[clamav-users] Errir parsing PNG files and 451_mail_server_temporarily_rejected_message

[G.W. Haywood]

Hi there,

On Mon, 19 Oct 2020, Pablo Murillo wrote:

> I started seeing the error [ 451_mail_server_temporarily_rejected_message ] 
> on maillog, and

Can you tell us if the time these messages started to appear coincided
with anything that you did to the system, such as upgrades, installing
new software, etc.?

> looking in the clamd.log I found a lot of lines like this [ /*/*/*/*.png: Can't parse data ERROR ]

Unfortunately that message doesn't say much about where in the code
the error occurs, the function which prints it is just a generic
translation of an error code to a text string.  If you enable debug
logging in clamd and debug messages in libclamav it should tell us a
bit more.  All you need to do is add the lines

LogVerbose yes
Debug yes

to your clamd.conf and restart clamd.  (After the problem is solved,
you'll probably want to remove these lines as they can produce a lot
of output.)

> I added on clamd.conf the next line
>
> ExcludePath ^\.png$
>
> But clamd is still sending the error

That works for scanning files in the filesystem, but if you're using
clamd via clamav-milter, which I guess is what you're doing as it's a
mail server error, I don't think that it will work.  It's not an ideal
solution anyway.

> Is there a way to avoid this ?

It seems best to find out why PNG files are longer handled properly.
The debug messages should tell us something.

> My config
> FreeBSD 11.3-RELEASE-p13
> qmail (with a lot ot patches)
> SpamDyke 5.0.1
> ClamAV 0.103.0

I wonder if something might be interfering with the mail before clamd
sees it.  When you get back with more information, could you confirm
that you're using clamav-milter and let us see the clamd configuration
file?  The configuration file is probably called clamd.conf but you'll
need to make sure it's the one that your clamd is using.  It might
help to let us see the clamav-milter configuration too, if that's what
you use to feed the messages to clamd.

-- 

73,
Ged.