Hi,

The error happens for any file in a "massive" scan.
This is part of the log scanning of the folder: C:\Program Files (x86):

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\x64\TE.ProcessHost.Managed.Clr20.exe: OK
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\x86\MinTe\TE.ProcessHost.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\TE.ProcessHost.Managed.exe: OK
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\TE.ProcessHost.Managed.Clr20.exe: OK
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\CommonExtensions\Microsoft\TestWindow\x64\TE.ProcessHost.Managed.exe: OK
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\MinTe\TE.ProcessHost.UAP.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\TE.ProcessHost.UAP.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\arm64\MinTe\TE.ProcessHost.UAP.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\x64\MinTe\TE.ProcessHost.UAP.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\x86\TE.ProcessHost.UAP.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\x86\MinTe\TE.ProcessHost.UAP.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\arm\MinTe\TE.ProcessHost.UAP.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\x64\TE.ProcessHost.UAP.exe: Can't allocate memory ERROR
C:\Program Files (x86)\TeamViewer\TeamViewer_Note.exe: Can't allocate memory ERROR
C:\OrCAD\OrCAD_10.5\tools\pcb\bin\techfile13.exe: Can't allocate memory ERROR
C:\OrCAD\OrCAD_10.5\tools\pcb\bin\techfile14.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Git\usr\bin\test.exe: Can't allocate memory ERROR
C:\Program Files\Git\usr\bin\tee.exe: Can't allocate memory ERROR
C:\Program Files\Common Files\microsoft shared\Team Foundation Server\12.0\LabManagement\TestAgentInstaller.exe: OK
C:\Program Files\Git\usr\bin\test.exe: Can't allocate memory ERROR
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\TestAgentConfig.exe: OK
C:\Program Files\dotnet\sdk\2.1.526\TestHost\testhost.exe: Can't allocate memory ERROR
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TShell\TShell\TaskActionHandlers\TestMetadataTool.exe: OK

An individual scan of any of these files runs ok.
I copied one of this files to a "testfolder" folder and started a scan, and everything goes ok:

Listening daemon: PID: 20796
MaxQueue set to: 512
C:\testfolder\TE.ProcessHost.exe: OK

The same happens for any scan of a folder:

LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigcnt[0]
C:\inetpub\wwwroot\license\bin\License Generator.dll: Can't allocate memory ERROR
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigcnt[0]
C:\inetpub\wwwroot\license\bin\log4net.dll: Can't allocate memory ERROR
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigcnt[0]
C:\inetpub\wwwroot\license\bin\MiToken.ActiveDirectory.Library.dll: Can't allocate memory ERROR
C:\inetpub\wwwroot\license\bin\!!License Generator.dll.config: OK

In other tests, a scanning of my own folder (c:\users\jorge) suddenly stops:

C:\Users\jorge\OneDrive\20180302_095721.jpg: OK
C:\Users\jorge\Pictures\Cumple\Cumple\DSCN1170.JPG: OK
C:\Users\jorge\OneDrive\20180302_095738.jpg: OK
memory allocation of 47775744 bytes failed

...and clamd stops.

I'm testing using clamd -F command, not running as a service, just to get the log dump in the console screen.
The connection is performed from my own application and the command sent to the clamd socket is:

nMULTISCAN C:\Program Files (x86)\n

or

nMULTISCAN c:\users\jorge\n

The machine I'm using for testing has 32GBytes, and only 29% is in use.
Clamav uses 1GB.

image.png

Thank you

Jorge


El lun, 12 dic 2022 a las 20:05, Andy Ragusa (aragusa) via clamav-users (<clamav-users@lists.clamav.net>) escribió:
That is not a normal error condition, unless you are out of memory or something like that.  I tried making calloc fail on that condition, but that didn't work for me.  

So if you scan just that archive AnticrapManager.exe by itself, you also see this?  


From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Jorge Elissalde via clamav-users <clamav-users@lists.clamav.net>
Sent: Saturday, December 10, 2022 8:08 AM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Jorge Elissalde <elissalde.j.e@gmail.com>
Subject: Re: [clamav-users] Memory Allocation error, clamd stop running
 
Hi,

Thank you for your time and tests.
If I turn off the ScanArchive switch clamd doesn't crash.
Maybe I have some unusual file there, I'm going to make more tests.
In any case I have several lines like these:

calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65020160 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Anticrap upload\AnticrapManager.exe: Can't allocate memory ERROR
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65020160 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Anticrap upload\ChromeSetup.exe: Can't allocate memory ERROR

The error happens with any file, several times during a normal scanning in any folder.
Is that a normal error reporting?

Thanks you

Jorge




El vie, 9 dic 2022 a las 18:08, Andy Ragusa (aragusa) via clamav-users (<clamav-users@lists.clamav.net>) escribió:
Hi Jorge,

I have attempted to reproduce the issue and haven't had any luck.  Here is what I tried, please let me know what I could be doing wrong.
  1.  Downloaded the prebuilt clamav-1.0.0.win.x64.zip
  2. clamd.exe --log=<log path>
  3. clamdscan --log=<log path> --multiscan <folder>
the scan folder had 23k files.

I then tried separating the files into multiple folders, and passing all the folders into clamdscan
  1. clamdscan --log=<log> --multiscan <folder 1> <folder2> ...
Neither of these were able to reproduce the behavior you are seeing.  Can you tell me a little more about your particular configuration, and what else I can try to reproduce this?

Thanks,
Andy 

From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Jorge Elissalde via clamav-users <clamav-users@lists.clamav.net>
Sent: Thursday, December 8, 2022 6:20 AM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Jorge Elissalde <elissalde.j.e@gmail.com>
Subject: Re: [clamav-users] Memory Allocation error, clamd stop running
 
Hi,

This is a very frequent error in the log:

LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Windows\SysWOW64\odbcad32.exe: Can't allocate memory ERROR
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe: Can't allocate memory ERROR

Thanks,

Jorge


El mié, 7 dic 2022 a las 18:43, Andy Ragusa (aragusa) via clamav-users (<clamav-users@lists.clamav.net>) escribió:
Hi Jorge,

Is it a particular file that is being scanned when this happens?  

Could you please send clamd's logs to help determine what is going on?

Thanks,
Andy
From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Jorge Elissalde via clamav-users <clamav-users@lists.clamav.net>
Sent: Wednesday, December 7, 2022 3:41 PM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Jorge Elissalde <elissalde.j.e@gmail.com>
Subject: [clamav-users] Memory Allocation error, clamd stop running
 
Hi,

I'm using the latest Windows Clamav version (1.0.0).
I'm connected to clamd and I request a folder scan having 94,249 files, 10GB total.
The command I send is MULTISCAN [folder].
When scanner is over 9,075 files it stops working and the message is:

memory allocation of 1048576 bytes failed

Clamd stop running.
I'm running with next relevant settings in clamd.conf:

MaxThreads 6
ScanArchive yes
MaxScanSize 20M
MaxFileSize 10M
MaxFiles 150
MaxRecursion 10

The same test with the older 0.105 Clamav version works without trouble using the same parameters.
What could be happening there?
Thank you

Jorge


_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat