our long-term goals is to investigate being able to properly support
> large files.
>
> Thanks,
>
> Shawn
> _______________________________________________


Hi Shawn, thanks for your quick reply.

The file I referred to in my previous message is 936MB.  I have other
large files but smaller than 2GB.

The server is running on a VM (ESX-i) with 1GB ram allocated to it.
I will try doubling the RAM for a test, but I find reserving 2GB for a
home file server VM is a bit overkill.

My concern is that since a recent update, the behaviour of clamDscan
seems to have changed.
In my opinion, files this big should be ignored and not loaded.

Finally, I don't know if it is a direct relation; but I have found the following
which seems be related to the fmap() memory allocation problem (at least on a
Debian distribution)
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740059

Stephen..