[clamav-users] Memory Allocation error, clamd stop running

Tue Dec 13 08:14:46 UTC 2022

Hi,

The error happens for any file in a "massive" scan.
This is part of the log scanning of the folder: C:\Program Files (x86):

C:\Program Files (x86)\Microsoft Visual Studio
14.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\x64\TE.ProcessHost.Managed.Clr20.exe:
OK
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\x86\MinTe\TE.ProcessHost.exe: *Can't allocate
memory ERROR*
C:\Program Files (x86)\Microsoft Visual Studio
14.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\TE.ProcessHost.Managed.exe:
OK
C:\Program Files (x86)\Microsoft Visual Studio
14.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\TE.ProcessHost.Managed.Clr20.exe:
OK
C:\Program Files (x86)\Microsoft Visual Studio
14.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\x64\TE.ProcessHost.Managed.exe:
OK
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\MinTe\TE.ProcessHost.UAP.exe: *Can't allocate
memory ERROR*
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\TE.ProcessHost.UAP.exe: *Can't allocate
memory ERROR*
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\arm64\MinTe\TE.ProcessHost.UAP.exe: Can't
allocate memory ERROR
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\x64\MinTe\TE.ProcessHost.UAP.exe: Can't
allocate memory ERROR
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\x86\TE.ProcessHost.UAP.exe: Can't allocate
memory ERROR
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\x86\MinTe\TE.ProcessHost.UAP.exe: Can't
allocate memory ERROR
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\arm\MinTe\TE.ProcessHost.UAP.exe: Can't
allocate memory ERROR
C:\Program Files (x86)\Windows
Kits\10\Testing\Runtimes\TAEF\x64\TE.ProcessHost.UAP.exe: Can't allocate
memory ERROR
C:\Program Files (x86)\TeamViewer\TeamViewer_Note.exe: Can't allocate
memory ERROR
C:\OrCAD\OrCAD_10.5\tools\pcb\bin\techfile13.exe: Can't allocate memory
ERROR
C:\OrCAD\OrCAD_10.5\tools\pcb\bin\techfile14.exe: Can't allocate memory
ERROR
C:\Program Files (x86)\Microsoft Visual
Studio\2017\Professional\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team
Explorer\Git\usr\bin\test.exe: Can't allocate memory ERROR
C:\Program Files\Git\usr\bin\tee.exe: Can't allocate memory ERROR
C:\Program Files\Common Files\microsoft shared\Team Foundation
Server\12.0\LabManagement\TestAgentInstaller.exe: OK
C:\Program Files\Git\usr\bin\test.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Microsoft Visual Studio
14.0\Common7\IDE\TestAgentConfig.exe: OK
C:\Program Files\dotnet\sdk\2.1.526\TestHost\testhost.exe: Can't allocate
memory ERROR
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TShell\TShell\TaskActionHandlers\TestMetadataTool.exe:
OK

An individual scan of any of these files runs ok.
I copied one of this files to a "testfolder" folder and started a scan, and
everything goes ok:

Listening daemon: PID: 20796
MaxQueue set to: 512
C:\testfolder\TE.ProcessHost.exe: OK

The same happens for any scan of a folder:

LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigcnt[0]
C:\inetpub\wwwroot\license\bin\License Generator.dll: Can't allocate memory
ERROR
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigcnt[0]
C:\inetpub\wwwroot\license\bin\log4net.dll: Can't allocate memory ERROR
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigcnt[0]
C:\inetpub\wwwroot\license\bin\MiToken.ActiveDirectory.Library.dll: Can't
allocate memory ERROR
C:\inetpub\wwwroot\license\bin\!!License Generator.dll.config: OK

In other tests, a scanning of my own folder (c:\users\jorge) suddenly stops:

C:\Users\jorge\OneDrive\20180302_095721.jpg: OK
C:\Users\jorge\Pictures\Cumple\Cumple\DSCN1170.JPG: OK
C:\Users\jorge\OneDrive\20180302_095738.jpg: OK
*memory allocation of 47775744 bytes failed*

...and clamd stops.

I'm testing using clamd -F command, not running as a service, just to get
the log dump in the console screen.
The connection is performed from my own application and the command sent to
the clamd socket is:

nMULTISCAN C:\Program Files (x86)\n

or

nMULTISCAN c:\users\jorge\n

The machine I'm using for testing has 32GBytes, and only 29% is in use.
Clamav uses 1GB.

[image: image.png]

Thank you

Jorge

El lun, 12 dic 2022 a las 20:05, Andy Ragusa (aragusa) via clamav-users (<
clamav-users at lists.clamav.net>) escribió:

> That is not a normal error condition, unless you are out of memory or
> something like that.  I tried making calloc fail on that condition, but
> that didn't work for me.
>
> So if you scan just that archive AnticrapManager.exe by itself, you also
> see this?
>
>
> ------------------------------
> *From:* clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of
> Jorge Elissalde via clamav-users <clamav-users at lists.clamav.net>
> *Sent:* Saturday, December 10, 2022 8:08 AM
> *To:* ClamAV users ML <clamav-users at lists.clamav.net>
> *Cc:* Jorge Elissalde <elissalde.j.e at gmail.com>
> *Subject:* Re: [clamav-users] Memory Allocation error, clamd stop running
>
> Hi,
>
> Thank you for your time and tests.
> If I turn off the ScanArchive switch clamd doesn't crash.
> Maybe I have some unusual file there, I'm going to make more tests.
> In any case I have several lines like these:
>
> calloc_problem: Not enough space
> LibClamAV Error: cli_calloc(): Can't allocate memory (65020160 bytes).
> LibClamAV Error: cli_ac_init: Can't allocate memory for
> data->lsigsuboff_(last|first)[0]
> C:\Anticrap upload\AnticrapManager.exe: Can't allocate memory ERROR
> calloc_problem: Not enough space
> LibClamAV Error: cli_calloc(): Can't allocate memory (65020160 bytes).
> LibClamAV Error: cli_ac_init: Can't allocate memory for
> data->lsigsuboff_(last|first)[0]
> C:\Anticrap upload\ChromeSetup.exe: Can't allocate memory ERROR
>
> The error happens with any file, several times during a normal scanning in
> any folder.
> Is that a normal error reporting?
>
> Thanks you
>
> Jorge
>
>
>
>
> El vie, 9 dic 2022 a las 18:08, Andy Ragusa (aragusa) via clamav-users (<
> clamav-users at lists.clamav.net>) escribió:
>
> Hi Jorge,
>
> I have attempted to reproduce the issue and haven't had any luck.  Here is
> what I tried, please let me know what I could be doing wrong.
>
>    1.  Downloaded the prebuilt clamav-1.0.0.win.x64.zip
>    2. clamd.exe --log=<log path>
>    3. clamdscan --log=<log path> --multiscan <folder>
>
> the scan folder had 23k files.
>
> I then tried separating the files into multiple folders, and passing all
> the folders into clamdscan
>
>    1. clamdscan --log=<log> --multiscan <folder 1> <folder2> ...
>
> Neither of these were able to reproduce the behavior you are seeing.  Can
> you tell me a little more about your particular configuration, and what
> else I can try to reproduce this?
>
> Thanks,
> Andy
>
> ------------------------------
> *From:* clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of
> Jorge Elissalde via clamav-users <clamav-users at lists.clamav.net>
> *Sent:* Thursday, December 8, 2022 6:20 AM
> *To:* ClamAV users ML <clamav-users at lists.clamav.net>
> *Cc:* Jorge Elissalde <elissalde.j.e at gmail.com>
> *Subject:* Re: [clamav-users] Memory Allocation error, clamd stop running
>
> Hi,
>
> This is a very frequent error in the log:
>
> LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
> LibClamAV Error: cli_ac_init: Can't allocate memory for
> data->lsigsuboff_(last|first)[0]
> C:\Windows\SysWOW64\odbcad32.exe: Can't allocate memory ERROR
> calloc_problem: Not enough space
> LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
> calloc_problem: Not enough space
> LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
> LibClamAV Error: cli_ac_init: Can't allocate memory for
> data->lsigsuboff_(last|first)[0]
> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe: Can't
> allocate memory ERROR
>
> Thanks,
>
> Jorge
>
>
> El mié, 7 dic 2022 a las 18:43, Andy Ragusa (aragusa) via clamav-users (<
> clamav-users at lists.clamav.net>) escribió:
>
> Hi Jorge,
>
> Is it a particular file that is being scanned when this happens?
>
> Could you please send clamd's logs to help determine what is going on?
>
> Thanks,
> Andy
> ------------------------------
> *From:* clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of
> Jorge Elissalde via clamav-users <clamav-users at lists.clamav.net>
> *Sent:* Wednesday, December 7, 2022 3:41 PM
> *To:* ClamAV users ML <clamav-users at lists.clamav.net>
> *Cc:* Jorge Elissalde <elissalde.j.e at gmail.com>
> *Subject:* [clamav-users] Memory Allocation error, clamd stop running
>
> Hi,
>
> I'm using the latest Windows Clamav version (1.0.0).
> I'm connected to clamd and I request a folder scan having 94,249 files,
> 10GB total.
> The command I send is MULTISCAN [folder].
> When scanner is over 9,075 files it stops working and the message is:
>
> memory allocation of 1048576 bytes failed
>
> Clamd stop running.
> I'm running with next relevant settings in clamd.conf:
>
> MaxThreads 6
> ScanArchive yes
> MaxScanSize 20M
> MaxFileSize 10M
> MaxFiles 150
> MaxRecursion 10
>
> The same test with the older 0.105 Clamav version works without trouble
> using the same parameters.
> What could be happening there?
> Thank you
>
> Jorge
>
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20221213/08c9df2a/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 42048 bytes
Desc: not available
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20221213/08c9df2a/attachment.png>