Bug 845800 - clamscan reports an error but does not tell me about it
clamscan reports an error but does not tell me about it
Product: Fedora
Classification: Fedora
Component: clamav (Show other bugs)
x86_64 Linux
unspecified Severity high
: ---
: ---
Assigned To: Enrico Scholz
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2012-08-05 02:44 EDT by Paul
Modified: 2012-10-12 13:35 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-10-12 13:35:01 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
captured output of clamscan operations (46.78 KB, text/plain)
2012-08-05 02:47 EDT, Paul
no flags Details
the png that triggered the error (9.17 MB, image/png)
2012-08-05 02:49 EDT, Paul
no flags Details

  None (edit)
Description Paul 2012-08-05 02:44:12 EDT
Description of problem:
I do a clamscan and I get no infections but 2 Errors that are not displayed. I am able to find one by brute force, yet I don't see why it is an error

The primary bug is that clamscan should tell me what any errors are

The secondary bug is that I don't understand why it is an error

Version-Release number of selected component (if applicable):
clamav.x86_64 0.97.5-1600.fc16 (running under xfce)

How reproducible:
I captured output of how I saw this

Steps to Reproduce:
1. I run clamscan (see attachments)
2. It shows an error but I can only see it under --debug
Actual results:
an error happens and clamscan doesn't report it, I have to drill through all my files to see what happened under --debug

Expected results:
clamscan should provide output on all errors without having to use verbose or debug

Additional info:
Please let me know if I can provide anything else ... I was only able to isolate one of the two errors as wading through @32K files is difficult (smile)

Attachments will follow once the bug is logged

Thanks for you help in advance,
Comment 1 Paul 2012-08-05 02:47:00 EDT
Created attachment 602335 [details]
captured output of clamscan operations

This is the output from running clamscan with --verbose and then adding --debug. The "error" shows up around line 679.

A copy of the *.png that triggered it is forthcoming
Comment 2 Paul 2012-08-05 02:49:59 EDT
Created attachment 602336 [details]
the png that triggered the error

This is the *.png that triggered the error. I don't think it matters, but I need to warn that I mailed this file as an attachment from my Linux box to my Windows box as I am submitting it on my Windows box. I would be hard pressed to believe that that transfer "changed" the file, but if your tests on it come up clean then please let me know and I am try to send directly from my Linux box

Comment 3 Paul 2012-08-05 16:16:45 EDT
I forgot to add that if I run the clanscan on that file without the '-i' option, I do get the error 'CL_FORMAT: Bad format or broken data ERROR'. However, given the normal scan involves @32K of files to be scanned, it is impractical to have cron jobs use that mode.

I want to amend my bug to errors should be reported whether or not the '-i' pr '--verbose' is used

I also guess I do know what is wrong with the file ... though given that the png displays perfectly well I can't say I can go "its a corrupt file". So I am wanting to change that question to wanting to understand if this really is an error?

Thanks (and apologies for not including in the original post ... a night's sleep helps uncover the tests that weren't initially run),
Comment 4 Jan ONDREJ 2012-08-06 02:32:02 EDT
I had similar problems with clamav, that it can't get clamav database files, but it was not a problem of clamav package, but clamav-unofficial-sigs.

Please, try to look at bug #842180, if it's not your problem. If it's same, please close this bug.
Comment 5 Paul 2012-08-06 02:49:25 EDT

Thanks for the reply.

I took a look at bug #842180 and I don't think it is the same issue. My concern is that an error is happening and I am not getting the necessary information in a meaningful fashion (as in I have to capture a trace of the whole clamscan to find the error ... 2 errors in @32K files).

I consider it an important issue that an error be treated with the same importance as an infected file ... if clamscan detects an error, I want to know what (unless I have elected to tell clamscan to "tell me nothing" in which case I won't know about the 2 errors).

The secondary concern is why a supposedly legit *.png flags an error as it behaves very nicely in all other respects.

If I am not understanding 842180, please correct me.

Comment 6 Paul 2012-10-12 13:30:21 EDT
I just brought up one of my boxes on F17 i686 under Xfce and, when running tests, I noticed that this file is no longer generating an error in clamscan.

I went back to my F16 machine and tested it. Also not seeing an error.

I am not certain what happened and can only assume that something got fixed with being documented in this bug. I'll let you close the bug so you can classify it correctly.

My thanks for getting rid of the error

Note You need to log in before you can comment on or make changes to this bug.