[clamav-users] Memory Allocation error, clamd stop running

Tue Dec 13 08:19:45 UTC 2022

Hi,

Missed from previous email:

The same scannings using *0.105 clamd* runs without issues:

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\cef.pak: OK
C:\Program Files (x86)\Adobe\Acrobat Reader
DC\Reader\acrocef_1\natives_blob.bin: OK
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\libEGL.dll:
OK
C:\Program Files (x86)\Adobe\Acrobat Reader
DC\Reader\acrocef_1\RdrServicesUpdater.exe: OK
C:\Program Files (x86)\Adobe\Acrobat Reader
DC\Reader\acrocef_1\libGLESv2.dll: OK
C:\Program Files (x86)\Adobe\Acrobat Reader
DC\Reader\acrocef_1\snapshot_blob.bin: OK
C:\Program Files (x86)\Adobe\Acrobat Reader
DC\Reader\acrocef_1\locales\en-US.pak: OK
C:\Program Files (x86)\Adobe\Acrobat Reader
DC\Reader\acrocef_1\v8_context_snapshot.bin: OK
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\icudtl.dat:
OK
C:\Program Files (x86)\Adobe\Acrobat Reader
DC\Reader\acrocef_1\chrome_elf.dll: OK

...etc...

The same for any other folders, no issues, no memory errores.
Both clamd running from console (clamd -F), both connected from
applications that only opens a socket connection and send the command
"nMULTISCAN folder".
Thank you

Jorge

El lun, 12 dic 2022 a las 20:05, Andy Ragusa (aragusa) via clamav-users (<
clamav-users at lists.clamav.net>) escribió:

> That is not a normal error condition, unless you are out of memory or
> something like that.  I tried making calloc fail on that condition, but
> that didn't work for me.
>
> So if you scan just that archive AnticrapManager.exe by itself, you also
> see this?
>
>
> ------------------------------
> *From:* clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of
> Jorge Elissalde via clamav-users <clamav-users at lists.clamav.net>
> *Sent:* Saturday, December 10, 2022 8:08 AM
> *To:* ClamAV users ML <clamav-users at lists.clamav.net>
> *Cc:* Jorge Elissalde <elissalde.j.e at gmail.com>
> *Subject:* Re: [clamav-users] Memory Allocation error, clamd stop running
>
> Hi,
>
> Thank you for your time and tests.
> If I turn off the ScanArchive switch clamd doesn't crash.
> Maybe I have some unusual file there, I'm going to make more tests.
> In any case I have several lines like these:
>
> calloc_problem: Not enough space
> LibClamAV Error: cli_calloc(): Can't allocate memory (65020160 bytes).
> LibClamAV Error: cli_ac_init: Can't allocate memory for
> data->lsigsuboff_(last|first)[0]
> C:\Anticrap upload\AnticrapManager.exe: Can't allocate memory ERROR
> calloc_problem: Not enough space
> LibClamAV Error: cli_calloc(): Can't allocate memory (65020160 bytes).
> LibClamAV Error: cli_ac_init: Can't allocate memory for
> data->lsigsuboff_(last|first)[0]
> C:\Anticrap upload\ChromeSetup.exe: Can't allocate memory ERROR
>
> The error happens with any file, several times during a normal scanning in
> any folder.
> Is that a normal error reporting?
>
> Thanks you
>
> Jorge
>
>
>
>
> El vie, 9 dic 2022 a las 18:08, Andy Ragusa (aragusa) via clamav-users (<
> clamav-users at lists.clamav.net>) escribió:
>
> Hi Jorge,
>
> I have attempted to reproduce the issue and haven't had any luck.  Here is
> what I tried, please let me know what I could be doing wrong.
>
>    1.  Downloaded the prebuilt clamav-1.0.0.win.x64.zip
>    2. clamd.exe --log=<log path>
>    3. clamdscan --log=<log path> --multiscan <folder>
>
> the scan folder had 23k files.
>
> I then tried separating the files into multiple folders, and passing all
> the folders into clamdscan
>
>    1. clamdscan --log=<log> --multiscan <folder 1> <folder2> ...
>
> Neither of these were able to reproduce the behavior you are seeing.  Can
> you tell me a little more about your particular configuration, and what
> else I can try to reproduce this?
>
> Thanks,
> Andy
>
> ------------------------------
> *From:* clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of
> Jorge Elissalde via clamav-users <clamav-users at lists.clamav.net>
> *Sent:* Thursday, December 8, 2022 6:20 AM
> *To:* ClamAV users ML <clamav-users at lists.clamav.net>
> *Cc:* Jorge Elissalde <elissalde.j.e at gmail.com>
> *Subject:* Re: [clamav-users] Memory Allocation error, clamd stop running
>
> Hi,
>
> This is a very frequent error in the log:
>
> LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
> LibClamAV Error: cli_ac_init: Can't allocate memory for
> data->lsigsuboff_(last|first)[0]
> C:\Windows\SysWOW64\odbcad32.exe: Can't allocate memory ERROR
> calloc_problem: Not enough space
> LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
> calloc_problem: Not enough space
> LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
> LibClamAV Error: cli_ac_init: Can't allocate memory for
> data->lsigsuboff_(last|first)[0]
> C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe: Can't
> allocate memory ERROR
>
> Thanks,
>
> Jorge
>
>
> El mié, 7 dic 2022 a las 18:43, Andy Ragusa (aragusa) via clamav-users (<
> clamav-users at lists.clamav.net>) escribió:
>
> Hi Jorge,
>
> Is it a particular file that is being scanned when this happens?
>
> Could you please send clamd's logs to help determine what is going on?
>
> Thanks,
> Andy
> ------------------------------
> *From:* clamav-users <clamav-users-bounces at lists.clamav.net> on behalf of
> Jorge Elissalde via clamav-users <clamav-users at lists.clamav.net>
> *Sent:* Wednesday, December 7, 2022 3:41 PM
> *To:* ClamAV users ML <clamav-users at lists.clamav.net>
> *Cc:* Jorge Elissalde <elissalde.j.e at gmail.com>
> *Subject:* [clamav-users] Memory Allocation error, clamd stop running
>
> Hi,
>
> I'm using the latest Windows Clamav version (1.0.0).
> I'm connected to clamd and I request a folder scan having 94,249 files,
> 10GB total.
> The command I send is MULTISCAN [folder].
> When scanner is over 9,075 files it stops working and the message is:
>
> memory allocation of 1048576 bytes failed
>
> Clamd stop running.
> I'm running with next relevant settings in clamd.conf:
>
> MaxThreads 6
> ScanArchive yes
> MaxScanSize 20M
> MaxFileSize 10M
> MaxFiles 150
> MaxRecursion 10
>
> The same test with the older 0.105 Clamav version works without trouble
> using the same parameters.
> What could be happening there?
> Thank you
>
> Jorge
>
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20221213/4b61bcab/attachment.htm>