On 2014/05/12 14:57, Steve Basford wrote: > > On Mon, May 12, 2014 2:12 pm, Stuart Henderson wrote: > > I'm running clamav on OpenBSD/amd64 5.5 (with various sanesecurity > > hdb's, if that matters). Built from ports (with LLVM 3.3). > > Hi, > > Is is random or only on a certain email? > > Do have a full copy of the email shown in your log? > If you do, does a clamdscan on the email cause a crash?
I've isolated a certain email which seems particularly likely to trigger it, but it doesn't happen every time for that message. >From the last few attempts running clamdscan in a loop, it took approx 100, 10, 300, 130 attempts to hit the crash. It also happens for clamscan (I removed all standard db's and included only the single signature triggered by this mail so it would start quickly). I have only hit this crash if a signature is matched (i.e. I haven't hit it if I remove phish.ndb). Here's a backtrace from clamscan built with -O0, I can provide message/sig to attempt to reproduce off-list. (gdb) bt full #0 0x000008617687540b in boundaryEnd (line=0x8616bbebd81 " ", boundary=0x8616ad88b60 "----------9305594F5ADCAB39") at mbox.c:2273 len = 26 newline = 0x86169a74000 "" p = 0x86169a74000 "" p2 = 0x86169a73fff <Address 0x86169a73fff out of bounds> #1 0x0000086176873baa in parseEmailBody (messageIn=0x861753cd980, textIn=0x0, mctx=0x7f7ffffc31a0, recursion_level=0) at mbox.c:1494 line = 0x8616bbebd81 " " lines = 4 m = (message **) 0x8616bbeb890 old_rc = FAIL subtype = 5 htmltextPart = 0 inMimeHead = 0 mimeSubtype = 0x8616bbeb000 "mixed" boundary = 0x8616ad88b60 "----------9305594F5ADCAB39" aMessage = (message *) 0x86169a75080 mimeType = MULTIPART inhead = 0 i = 0 t_line = (const text *) 0x8616bbeb270 multiparts = 0 messages = (message **) 0x8616bbeb890 rc = OK aText = (text *) 0x0 mainMessage = (message *) 0x861753cd980 fb = (fileblob *) 0x0 infected = false engine = (const struct cl_engine *) 0x8617164e800 doPhishingScan = 1 #2 0x0000086176871e35 in cli_parse_mbox ( dir=0x8616fe80d80 "/tmp//clamav-d32876238e1c0847f3ed68257ceb49c6.tmp", ctx=0x7f7ffffc39e0) at mbox.c:508 retcode = 0 body = (message *) 0x861753cd980 buffer = "Return-Path: <>\n\000\000c6", '\0' <repeats 20 times>, "÷V.\230\215íÐI\000\000\000\000\000\000\000\000^\016èoa\b\000\000\2205üÿ\177\177\000\000\236dµva\b\000\000\002", '\0' <repeats 23 times>, "ÃñÖha\b", '\0' <repeats 14 times>, "a\b\000\000\000\000\000\000\000\000\000\000÷V.\230\215íÐI\000\000\000\000\000\000\000\000\200\rèoa\b\000\0002\000\000\000\000\000\000\000âdµva\b\000\000\002", '\0' <repeats 23 times>, "d¥Ùha\b", '\0' <repeats 290 times>, "ÿÿÿÿ\000\000\000\000p2üÿ\177\177\000\000±\rèoa\b\000\000"... mctx = { dir = 0x8616fe80d80 "/tmp//clamav-d32876238e1c0847f3ed68257ceb49c6.tmp", rfc821Table = 0x8616ad986e0, subtypeTable = 0x8616ad88080, ctx = 0x7f7ffffc39e0, files = 0} at = 21404 map = (fmap_t *) 0x8616796b000 #3 0x0000086176871845 in cli_mbox ( dir=0x8616fe80d80 "/tmp//clamav-d32876238e1c0847f3ed68257ceb49c6.tmp", ctx=0x7f7ffffc39e0) at mbox.c:309 No locals. #4 0x0000086176866520 in cli_scanmail (ctx=0x7f7ffffc39e0) at scanners.c:1804 dir = 0x8616fe80d80 "/tmp//clamav-d32876238e1c0847f3ed68257ceb49c6.tmp" ret = 2145 viruses_found = 0 #5 0x000008617686a49c in magic_scandesc (ctx=0x7f7ffffc39e0, type=CL_TYPE_MAIL) at scanners.c:2697 ret = 0 dettype = CL_TYPE_ANY typercg = 1 '\001' current_container_type = CL_TYPE_ANY current_container_size = 0 hashed_size = 21404 hash = "uÒ\000\000Qÿ·/\005|ÝÅgB§Æ" old_hook_lsig_matches = (bitset_t *) 0x8616bbeb780 filetype = 0x86176b1bf94 "CL_TYPE_MAIL" cache_clean = 0 res = 1 #6 0x000008617686c178 in cli_base_scandesc (desc=3, ctx=0x7f7ffffc39e0, type=CL_TYPE_ANY) at scanners.c:3007 sb = {st_mode = 33184, st_dev = 9985, st_ino = 45975, st_nlink = 1, st_uid = 1000, st_gid = 0, st_rdev = -1, st_atim = {tv_sec = 1399905336, tv_nsec = 495715245}, st_mtim = {tv_sec = 1399904591, tv_nsec = 62550638}, st_ctim = {tv_sec = 1399904591, tv_nsec = 62555667}, st_size = 21404, st_blocks = 48, st_blksize = 4096, st_flags = 0, st_gen = 0, __st_birthtim = {tv_sec = 0, tv_nsec = 0}} ret = 32639 #7 0x000008617686c1fa in cli_magic_scandesc (desc=3, ctx=0x7f7ffffc39e0) at scanners.c:3016 No locals. #8 0x000008617686cbf6 in scan_common (desc=3, map=0x0, virname=0x7f7ffffc3c58, scanned=0x85f672275d8, engine=0x8617164e800, ---Type <return> to continue, or q <return> to quit--- scanoptions=4219447, context=0x7f7ffffc3c30) at scanners.c:3233 ctx = {virname = 0x7f7ffffc3c58, num_viruses = 0, size_viruses = 0, scanned = 0x85f672275d8, root = 0x0, engine = 0x8617164e800, scansize = 21404, options = 4219447, recursion = 1, scannedfiles = 1, found_possibly_unwanted = 0, corrupted_input = 0, img_validate = 0, container_type = CL_TYPE_MAIL, container_size = 21404, handlertype_hash = '\0' <repeats 15 times>, dconf = 0x8616f0fe3b8, fmap = 0x86169502b08, hook_lsig_matches = 0x8616bbebe70, cb_ctx = 0x7f7ffffc3c30, perf = 0x0} rc = 0 sb = {st_mode = 33184, st_dev = 9985, st_ino = 45975, st_nlink = 1, st_uid = 1000, st_gid = 0, st_rdev = -1, st_atim = {tv_sec = 1399905336, tv_nsec = 495715245}, st_mtim = {tv_sec = 1399904591, tv_nsec = 62550638}, st_ctim = {tv_sec = 1399904591, tv_nsec = 62555667}, st_size = 21404, st_blocks = 48, st_blksize = 4096, st_flags = 0, st_gen = 0, __st_birthtim = {tv_sec = 0, tv_nsec = 0}} #9 0x000008617686cd10 in cl_scandesc_callback (desc=3, virname=0x7f7ffffc3c58, scanned=0x85f672275d8, engine=0x8617164e800, scanoptions=4219447, context=0x7f7ffffc3c30) at scanners.c:3252 No locals. #10 0x0000085f66e123ad in scanfile (filename=0x8616bbebdd0 "test", engine=0x8617164e800, opts=0x8616afdcc80, options=4219447) at manager.c:303 ret = 0 fd = 3 included = 2145 i = 1895541136 opt = (const struct optstruct *) 0x8616afdc480 virname = 0x86170fba120 "" virpp = (const char **) 0x7f7ffffc3c58 sb = {st_mode = 33184, st_dev = 9985, st_ino = 45975, st_nlink = 1, st_uid = 1000, st_gid = 0, st_rdev = -1, st_atim = {tv_sec = 1399905336, tv_nsec = 495715245}, st_mtim = {tv_sec = 1399904591, tv_nsec = 62550638}, st_ctim = {tv_sec = 1399904591, tv_nsec = 62555667}, st_size = 21404, st_blocks = 48, st_blksize = 4096, st_flags = 0, st_gen = 0, __st_birthtim = {tv_sec = 0, tv_nsec = 0}} chain = {chains = 0x0, lastadd = 0, lastvir = 0, level = 0, n = 0} #11 0x0000085f66e14c23 in scanmanager (opts=0x8616afdcc80) at manager.c:1005 ret = 0 i = 3 options = 4219447 dboptions = 8202 dirlnk = 1 filelnk = 1 engine = (struct cl_engine *) 0x8617164e800 sb = {st_mode = 33184, st_dev = 9985, st_ino = 45975, st_nlink = 1, st_uid = 1000, st_gid = 0, st_rdev = -1, st_atim = {tv_sec = 1399905336, tv_nsec = 495715245}, st_mtim = {tv_sec = 1399904591, tv_nsec = 62550638}, st_ctim = {tv_sec = 1399904591, tv_nsec = 62555667}, st_size = 21404, st_blocks = 48, st_blksize = 4096, st_flags = 0, st_gen = 0, __st_birthtim = {tv_sec = 0, tv_nsec = 0}} file = 0x8616bbebdd0 "test" cwd = "h£ûpa\b\000\000ð£\232ta\b\000\000h08qa\b\000\000\000\000\000\000\000\000\000\000Çd¡\a\000\000\000\0000\000\000\000\000\000\000\000h£ûpa\b\000\000ð£\232ta\b\000\000\177A@pa\b\000\000Ø>üÿ\177\177\000\000h£ûpa\b\000\000Ø>üÿ\177\177\000\000à>üÿ\177\177\000\000\000\000\000\000\000\000\000\0000?üÿ\177\177\000\000Xç¼ra\b\000\000h08qa\b", '\0' <repeats 11 times>, "@üÿ\177\177\000\000 Û[ta\b\000\000h£ûpa\b\000\000ð£\232ta\b\000\0000?üÿ\177\177\000\000f\037Ôra\b\000\000\000@üÿ\177\177\000\000 "... pua_cats = 0x0 filename = 0x8616bbebc10 "test" opt = (const struct optstruct *) 0x861753cde00 rlim = {rlim_cur = 9223372036854775807, rlim_max = 9223372036854775807} #12 0x0000085f66e10e4c in main (argc=2, argv=0x7f7ffffc43d8) at clamscan.c:166 ds = 0 dms = 2 ret = 32639 mb = 6.9261942496159218e-310 rmb = 6.9261942496182933e-310 t1 = {tv_sec = 1399905336, tv_usec = 624304} t2 = {tv_sec = 9212704849920, tv_usec = 0} sigset = 16777216 opts = (struct optstruct *) 0x8616afdcc80 opt = (const struct optstruct *) 0x86175d39a80 _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/support/ml