> > We have a customer who sent an email through us that was a > short text body with an Excel spreadsheet attachment. > > The attachment is about 988K and the entire email is about 1.3M. > > For some reason, when ClamAV parses the Excel file, > > it winds up creating about 2300 files and > > taking up about 1.3 *gig* of space. > > What is your MaxScanSize setting? > If it is the default, or below 1.3G then it is a bug. > It should stop extracting as soon as it reaches that limit.
The MaxScanSize setting is the default, which I see is 100M. As a test, I ran it with "--max-scansize=50M" and it only took half the space, so I think it did stop when it it the limit. > > Running debug, it says it thinks it "Matched signature for > file type CAB-SFX at 35233". Why would it think an Excel file > is a cab file? > > Because it matched the CAB-SFX signature (MSCF): > "1:*:4d534346:CAB-SFX:CL_TYPE_ANY:CL_TYPE_CABSFX" > > However if this is a false match and not a real CAB, it should detect > that, and extract nothing. > > Please open a bug and attach the file. I'll do so as soon as we get permission from the customer. > Best regards, > --Edwin > _______________________________________________ > Help us build a comprehensive ClamAV guide: visit > http://wiki.clamav.net > http://www.clamav.net/support/ml > > _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
