ClamAV

Recent Commits

• Val S. (10 Jul 26)

  Tests: widen PNG decoder Valgrind suppression (#1764) Newer Rust builds may render the Cursor type in the PNG decoder stack as core::io::cursor::Cursor rather than std::io::cursor::Cursor. The existing fuzzy image hash suppression only matched the std::io spelling, so Debian 11 arm64 Valgrind jobs reported a known third-party PNG decoder warning instead of suppressing it. Use a wildcard for the leading module path so the suppression covers both symbol spellings while still requiring the fuzzy_hash_calculate_image stack.

• Val S. (10 Jul 26)

  Tests: Avoid DNS lookup in freshclam mock mirror (#1763) The freshclam tests start a local HTTP server in a child process and wait for a readiness message before running freshclam. On newer macOS runners, the standard HTTPServer startup can stall while resolving the bound loopback address to a fully-qualified name, so the child process never reports readiness and the tests time out before freshclam is exercised. Use a test-only HTTPServer subclass that binds through TCPServer.server_bind() and records the bound address directly. The mock mirror does not need reverse DNS, and avoiding it keeps startup dependent only on the local socket bind.

• Val S. (09 Jul 26)

  Clang-format fixup (#1762) Resolve format issues accidentally introduced with the recent quarantine TOCTOU fixes.

• dependabot[bot] (20 Mar 26)

  Bump the cargo group across 1 directory with 2 updates Bumps the cargo group with 2 updates in the / directory: [tar](https://github.com/alexcrichton/tar-rs) and [bytes](https://github.com/tokio-rs/bytes). Updates `tar` from 0.4.44 to 0.4.45 - [Commits](https://github.com/alexcrichton/tar-rs/compare/0.4.44...0.4.45) Updates `bytes` from 1.10.1 to 1.11.1 - [Release notes](https://github.com/tokio-rs/bytes/releases) - [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md) - [Commits](https://github.com/tokio-rs/bytes/compare/v1.10.1...v1.11.1) --- updated-dependencies: - dependency-name: tar dependency-version: 0.4.45 dependency-type: direct:production dependency-group: cargo - dependency-name: bytes dependency-version: 1.11.1 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <[email protected]>

• Valerie Snyder (06 May 26)

  Harden HFS+ resource bounds checks Compressed HFS+ resource parsing accumulated resource instance counts with int arithmetic before seeking to the selected reference entry. A crafted resource map could overflow the index or produce an unchecked seek target. Track the instance index and reference-entry offset in uint64_t, reject offsets outside the resource fork, and widen catalog key padding before it feeds record bounds checks. CLAM-2989

• Valerie Snyder (06 May 26)

  Fix 32-bit DMG mish size checks DMG mish stripe table validation used size_t arithmetic on 32-bit builds, allowing a crafted stripe count to wrap the required decoded byte count and let a short table reach the stripe walker. Calculate the required table size in uint64_t before comparing it with the decoded buffer length. Keep related DMG range checks in subtraction form and compare stripe sort keys without truncating a 64-bit subtraction. Reported-by: Stanley John Tobias CLAM-2989

• Valerie Snyder (25 Jun 26)

  Fix ALZ parser robustness and scan coverage Fix ALZ parsing and scanning behavior for malformed archives and scan-limit edge cases. The ALZ parser previously mixed archive traversal, metadata callbacks, and extraction in ways that could stop scanning too early or account scan limits inconsistently. A malformed member could prevent already extracted or later members from being scanned, unsupported or malformed entries could bypass metadata checks, and claimed ALZ sizes could steer MaxFiles, MaxFileSize, and MaxScanSize handling away from the behavior used by the normal nested scan path. Refactor ALZ traversal so per-member errors, unsupported entries, directories, and limit decisions are handled intentionally. Metadata scans now use 1-based file positions, preserve hard metadata errors, stop promptly on fatal or timeout conditions, and avoid passing unrepresentable ALZ sizes through the size_t metadata interface. Extraction now preserves decoded output produced before deflate or bzip2 tail errors, validates payload bounds before skipping unsupported entries, applies file-count and size-budget decisions before doing unnecessary decompression, and keeps parser-side budgeting aligned with small buffers that ClamAV does not count as scanned files. Add ALZ regression coverage for malformed headers, partial compressed output, metadata matching, scan-limit accounting, unsupported entries, directory-heavy archives, and small-member edge cases. Also update supporting Rust FFI exports needed by shared-library builds. Credit: Yazdan Soltani CLAM-2988

• Valerie Snyder (25 Jun 26)

  Harden quarantine actions against TOCTOU races Quarantine actions previously validated a source path or destination directory, scanned through that path, and then reopened pathnames later to copy, move, or remove infected files. A local attacker who could replace a source path, symlink, or quarantine directory between those steps could cause ClamAV to copy, move, or delete an object different from the one that produced the detection, or redirect the quarantined output. This change makes quarantine actions operate on objects that were opened and validated before the scan. The shared action_source_t records the user-facing display path, the action path, the scan descriptor, stable file metadata, and Windows handle state. clamscan, clamdscan, clamonacc, clamd, and scanmem pass that source object from scan setup through the quarantine callback so action code does not have to trust mutable pathnames after a detection. On POSIX, destination setup opens and retains the validated quarantine directory, then creates the per-run lock file and destination files relative to that directory. Source opens use no-follow traversal for resolved action paths. Copy reads from the opened scan descriptor. Move is copy plus a verified unlink, and remove captures the final path component into a private directory before deleting it. Device and inode metadata from the scanned file are checked before unlinking. Copy and move revalidate that the configured quarantine path still names the retained destination directory before reporting success. Mismatched private captures are restored only when the platform supports no-replace rename. That conservative behavior avoids hiding a replacement object when a writable directory races the action path. On Windows, destination setup retains an opened directory handle and actions operate through normalized long-path names or retained handles. Move and remove try to keep DELETE access on the scanned source handle; if that access is not available, scanning still proceeds and the action reopens the path at action time, validating the reopened object against the scanned file before deleting. Windows copy preserves alternate data streams, basic file times and attributes, and security metadata where available. File metadata preservation now follows the platform capabilities. Linux copies mode, ownership when permitted, timestamps, and extended attributes from the scanned source. macOS uses fcopyfile() with COPYFILE_ALL. Windows copies named streams, basic metadata, and security descriptors. Metadata failures that are not required for a safe detection do not suppress the detection. The client paths now keep reporting stable for users while separating display paths from action paths. clamd and clamdscan still print the submitted path, but clamd resolves callback paths before opening them so a symlinked parent component cannot change the object scanned after cli_ftw() checks. VirusEvent and quarantine actions receive the resolved scan target. clamdscan and clamonacc use client-opened FILDES or INSTREAM scans when quarantine actions are enabled so clamd does not need to reopen mutable source names. For local quarantine-action directory walks, clamdscan applies clamd CrossFilesystems=no policy to avoid crossing mount points that daemon-side scans would skip. clamdscan --memory applies clamd ExcludePath to each module before direct or packed-module scans. When quarantine actions are enabled, scanmem resolves memory module action sources with the same sharing policy used by action source opens, filters both the submitted module path and resolved path, and uses the resolved path for direct module scanning and quarantine action setup. scanmem avoids caching infected module results while actions are enabled so move or remove can be retried after unload or action failure. The regression coverage exercises destination replacement, source symlink and replacement races, relative source paths, clamdscan scan modes, quarantine lock creation through the validated directory, Windows move and delete behavior, and metadata preservation paths. Reported-by: Hiroki Imai from Ricerca Security, Inc. CLAM-2959

• Val S. (06 Apr 26)

  Libclamav: enforce InstallShield extraction limits A multi-chunk InstallShield payload could bypass the intended file size limits because the extractor checked zlib's per-stream total_out instead of the cumulative bytes written across all chunks. The extraction path also collapsed timeout and maxfiles limit hits to CL_BREAK, and the header parser trusted declared sizes that can be forged to skip scanning a small payload entirely. Fix this by enforcing maxfilesize and maxscansize against the cumulative output written while inflating and by propagating hard-stop limit errors out of is_extract_cab(). Keep the parser preflight, but only use cli_checklimits() for non-size checks before extraction so size decisions are based on actual inflated output instead of attacker-controlled metadata. Thanks to Mizu for reporting this issue. CLAM-2956

• Val S. (04 Apr 26)

  Libclamav: fix 7z substream count overflow A malformed 7z archive can force SzReadSubStreamsInfo() to sum folder substream counts in a UInt32 accumulator until the total wraps. The parser then allocates arrays using the wrapped smaller count and later writes past the end of those buffers while filling substream size metadata. Fix the parser by rejecting archives whose total unpack-stream count would overflow UInt32 before the count is accumulated. This preserves the existing parsing flow while preventing the under-allocation that leads to the heap overflow. Credit: Trail of Bits, in collaboration with Anthropic CLAM-2967

• Val S. (04 Apr 26)

  Libclamav: fix FSG section loop underflow A malformed FSG sample can leave the recovered section count at zero in the v1.31 unpacker path. The code then allocates space for one section entry but initializes recovered RVAs with a loop bound that underflows, causing an out-of-bounds write past the end of the sections array. Fix the loop bound by iterating while t is strictly less than the section count. This preserves the intended behavior for valid nonzero counts and correctly performs zero iterations when no original sections were recovered. Credit: Trail of Bits, in collaboration with Anthropic CLAM-2966

• Val S. (04 Apr 26)

  Libclamav: fix Aspack-triggered rebuild PE overflow A malformed Aspack sample can force cli_rebuildpe_align() to sum rebuilt section sizes in a 32-bit accumulator until the total wraps. The rebuilder then allocates a destination buffer that is too small and later overflows it while copying section contents. Fix the allocation math by summing rebuilt section sizes in a 64-bit temporary and rejecting outputs whose packed section total or final allocation would exceed CLI_MAX_ALLOCATION. This is the correct fix because the later memcpy() assumes the destination size is valid; the real bug is the earlier integer overflow that under-allocates the buffer. Credit: Trail of Bits, in collaboration with Anthropic CLAM-2965

• Val S. (04 Apr 26)

  Libclamav: fix PESpin cleanup bitmap tracking The PESpin unpacker mixes heap-owned section buffers with pointers back into the original PE image. Its final cleanup loop is supposed to walk a copy of the ownership bitmap and free only the entries that were allocated by the unpacker. That loop checked bitmap but shifted bitman instead. When the low bit was set, bitmap never changed and the loop could free every entry in sects, including pointers into the input buffer. A crafted sample can drive this path after an allocation failure and crash in free() with an invalid pointer. Shift bitmap in the cleanup loop so the free decision advances one section at a time using the same working bitmap that the condition already tests. This matches the existing intent of saving bitmap as a disposable free bitmap copy and avoids touching the original bitman state. Credit: Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab. CLAM-2961

• Val S. (01 Jul 26)

  Libclamav: tighten HTML filetype signatures (#1734) Require a tag boundary after built-in <table and <TABLE HTML filetype signatures so OOXML elements such as <tableStyles> do not retype XML content as HTML. Match the ASCII whitespace bytes accepted by htmlnorm's isspace() handling, and add clamscan coverage for the false positive and accepted table tag boundaries. The built-in HTML FTM signatures for iframe, img, object, and script only matched the start of the tag name. That allowed longer XML or custom element names, such as <scriptlet> or <objectId>, to retype otherwise textual content as HTML. This is the same class of false positive fixed for <table>. Require an HTML tag boundary after those tag names using the same byte set used for the table signature: '>', '/', and the ASCII whitespace bytes accepted by htmlnorm. Broaden the clamscan regression to cover the adjacent false-positive prefixes and the accepted real tag boundary forms. Validation: - cmake --build clamav/build-asan-clamscan --target clamscan -j12 - VERSION=test SOURCE=/Users/val/dev/clamav-dev-workspace/clamav BUILD=/Users/val/dev/clamav-dev-workspace/clamav/build-asan-clamscan TMP=/private/tmp CLAMSCAN=/Users/val/dev/clamav-dev-workspace/clamav/build-asan-clamscan/clamscan/clamscan python3 -m pytest -q clamscan/hash_and_file_type_test.py::TC::test_html_file_type_tag_signatures_require_tag_boundary - git -C clamav diff --check CLAM-3007

• Val S. (01 Jul 26)

  Run metadata preclass scans before final verdict (#1721) Metadata preclass bytecodes ran after cli_magic_scan() finalized the layer verdict. Evidence added by those hooks, or by the legacy metadata JSON scan, could miss the root-layer verdict update and clean-cache decision. Move root metadata preclass work into cli_magic_scan() for the root layer, before verdict finalization. Keep final metadata serialization in scan_common(), preserve legacy RootFileType handling, log long JSON strings in chunks, and normalize CL_BREAK from the preclass hook to a successful control result. Run post-scan callbacks only after the metadata preclass work has updated the layer verdict. Reconcile the verdict and status again after callbacks, because either callback API can add evidence or trust the current layer. Derive non-trusted layer verdicts from current evidence so removed indicators do not leave stale non-clean verdicts behind. Gate clean-cache insertion on a successful status so terminal scan errors are not cached as clean. CLAM-2991

• Val S. (30 Jun 26)

  Raise minimum CMake version to 3.17 (#1753) Linux static dependency builds can fail when a package exports private static dependencies as bare -l flags plus interface link directories. In older CMake policy mode, those link directories are not propagated through private dependencies of static libraries, so consumers can lose the directory needed to resolve libraries such as libssh2, OpenSSL, and nghttp2. Possible fixes include forcing the dependency package metadata to avoid pkg-config, adding project-specific link directory workarounds, or using CMake policy CMP0099's newer behavior. Since the oldest supported Linux distributions now provide CMake 3.18 or newer, use CMake 3.17 as the minimum for every platform so CMP0099 is set to NEW by cmake_minimum_required(). CLAM-3015

• metsw24-max (29 Jun 26)

  Libclamav: fix compressed XLM STRING reads (#1735) The compressed STRING record path read from data[6] while using biff_header.length - 3 as the precision. A maximum-length record can therefore read three bytes past the record body and off the end of the BIFF record buffer. For OPC_STRING, the string bytes start at offset 3, after the two-byte character count and one-byte flags field. Read compressed strings from that offset, matching the UTF-16 path, and clamp the printed length to the bytes present so a malformed character count cannot over-read the record.

• Val S. (26 Jun 26)

  Merge pull request #1747 from val-ms/CLAM-2993-hwpml-attribute-uaf Libclamav: copy HWPML callback attributes

• OrbisAI Security (26 Jun 26)

  fix: CVE-2026-41676 security vulnerability (#1733) Automated dependency upgrade by OrbisAI Security

• Val S. (22 Jun 26)

  Improve detection of attachments in malformed email (#1720) Reconstruct the email attachment edge cases reported and add regression fixtures for MIME messages that use comments in header names, ambiguous boundary parameters, RFC2231 disposition fields, trailing boundary whitespace, folded headers, and message/partial reassembly. Harden the mail parser so those messages keep their attachment and boundary metadata during extraction. Normalize commented header names before lookup, choose MIME boundary and disposition values consistently, count folded header data against parser limits, and preserve malformed-but-supported boundary handling. Tighten allocation-failure handling and cleanup in the email text, message, and mbox paths. Replace fragile assert and fall-through cases with explicit error propagation, avoid silent text truncation, centralize mbox cleanup, and fix stale partial-file cleanup so old temporary fragments can be removed safely. Credit: Artem Danilov at Positive Technologies CLAM-2947

• Valerie Snyder (16 Jun 26)

  Libclamav: normalize OOXML attribute iteration Use an explicit MoveToFirstAttribute/MoveToNextAttribute loop when parsing OOXML content-type attributes, then move the reader back to the element before continuing. This keeps the reader position clear and matches the MSXML callback attribute cleanup pattern. CLAM-2994

• Valerie Snyder (16 Jun 26)

  Libclamav: copy OOXML content-type attributes OOXML metadata parsing reads [Content_Types].xml with libxml2. The parser kept pointers returned by xmlTextReaderConstValue() for ContentType and PartName after continuing through the attribute list. libxml2 may reuse or reallocate that reader-owned storage on later reader calls, so those pointers can become stale before they are used for ZIP entry lookup. Copy the attribute values that need to outlive the current reader call and free them when moving to the next Override or leaving the parser. Treat allocation failure as CL_EMEM. We do not believe this to be a security concern based on current evidence. The stale value is only read as a string length/name for metadata-mode OOXML processing, metadata collection is off by default, and a standard non-ASan build did not crash with the supplied sample. Reported by David Pokora and Evan Sultanik of Trail of Bits, working with Anthropic. CLAM-2994

• Valerie Snyder (16 Jun 26)

  Libclamav: copy HWPML callback attributes The MSXML parser stored libxml2 reader-owned attribute name and value pointers for HWPML scan callbacks. The callback runs after the reader has advanced through child nodes, so libxml2 can invalidate that storage before the HWPML callback compares the saved attributes. Copy callback attributes with the non-Const reader APIs and release the owned strings when leaving the element parser. This keeps callback attribute lifetimes independent from the reader state while leaving immediate-use xmlTextReaderConst* paths unchanged. We do not believe this is a security concern. The stale pointer is only read by strcmp() while checking attribute strings; there is no write-after-free, function pointer use, or disclosure path, and a non-sanitized scan did not reproduce a crash. Treat this as a hardening fix rather than a security fix. Reported by David Pokora and Evan Sultanik of Trail of Bits, working with Anthropic. CLAM-2993

• metsw24-max (10 Jun 26)

  fix out-of-bounds access in gpt_scan_partitions name loop (#1736) the name byte-swap loop iterates j over the 36-element array but subscripts gpe.name[i], the outer partition counter. name is the last field of struct gpt_partition_entry, so partition indices >= 36 (reachable with the default 50-partition cap) read and wrote past the end of the on-stack entry. subscript with j instead.

• Val S. (08 Jun 26)

  CLAM-3005: Retire stats submission code (#1732) Remove the legacy ClamAV stats submission implementation that sent telemetry to the discontinued clamintel service. Delete the built-in stats data model, host ID helpers, JSON report generation, HTTP submission helper, and matcher code that gathered PE section metadata only for telemetry reporting. Remove the associated libclamav stats callback API, engine fields and settings, dynamic-config STATS entries, and exported symbols. Bump the libclamav ABI version tuple from the 1.5.x 13:0:1 value to 14:0:0 so the generated soname changes for the incompatible exported-symbol and API removals. Keep the sigtool PE hash generation path working by preserving cli_genhash_pe() for --mdb and --imp without the retired stats-output parameter. Update the generated Rust bindings to match the changed C struct layout and add a NEWS entry for the removed API. The command-line and configuration options for stats submission were removed in earlier releases, so this change cleans up the remaining library-side implementation and ABI surface. CLAM-3005

• Val S. (05 Jun 26)

  Update SECURITY.md (#1687)

• Burak Emir (05 Jun 26)

  feat: Add support for scanning Zstandard (zstd) compressed files (#1700) ClamAV did not previously detect or decompress zstd-compressed files. This adds full support in Rust using the ruzstd crate. A few special cases: - Concatenated frames: the decoder is recreated per frame until the input is exhausted (ruzstd's StreamingDecoder decodes a single frame). - Skippable frames: handled via the SkipFrame header error. - Partial output is always scanned: on decode error, scan-limit hit, or even a decoder panic (caught so it cannot unwind across the FFI boundary), whatever was decompressed so far is still scanned, avoiding evasion gaps. - Scan limits are enforced between and within frames. - It is per zstd spec possible that a file starts with a skippable frame

• Val S. (21 May 26)

  Tests: Stabilize freshclam mock mirror startup (#1722) The freshclam tests started a mock HTTP mirror on a fixed port and immediately ran freshclam without waiting for the server to bind. On slower or busier runners, especially macOS, that left a race where the client could connect before the server was ready or collide with stale port state. Start the mock mirror on an ephemeral loopback port and report the bound address to the parent process through a readiness pipe. Prefer IPv4 loopback and fall back to IPv6 loopback, formatting IPv6 addresses for use in URLs. Tighten teardown so stale mock mirror processes are killed if they do not exit promptly.

• Val S. (21 May 26)

  Libclamav: harden XLM drawing group length checks (#1707) The XLM drawing group parser grew a size_t length with BIFF record sizes before reallocating and copying the new chunk. That pattern looked like an integer overflow candidate, but the reported heap overflow is not reachable in practice because every growth step is immediately bounded by cli_max_realloc() and the BIFF record length cap, so the accumulated length cannot approach SIZE_MAX before the allocation limit stops processing. Add explicit pre-addition overflow checks at the two drawing group growth sites anyway. This keeps the existing control flow while making the arithmetic safety guarantee explicit and easier to audit. Credit: rinto CLAM-2935

• Val S. (19 May 26)

  Win32: fix opendir entry bounds handling (#1706) opendir() copied up to PATH_MAX wide characters into DIR::entry and then wrote the terminator one element past the end of the buffer, leaving a fixed out-of-bounds write on success. We do not believe this to be a security issue. Copy at most entry_count - 1 characters, terminate the last valid element, keep the append length check aligned with that bound, and free DIR when uncpath() fails. CLAM-2487