[clamav-users] Errir parsing PNG files and 451_mail_server_temporarily_rejected_message
Micah Snyder (micasnyd)
micasnyd at cisco.com
Tue Nov 3 02:04:20 UTC 2020
Thanks Pablo,
Just took a look - it seems that image001.gif is missing the final byte, a value "0x3B" should be at the end of every GIF file. Interestingly firefox rendered it, though clam didn't like it and 010editor's GIF template also couldn't handle it. Perhaps this is the sort of issue that should be overlooked when validating the format?
I wonder if this is a common occurrence. I haven't seen it in my test set yet, but I'm still collecting more files to test with.
-Micah
On 11/2/20, 5:58 PM, "clamav-users on behalf of Pablo Murillo" <clamav-users-bounces at lists.clamav.net on behalf of info at pablomurillo.com.ar> wrote:
I try so send several mails to the list with gifs attached, but none
arrived to the list
I'm sending a link to one gif that everyday is rejected by ClamAV
Link to gif file: http://pablomurillo.com.ar/image001.gif
On 11/2/2020 9:02 PM, Micah Snyder (micasnyd) via clamav-users wrote:
> We disabled the PNG parser because of bugs in the code that need to be fixed. I'm actively working on the PNG and GIF parsers, and have started testing with larger sample sets to try to make sure they're more robust. T
>
> he GIF parser seems fairly stable though I'm putting a lot of effort into making the code readable and adding debug output. If you have GIF samples that are incorrectly throwing parse errors, can you share them with me? It would be very helpful.
>
> -Micah
>
> On 11/2/20, 11:50 AM, "clamav-users on behalf of Pablo Murillo" <clamav-users-bounces at lists.clamav.net on behalf of info at pablomurillo.com.ar> wrote:
>
> Hi
>
> What happened with this ?
> Now I'm seeing some errors in GIF files too
>
> On 10/21/2020 2:04 PM, Pablo Murillo wrote:
> > Ajajaja
> > I feel better !
> > ajajaja
> >
> > Check the mail I sent few minutes ago with more info and more files
> > (defug, config, the rights pngs, and the real error)
> >
> > Sorry my english !
> >
> >
> > On 10/21/2020 1:48 PM, Micah Snyder (micasnyd) via clamav-users wrote:
> >> Thanks Pablo I'll check it out right away! I hope you're feeling
> >> better now :D
> >>
> >> Best,
> >> Micah
> >>
> >> On 10/20/20, 1:10 PM, "clamav-users on behalf of Pablo Murillo"
> >> <clamav-users-bounces at lists.clamav.net on behalf of
> >> info at pablomurillo.com.ar> wrote:
> >>
> >> Hi Micah
> >>
> >> I was ready to send a new mail when yours arrived
> >> I made a lot of test and when I activated the option LogClean to
> >> yes on
> >> clamd.conf I found that not all PNG generate the problem !
> >> I'm sending some PNGs attached inside a tar.gz
> >>
> >> Now, I feel me better, I thought that I was the problem :D
> >>
> >> Pablo Murillo
> >>
> >> On 10/20/2020 4:40 PM, Micah Snyder (micasnyd) via clamav-users
> >> wrote:
> >> > Hi all,
> >> >
> >> > It seems as though the new PNG graphics format/CVE checker
> >> added in 0.103 is causing trouble for you and for some others. We
> >> will disable it for now, which we can do with an update to the daily
> >> database.
> >> >
> >> > Pablo, if you're allowed to share some of the PNG files with
> >> me that caused issues for you, the samples will help us find the bug
> >> in the PNG parser.
> >> >
> >> > Regards,
> >> > Micah
> >> >
> >> >
> >> > Micah Snyder
> >> > ClamAV Development
> >> > Talos
> >> > Cisco Systems, Inc.
> >> >
> >> >
> >> >
> >> > On 10/19/20, 11:26 AM, "clamav-users on behalf of Pablo
> >> Murillo" <clamav-users-bounces at lists.clamav.net on behalf of
> >> info at pablomurillo.com.ar> wrote:
> >> >
> >> > Hi
> >> >
> >> > I started seeing the error [
> >> > 451_mail_server_temporarily_rejected_message ] on
> >> maillog, and looking
> >> > in the clamd.log I found a lot of lines like this [
> >> /*/*/*/*.png: Can't
> >> > parse data ERROR ]
> >> > I added on clamd.conf the next line
> >> >
> >> > ExcludePath ^\.png$
> >> >
> >> > But clamd is still sending the error
> >> > Is there a way to avoid this ?
> >> > Any mail qith a PNG file is rejected by clamd
> >> >
> >> > My config
> >> > FreeBSD 11.3-RELEASE-p13
> >> > qmail (with a lot ot patches)
> >> > SpamDyke 5.0.1
> >> > ClamAV 0.103.0
> >> >
> >> > Thanks
> >> >
> >> >
> >> > --
> >> > This email has been checked for viruses by AVG.
> >> > https://www.avg.com
> >> >
> >> >
> >> > _______________________________________________
> >> >
> >> > clamav-users mailing list
> >> > clamav-users at lists.clamav.net
> >> > https://lists.clamav.net/mailman/listinfo/clamav-users
> >> >
> >> >
> >> > Help us build a comprehensive ClamAV guide:
> >> > https://github.com/vrtadmin/clamav-faq
> >> >
> >> > http://www.clamav.net/contact.html#ml
> >> >
> >> >
> >> > _______________________________________________
> >> >
> >> > clamav-users mailing list
> >> > clamav-users at lists.clamav.net
> >> > https://lists.clamav.net/mailman/listinfo/clamav-users
> >> >
> >> >
> >> > Help us build a comprehensive ClamAV guide:
> >> > https://github.com/vrtadmin/clamav-faq
> >> >
> >> > http://www.clamav.net/contact.html#ml
> >>
> >>
> >> --
> >> This email has been checked for viruses by AVG.
> >> https://www.avg.com
> >>
> >>
> >> _______________________________________________
> >>
> >> clamav-users mailing list
> >> clamav-users at lists.clamav.net
> >> https://lists.clamav.net/mailman/listinfo/clamav-users
> >>
> >>
> >> Help us build a comprehensive ClamAV guide:
> >> https://github.com/vrtadmin/clamav-faq
> >>
> >> http://www.clamav.net/contact.html#ml
> >
>
> --
> This email has been checked for viruses by AVG.
> https://www.avg.com
>
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
>
>
> _______________________________________________
>
> clamav-users mailing list
> clamav-users at lists.clamav.net
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/vrtadmin/clamav-faq
>
> http://www.clamav.net/contact.html#ml
--
This email has been checked for viruses by AVG.
https://www.avg.com
_______________________________________________
clamav-users mailing list
clamav-users at lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users
Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq
http://www.clamav.net/contact.html#ml
More information about the clamav-users
mailing list