search

Cisco-Talos / clamav

ClamAV - Documentation is here: https://docs.clamav.net
https://www.clamav.net/
GNU General Public License v2.0
4.27k stars 692 forks source link

Can't allocate memory ERROR #1271

Closed fangfu closed 4 months ago

fangfu commented 4 months ago

We encountered can't allocate memory error when using clamAV on RHEL8 VMs. The affected files are scanned successfully when uploaded to AWS and scanned with clamAV through aws-cdk construct.

$ clamscan --version ClamAV 0.103.11/27281/Mon May 20 04:24:39 2024

$ clamscan --suppress-ok-results --recursive=yes --scan-archive=yes --verbose --max-filesize=4095M --max-scansize=4095M --bytecode-timeout=300000 --max-scantime=0 /run/media/transfer/NACRDALL/M745XL5128_007/M745XL5128_007.pdf Scanning /run/media/transfer/NACRDALL/M745XL5128_007/M745XL5128_007.pdf LibClamAV Error: cli_malloc(): Attempt to allocate 218111792 bytes. Please report to https://github.com/Cisco-Talos/clamav/issues /run/media/transfer/NACRDALL/M745XL5128_007/M745XL5128_007.pdf: Can't allocate memory ERROR

----------- SCAN SUMMARY ----------- Known viruses: 8693036 Engine version: 0.103.11 Scanned directories: 0 Scanned files: 0 Infected files: 0 Total errors: 1 Data scanned: 223.69 MB Data read: 208.49 MB (ratio 1.07:1) Time: 13.418 sec (0 m 13 s) Start Date: 2024:05:21 16:22:51 End Date: 2024:05:21 16:23:04

The size of the pdf file is 218617746 byte.

Server info: 4.18.0-513.24.1.el8_9.x86_64 #1 SMP Thu Mar 14 14:20:09 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux

micahsnyder commented 4 months ago

@fangfu This is, unfortunately, expected behavior for ClamAV 0.103. We have a hardcoded limit for how much memory may be allocated based on extracted file content.

We improved the error message in later releases and increased that limit to 1GB. But with ClamAV 0.103 this file cannot be scanned.