Results 1 to 4 of 4

Thread: clamscan results - file exceeds limits warning

  1. #1

    Default clamscan results - file exceeds limits warning

    Using the scanvirus - clamscan engine -. These 'warnings' are printed unchanged.

    Do I need to scan this file by change the clamscan line? To what value? 1 tb?


    149812LibClamAV Warning: cli_scanxz: decompress file size exceeds limits - only scanning 27262976 bytes


    https://askubuntu.com/questions/6013...les-and-errors

  2. #2
    Join Date
    Apr 2011
    Location
    Texas USA
    Posts
    301

    Default Re: clamscan results - file exceeds limits warning

    Review the man page for clamscan. There is a setting for "--max-filesize=#n". This set the max search size of an extraction from an archived (zip or similar) file. The default limit is 25mb. This limit can be increased on the commandline to 4 gb.

    What was seen and described above is the message resuling from the scan of an archive file that was larger than the default. This can be made larger as previously described.






  3. #3

    Default Re: clamscan results - file exceeds limits warning

    Code:
    nice -n "$CS_Priority" clamscan -r "$CopyVirus" --follow-dir-symlinks=0 --follow-file-symlinks=0 --cross-fs=no --max-filesize=0 --max-scansize=0 "$Mount_Point" | Scan_Results_Filter 1
    This is the typical the new line format. I'm now getting these results.

    Code:
    4439LibClamAV Warning: PNG: Unexpected early end-of-file.
    LibClamAV Warning: PNG: Unexpected early end-of-file.
    LibClamAV Warning: PNG: Unexpected early end-of-file.
    LibClamAV Warning: PNG: Unexpected early end-of-file.
    LibClamAV Warning: PNG: Unexpected early end-of-file.
    LibClamAV Warning: PNG: Unexpected early end-of-file.

  4. #4
    Join Date
    Aug 2010
    Location
    Chicago suburbs
    Posts
    15,476
    Blog Entries
    3

    Default Re: clamscan results - file exceeds limits warning

    Quote Originally Posted by lord_valarian View Post
    149812LibClamAV Warning: cli_scanxz: decompress file size exceeds limits - only scanning 27262976 bytes
    I don't have any experience with this software. However, it is a known "trick" that it is possible to create a small compressed file that expands to something so big that it causes problems. It has been used in denial of service attacks. My guess is that the size checking in clamscan is intended as a protection against this kind of attack.
    openSUSE Leap 15.3; KDE Plasma 5.18.6;

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •