[clamav-users] recently noted that scanning firefox browser cache reports many errors

mum laris mum_laris at hotmail.com
Sat Oct 10 12:49:09 UTC 2020


Hi.

On 10/10/20 01:01, G.W. Haywood via clamav-users wrote:
> Hello again,
>
> On Fri, 9 Oct 2020, mum laris via clamav-users wrote:
>
>> gzip -vtl FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F
>>
>> method  crc    date  time compressed uncompressed ...
>> defla 00310064 Oct 6 18:52    435807   1383269888 ...
>
> A 1.4Gbyte file compressed down to 436kbytes?  Seems unlikely.
>
That's why I've decided to inspect it before erasing...

Following what I found.

Starting with gzip:

 > gzip -vt FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F
FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F:
gzip: FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F: decompression OK, 
trailing garbage ignored
  OK


Suspect... extracting with 7zip:

 > 7z e FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F -o/tmp/

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 [...]

Scanning the drive for archives:
1 file, 435807 bytes (426 KiB)

Extracting archive: FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F
--
Path = FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F
Type = gzip
Headers Size = 10

ERROR: There are some data after the end of the payload data : 
FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F~

Sub items Errors: 1

Archives with Errors: 1

Sub items Errors: 1


Then:

 > file /tmp/FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F~
/tmp/FF13A1C7B9A4E5C26BE58596DF7F58E6CCB3F19F~: UTF-8 Unicode text, with 
very long lines


So parsing it, I can see 168 raws, beginning with:

(function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var 
c="function"==typeof require&&require;if(!f&&c)return 
c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module 
'"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var 
p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var 
n=e[i][1][r];return o(n||r)},p,p.exports,r,e,n,t)}return 
n[i].exports}for(var u="function"==typeof 
require&&require,i=0;i<t.length;i++)o(t[i]);return o}return 
r})()({1:[function(require,module,exports){
[...]


And at the end of file:

//# sourceMappingURL=bundle.js.map


How can a js be cached in this way?

Thanks,

M.





More information about the clamav-users mailing list