Hi,

Sorry for the flood...
I have made the same tests using clamdscan and I have discovered that the error happens with multi threads (the same command I'm sending)

This is the result for the command:

clamdscan.exe --multiscan C:\users\jorge


:\Users\jorge\Printer\SPL\amd64\itdrvsc.dll: Can't allocate memory ERROR
calloc_problemLibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
: Not enough space
C:\Users\jorge\Printer\SPL\amd64\itdrvua.dll: Can't allocate memory ERROR
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
calloc_problemC:\Users\jorge\Printer\SPL\amd64\itdrvuc.dll: Can't allocate memory ERROR
: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
calloc_problem: LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
calloc_problemC:\Users\jorge\Printer\SPL\amd64\itdrvum.dll: Can't allocate memory ERROR
: LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigcnt[0]
Not enough space
calloc_problem: Not enough spaceLibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).

C:\Users\jorge\Printer\SPL\amd64\sbuysupplies.exe: Can't allocate memory ERROR
calloc_problemLibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
: Not enough space
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigcnt[0]
LibClamAV Error: cli_calloc(): Can't allocate memory (65025792 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Users\jorge\Printer\SPL\amd64\coinst.dll: Can't allocate memory ERROR
C:\Users\jorge\Printer\SPL\amd64\itdrvur.dll: Can't allocate memory ERROR
C:\Users\jorge\Saved Games\desktop.ini: OK
C:\Users\jorge\Searches\desktop.ini: OK
C:\Users\jorge\Searches\Everywhere.search-ms: OK
C:\Users\jorge\Searches\Indexed Locations.search-ms: OK
C:\Users\jorge\Searches\Microsoft Outlook.searchconnector-ms: OK
C:\Users\jorge\Searches\winrt--{S-1-5-21-2369677467-393392422-2501058989-1001}-.searchconnector-ms: OK

The same scan, without multiscan, runs ok:

clamdscan.exe  C:\users\jorge

C:\Users\jorge\Printer\SPL\amd64\sbuysupplies.exe: OK
C:\Users\jorge\Printer\SPL\amd64\coinst.dll: OK
C:\Users\jorge\Saved Games\desktop.ini: OK
C:\Users\jorge\Searches\desktop.ini: OK
C:\Users\jorge\Searches\Everywhere.search-ms: OK
C:\Users\jorge\Searches\Indexed Locations.search-ms: OK
C:\Users\jorge\Searches\Microsoft Outlook.searchconnector-ms: OK
C:\Users\jorge\Searches\winrt--{S-1-5-21-2369677467-393392422-2501058989-1001}-.searchconnector-ms: OK

So, this is related to multithread scan.

Thanks,

Jorge


El lun, 12 dic 2022 a las 20:05, Andy Ragusa (aragusa) via clamav-users (<clamav-users@lists.clamav.net>) escribió:
That is not a normal error condition, unless you are out of memory or something like that.  I tried making calloc fail on that condition, but that didn't work for me.  

So if you scan just that archive AnticrapManager.exe by itself, you also see this?  



From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Jorge Elissalde via clamav-users <clamav-users@lists.clamav.net>
Sent: Saturday, December 10, 2022 8:08 AM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Jorge Elissalde <elissalde.j.e@gmail.com>
Subject: Re: [clamav-users] Memory Allocation error, clamd stop running
 
Hi,

Thank you for your time and tests.
If I turn off the ScanArchive switch clamd doesn't crash.
Maybe I have some unusual file there, I'm going to make more tests.
In any case I have several lines like these:

calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65020160 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Anticrap upload\AnticrapManager.exe: Can't allocate memory ERROR
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65020160 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Anticrap upload\ChromeSetup.exe: Can't allocate memory ERROR

The error happens with any file, several times during a normal scanning in any folder.
Is that a normal error reporting?

Thanks you

Jorge




El vie, 9 dic 2022 a las 18:08, Andy Ragusa (aragusa) via clamav-users (<clamav-users@lists.clamav.net>) escribió:
Hi Jorge,

I have attempted to reproduce the issue and haven't had any luck.  Here is what I tried, please let me know what I could be doing wrong.
  1.  Downloaded the prebuilt clamav-1.0.0.win.x64.zip
  2. clamd.exe --log=<log path>
  3. clamdscan --log=<log path> --multiscan <folder>
the scan folder had 23k files.

I then tried separating the files into multiple folders, and passing all the folders into clamdscan
  1. clamdscan --log=<log> --multiscan <folder 1> <folder2> ...
Neither of these were able to reproduce the behavior you are seeing.  Can you tell me a little more about your particular configuration, and what else I can try to reproduce this?

Thanks,
Andy 


From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Jorge Elissalde via clamav-users <clamav-users@lists.clamav.net>
Sent: Thursday, December 8, 2022 6:20 AM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Jorge Elissalde <elissalde.j.e@gmail.com>
Subject: Re: [clamav-users] Memory Allocation error, clamd stop running
 
Hi,

This is a very frequent error in the log:

LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Windows\SysWOW64\odbcad32.exe: Can't allocate memory ERROR
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
calloc_problem: Not enough space
LibClamAV Error: cli_calloc(): Can't allocate memory (65013504 bytes).
LibClamAV Error: cli_ac_init: Can't allocate memory for data->lsigsuboff_(last|first)[0]
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe: Can't allocate memory ERROR

Thanks,

Jorge


El mié, 7 dic 2022 a las 18:43, Andy Ragusa (aragusa) via clamav-users (<clamav-users@lists.clamav.net>) escribió:
Hi Jorge,

Is it a particular file that is being scanned when this happens?  

Could you please send clamd's logs to help determine what is going on?

Thanks,
Andy

From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Jorge Elissalde via clamav-users <clamav-users@lists.clamav.net>
Sent: Wednesday, December 7, 2022 3:41 PM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Jorge Elissalde <elissalde.j.e@gmail.com>
Subject: [clamav-users] Memory Allocation error, clamd stop running
 
Hi,

I'm using the latest Windows Clamav version (1.0.0).
I'm connected to clamd and I request a folder scan having 94,249 files, 10GB total.
The command I send is MULTISCAN [folder].
When scanner is over 9,075 files it stops working and the message is:

memory allocation of 1048576 bytes failed

Clamd stop running.
I'm running with next relevant settings in clamd.conf:

MaxThreads 6
ScanArchive yes
MaxScanSize 20M
MaxFileSize 10M
MaxFiles 150
MaxRecursion 10

The same test with the older 0.105 Clamav version works without trouble using the same parameters.
What could be happening there?
Thank you

Jorge


_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat