Bugzilla – Bug 12129
ClamAV can't allocate more than 256MB of memory and fails
Last modified: 2018-07-09 10:15:36 EDT
Hi, I'm using ClamAV 0.100.0 stable on Windows 7 with current databases. Since the upgrade from 0.99.4 I can't perform any scans anymore. I have the clamscan.exe and all the .dll-Files in the directory "C:\bin\" and all signatures in "C:\bin\.clamwin\db". With 0.99.4 the same call works, with 0.100.0 no longer. This is what I'm calling: C:\bin\clamscan.exe --block-encrypted=yes --max-filesize=3000M --max-scansize=3000M --max-files=4294967295 --max-recursion=21474836 --max-dir-recursion=2147483647 -i --database=C:\bin\.clamwin\db --tempdir=C:\temp\ --recursive F: this is the log output: Scanning F:\System Volume Information\WPSettings.dat LibClamAV Error: cli_calloc(): Attempt to allocate 257698056 bytes. Please report to https://bugzilla.clamav.net Scanning F:\System Volume Information\IndexerVolumeGuid LibClamAV Error: cli_calloc(): Attempt to allocate 257698056 bytes. Please report to https://bugzilla.clamav.net Scanning F:\kixinstall.version LibClamAV Error: cli_calloc(): Attempt to allocate 257698056 bytes. Please report to https://bugzilla.clamav.net ...every other file on the USB device F: ----------- SCAN SUMMARY ----------- Known viruses: 6436899 Engine version: 0.100.0 Scanned directories: 31 Scanned files: 0 Infected files: 0 Total errors: 475 Data scanned: 0.00 MB Data read: 3969.60 MB (ratio 0.00:1) Time: 13.822 sec (0 m 13 s) Thanks for any help.
Sorry for the delay in getting back to you. I went to replicate your usage and I see what you're talking about. I slowly removed arguments until I found that it has something to do with the --max-recursion option. The following is enough to throw those errors on my test VM: clamscan.exe --max-recursion=21474836 --recursive C: I haven't attempted to debug any further yet to understand what exactly the cause is or to compare with prior versions.
Just wanted to ask if there was any more progress? Good to see you could reproduce it, did lowering the recursion improve the problem?
I'm sorry to say, I haven't found time to investigate the issue any further. In the small amount of testing I did, I didn't see errors when I wasn't overriding the default maximum with --max-recursion, so perhaps a lower value would work ok. The recursion in this case has to do with how many scanning recursion of files with nested data/sections. The purpose of max-recursion is to prevent possible out-of-memory scenarios.