Hi Tsutomu, all,

I would like to clarify one thing from this message in regard to our support policy.  ClamAV 0.103 is still supported by LTS, which means we continue to provide patch versions.  ClamAV 0.103.4 is still able to download signatures but is not​ supported for bug fixes.  You should stay up to date with the latest patch version for the 0.103 release, which as of yesterday is 0.103.8. 

If the bug still exists in 0.103.8 (and in this case, it probably does still exist), then we could try to fix it for 1.1 and perhaps 0.103.9.  But even for LTS version we can't promise to backport every bug fix.  We only put a priority on severe bugs.  All other fixes only go into the next feature version, which will be ClamAV 1.1.  I realize that because Rust support for AIX is incomplete, you're effectively stuck on 0.103, so perhaps we should place a priority on backporting these specific issues if we can find and fix them.  But I maybe should also point out that 0.103 LTS end of life is Sep-14 2023, which is just under 7 months out.  That's a little awkward.  I'm not sure what else to say there.


In regard to the specific errors you're seeing, they appear to be when scanning EXE/DLL and JAR files, and appear to be specific to AIX, which I believe is a big-endian system.  I suspect this represents 1 or 2 big endian compatibility bugs. 

I suspect that the EXE/DLL errors may be fixed by this PR: https://github.com/Cisco-Talos/clamav/pull/814  But I can't be sure without setting up a big endian test environment and scanning these files.
I think I found a couple versions of one of these files, through VirusTotal: https://www.virustotal.com/gui/search/name%253Alwiservice.exe
Scanning these on my little endian Linux machine didn't result in an error though, which was expected.

I suspect that the JAR errors may be an endianness issue as well, but someone would need to debug them and find out where the error happens exactly.

You are welcome to create a Github Issue and attach the affected files for investigation, or provide links to them.

Regards,
Micah


Micah Snyder
ClamAV Development
Talos
Cisco Systems, Inc.
From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Tsutomu Oyamada <oyamada@promark-inc.com>
Sent: Thursday, February 9, 2023 5:51 AM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Subject: Re: [clamav-users] about ”Can't allocate memory ERROR”
 
Hi, Andy.

Thanks for your reply.

I am aware that version 0.103.4 is still supported by LTS.
Some of the scan logs for this time are shown below.

[2023-01-12 19:03:11.015] Thu Jan 12 10:23:19 2023 - /esa/bin/lwiservice.exe: Can't allocate memory ERROR
[2023-01-12 19:03:11.015] Thu Jan 12 10:23:19 2023 - /esa/bin/lwiserviceicon.exe: Can't allocate memory ERROR
[2023-01-12 19:03:11.015] Thu Jan 12 10:23:19 2023 - /esa/bin/lwiserviceiconremove.exe: Can't allocate memory ERROR
[2023-01-12 19:03:11.015] Thu Jan 12 10:23:50 2023 - /esa/runtime/core/eclipse/features/com.ibm.lwi.application.feature_8.1.0.3-LWI/installHandler.jar: Can't allocate memory ERROR
[2023-01-12 19:03:11.015] Thu Jan 12 10:25:26 2023 - /esa/runtime/core/eclipse/plugins/com.ibm.rcp.base_6.2.1.20091117-1800/win32/x86/eclipse_1114.dll: Can't allocate memory ERROR
[2023-01-12 19:03:11.015] Thu Jan 12 10:26:22 2023 - /esa/runtime/core/eclipse/plugins/org.eclipse.core.filesystem.win32.x86_1.1.0.v20080604-1400.jar: Can't allocate memory ERROR
[2023-01-12 19:03:11.015] Thu Jan 12 10:26:23 2023 - /esa/runtime/core/eclipse/plugins/org.eclipse.core.resources.win32.x86_3.4.0.v20071204.jar: Can't allocate memory ERROR
[2023-01-12 19:03:11.015] Thu Jan 12 10:26:34 2023 - /esa/runtime/core/eclipse/plugins/org.eclipse.equinox.security.win32.x86_1.0.0.v20080529-1600/jnicrypt.dll: Can't allocate memory ERROR
[2023-01-12 19:03:11.031] Thu Jan 12 10:26:46 2023 - /esa/runtime/core/eclipse/plugins/org.eclipse.update.core.win32_3.2.100.v20080107.jar: Can't allocate memory ERROR
[2023-01-12 19:03:11.031] Thu Jan 12 10:33:08 2023 - /opt/IBM/ibm-java-ppc64-60/docs/launchpad/ScriptLauncher.exe: Can't allocate memory ERROR
[2023-01-12 19:03:11.031] Thu Jan 12 10:33:13 2023 - /opt/IBM/ibm-java-ppc64-60/docs/launchpad.exe: Can't allocate memory ERROR

Nearly 150 other files are in the same state.

Also, my system is AIX. Does that have an effect?
I would like to try it with the latest version.

Thanks,
T.O

On Wed, 1 Feb 2023 21:11:01 +0000
"Andy Ragusa \(aragusa\) via clamav-users" <clamav-users@lists.clamav.net> wrote:

> Hi,
>
> That version is pretty old, have you tried using version 1.0?
>
> When I opened that zip file, I am only seeing the following (no log files)
>
> com.ibm.websphere.LIBERTY.shared_013_all.all_x_8.5.5003.201407301652.zip
> lwiservice.exe
> NativeFile.dll
> org.eclipse.core.filesystem.win32.x86_1.1.0.v20070510.jar
>
> Thanks,
> Andy
>
> ________________________________
> From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Tsutomu Oyamada <oyamada@promark-inc.com>
> Sent: Wednesday, February 1, 2023 8:36 AM
> To: ClamAV users ML <clamav-users@lists.clamav.net>
> Subject: [clamav-users] about ”Can't allocate memory ERROR”
>
> Hi all,
>
> We use the services of clamd to scan files.
> The version of clamd is 0.103.4.
>
> After scanning some files, it will be "Can't allocate memory ERROR". However, with 24GB of memory on the system, there is no possibility of running out of memory. I have tried it on several systems, but I think there may be a problem with clamd because of the same result.
>
> I put the error file at the following URL.
> https://www.uinet.or.jp/~oyamada/error_files.zip
>
> Please tell me how to deal with it other than adding memory.
>
> Best regards
> T.O
>
> _______________________________________________
>
> Manage your clamav-users mailing list subscription / unsubscribe:
> https://lists.clamav.net/mailman/listinfo/clamav-users
>
>
> Help us build a comprehensive ClamAV guide:
> https://github.com/Cisco-Talos/clamav-documentation
>
> https://docs.clamav.net/#mailing-lists-and-chat


_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat