ClamAV

Recent Commits

• Val S.(27 Aug 26)

  Merge pull request #1758 from Cisco-Talos/slow-signature-repeat-starting-character CLAM-3049 perf(matcher): avoid slow AC heads with repeated bytes

• Valerie Snyder(19 Aug 26)

  Fix: Reject repeated AC replacement heads The repeated-prefix selector ranked candidate windows by occurrences of the original repeated byte. A signature such as ffffff000000 could therefore replace an ff trie head with an all-zero trie head and recreate the low-selectivity behavior this optimization is intended to avoid. Require shifted windows to contain at least two distinct bytes. Add a matcher regression that verifies the transition window is selected and that the complete signature still matches. Validation: - make -j12 check_clamav - CK_RUN_CASE=matchers ./build/unit_tests/check_clamav - git clang-format --diff HEAD -- libclamav/matcher-ac.c unit_tests/check_matchers.c

• Valerie Snyder(05 Jul 26)

  perf(matcher): avoid slow AC heads with repeated bytes Some ClamAV hex patterns begin a sub-pattern with a long run of the same exact byte. When that byte is common in the scanned input, such as space bytes in document text or zero bytes in binary data, the AC trie head produces a large number of candidate branches and scan time can grow dramatically. A real main.ldb sample spent minutes in this path for Valyria signatures with repeated leading spaces. Extend the existing poor-prefix shifting logic, which already handles wildcard and all-zero trie heads, to also detect repeated exact-byte prefixes. The matcher now selects a later exact static window with fewer occurrences of the repeated byte, stores the skipped bytes as the backwards-checked prefix, and keeps normal match semantics unchanged. Benchmarks on c72ca7651909b7bd89bc05dbd18be88fe8a22c4cbff0b837d016ea1be9caf277: - five-signature Valyria repro: 5.846s main to 2.134s branch - full main.ldb repro: 262.176s main to 3.302s branch Validation: - make -j12 - ctest -V -R '^libclamav$' - ctest -V -R '^clamscan$'

• Val S.(19 Aug 26)

  FreshClam: use the configured outdated hook in daemon mode (#1770) FreshClam's non-daemon update path passes OnOutdatedExecute to the database update helper when the outdated-version hook is enabled. The daemon update loop checked the OnOutdatedExecute option but accidentally passed the OnUpdateExecute command string instead. This could cause daemon-mode outdated-version events to run the update hook, or to run no hook when only OnOutdatedExecute was configured. Pass the OnOutdatedExecute command string in the daemon path so both update modes use the same hook selection. Credit: Nir Yehoshua, Cipher Security Labs CLAM-3025

• Val S.(19 Aug 26)

  Stabilize Valgrind and scanner integration tests (#1805) * Adapt Valgrind file descriptor checks Valgrind 3.23 changed --track-fds=yes so descriptors left open at process exit count as real errors and trigger --error-exitcode. This caused the clamd and freshclam Valgrind tests to fail on intentional process-lifetime descriptors rather than memory defects. Select the fd tracking mode from the installed Valgrind version. Preserve the original yes mode before 3.23, disable fd tracking on 3.23 through 3.25, and use the new bad mode on 3.26 and later so invalid descriptor use is still detected without reporting descriptors closed by process exit. * Make clean scan assertions path-safe The clamscan and clamd tests used the unanchored regular expression OK to decide whether a clean result appeared. Randomized temporary paths containing those letters caused virus-detection tests to fail even though the scanner output was correct. Match the complete ': OK' result marker through the line ending and use the shared expression for every bare clean-result assertion. Also activate the LHA test's existing negative assertion so it checks the behavior it documents. * Wait for clamd test readiness The shared clamd startup helper returned immediately after creating the process. Tests then used inconsistent short ping windows, so slow startup under Valgrind could fail the first tests even while the daemon was still loading its databases. Wait for clamdscan to receive PONG from the daemon using the selected configuration, allowing up to 60 attempts. Report early daemon exits and readiness timeouts at the startup boundary, and honor custom configurations in the non-Valgrind path.

• Val S.(18 Aug 26)

  Harden codesign and cdiff input parsing (#1772) Detached .sign files and cdiff/script commands are database-side inputs that should be trusted only after basic format validation. A malformed .sign header could reach a split/unwrap path and abort the process instead of returning a verification error. Several adjacent .sign certificate/signature metadata paths and cdiff command argument paths had similar panic-on-malformed-input assumptions. Validate the .sign file header explicitly, report malformed digital-signature metadata and certificate common-name failures as verification errors, and reject truncated cdiff/script commands with MissingParameter errors. Add focused Rust unit tests for the malformed header and command cases. These changes are hardening only. ClamAV database and update artifacts are expected to be provided by administrators or trusted update infrastructure, so we are not treating this as a vulnerability fix. Credit: Owais Lone (TheSecGuy) CLAM-2996

• Val S.(18 Aug 26)

  Support safe quarantine removal on FreeBSD (#1791) * Support safe quarantine removal on FreeBSD The CLAM-2959 quarantine hardening requires an atomic way to prove that a pathname still identifies the source retained during scanning before removing it. FreeBSD lacks the no-replace rename primitive used by the generic POSIX capture path on supported releases, causing --move and --remove to fail with ENOTSUP. Detect funlinkat() and use it with the retained scan descriptor after securely traversing to the source parent. FreeBSD atomically checks that the basename still names the retained descriptor before unlinking it. Normalize EDEADLK to EAGAIN so replacement races follow the existing action-failure behavior. Resolve descriptor paths through F_KINFO so FreeBSD symlink submissions retain the real scanned source path. Other platform implementations and the conservative unsupported-POSIX fallback remain unchanged. Reported-by: Hiroki Imai from Ricerca Security, Inc. CLAM-2959 * Preserve resolved quarantine source paths FreeBSD F_KINFO resolves a vnode through the name cache and may return a different hard-link name from the path used to open the scanned file. Using that result for a path-based quarantine action could remove another link and leave the submitted path in place. Retain the already-resolved path supplied to path-based action sources and use descriptor path resolution only when no authoritative path is available. Guard F_KINFO use so FreeBSD releases without that command fall back cleanly instead of failing to compile. Add hard-link regression coverage for move and remove actions. CLAM-2959 * Fix macOS quarantine test result matching On macOS, /tmp is reported as its canonical /private/tmp path. The quarantine directory replacement tests compared the complete clamscan success message against paths created from the noncanonical temporary directory. A successful copy or move could therefore be misclassified as an action failure. Match the stable copy and move action markers instead. Existing filesystem assertions continue to verify that the payload reached the pinned quarantine directory and was not redirected through a replaced path. CLAM-2959

• qxp930712(18 Aug 26)

  libfreshclam: fix use-after-free in fc_cleanup on init failure (#1801) fc_cleanup() frees g_signVerifier but does not set it to NULL. When fc_initialize() fails, fc_cleanup() is called internally and then again by freshclam at exit, causing a double free that results in a segmentation fault. Set g_signVerifier to NULL after freeing it, matching the pattern used by other pointers in fc_cleanup(). Triggered when freshclam cannot write to the database directory. Co-authored-by: caimengci <[email protected]>

• Val S.(17 Aug 26)

  sigtool: Retry incompatible build hashes after a delay (#1781) A database archive whose MD5 starts with 00 cannot be verified by ClamAV 1.1 through 1.4. The existing immediate retry can rebuild the same archive when both attempts use the same timestamp. Retry this specific compatibility failure up to ten times, waiting one second for the build timestamp to change between attempts. Preserve immediate failures for all other errors and keep the test limited to one sigtool invocation. CLAM-3048

• Valerie Snyder(06 Aug 26)

  Fix macOS quarantine test result matching On macOS, /tmp is reported as its canonical /private/tmp path. The quarantine directory replacement tests compared the complete clamscan success message against paths created from the noncanonical temporary directory. A successful copy or move could therefore be misclassified as an action failure. Match the stable copy and move action markers instead. Existing filesystem assertions continue to verify that the payload reached the pinned quarantine directory and was not redirected through a replaced path. CLAM-2959

• Valerie Snyder(05 Aug 26)

  Preserve resolved quarantine source paths FreeBSD F_KINFO resolves a vnode through the name cache and may return a different hard-link name from the path used to open the scanned file. Using that result for a path-based quarantine action could remove another link and leave the submitted path in place. Retain the already-resolved path supplied to path-based action sources and use descriptor path resolution only when no authoritative path is available. Guard F_KINFO use so FreeBSD releases without that command fall back cleanly instead of failing to compile. Add hard-link regression coverage for move and remove actions. CLAM-2959

• Valerie Snyder(05 Aug 26)

  Support safe quarantine removal on FreeBSD The CLAM-2959 quarantine hardening requires an atomic way to prove that a pathname still identifies the source retained during scanning before removing it. FreeBSD lacks the no-replace rename primitive used by the generic POSIX capture path on supported releases, causing --move and --remove to fail with ENOTSUP. Detect funlinkat() and use it with the retained scan descriptor after securely traversing to the source parent. FreeBSD atomically checks that the basename still names the retained descriptor before unlinking it. Normalize EDEADLK to EAGAIN so replacement races follow the existing action-failure behavior. Resolve descriptor paths through F_KINFO so FreeBSD symlink submissions retain the real scanned source path. Other platform implementations and the conservative unsupported-POSIX fallback remain unchanged. Reported-by: Hiroki Imai from Ricerca Security, Inc. CLAM-2959

• Val S.(12 Aug 26)

  Jenkinsfile: throttle concurrent builds from first run (#1782) Jenkinsfile-defined job properties are unavailable when Jenkins queues the first build of a newly discovered multibranch job. Use the runtime throttle step around agent allocation so first builds also observe the global clamav category. Refs: https://github.com/jenkinsci/throttle-concurrent-builds-plugin/issues/448

• Val S.(07 Aug 26)

  Merge pull request #1783 from jhumlick/CLAM-3011-XLM-out-of-bounds-read libclamav: Harden XLM formula record parsing

• Val S.(07 Aug 26)

  Merge pull request #84 from cisco-sbg/dependabot/cargo/cargo-f4adfd9abb Bump the cargo group across 1 directory with 2 updates

• Val S.(07 Aug 26)

  Merge pull request #112 from cisco-sbg/CLAM-3052-clamd-stats-address-disclosure CLAM-3052: Prevent clamd STATS address disclosure

• Val S.(07 Aug 26)

  libclamunrar: Reject paths in NTFS stream names (#88) Portable UnRAR releases before 7.13 allow Windows NTFS alternate data stream names to contain path separators. When ClamAV extracts a crafted RAR archive for scanning, such a stream name can escape the temporary scan directory and create or overwrite a file writable by the scanner process. Reject forward and backward slashes in both the RAR2/4 and RAR5 stream handlers, matching the upstream fix for CVE-2025-8088. Reported by Yazdan Soltani as affecting ClamAV. CLAM-3035

• Val S.(07 Aug 26)

  Merge pull request #86 from cisco-sbg/CLAM-3010-xar-mem-alloc CLAM-3010 libclamav: Fix oversized XAR TOC allocation handling

• Val S.(07 Aug 26)

  Libclamav: fix ZIP local-header catalogue growth (#71) The ZIP local-header indexing helper can append to the same temporary catalogue across multiple bounded scans. It tracked allocation capacity with a local value derived from the current record count, so later calls could lose the true allocated size and append past the catalogue. Keep the catalogue block count as caller-owned state and grow the catalogue before parsing into the next record slot. Reported-by: Kevin Stubbings CLAM-2995

• Val S.(07 Aug 26)

  Libclamav: harden Mach-O section validation (#70) Mach-O encodes a section's alignment as a base-2 exponent. A malformed exponent can trigger undefined behavior in the signed shift used to compute the alignment, and unchecked rounding can overflow the 32-bit raw-size field. Use a shared helper for 32- and 64-bit sections. Reject exponents above 31, perform the shift in uint64_t so exponent 31 remains valid, and reject file-backed section sizes or rounded sizes that exceed UINT32_MAX before narrowing them into cli_exe_section. Review also identified valid virtual sections that must not be subject to file-backed raw-size limits. Treat S_ZEROFILL, S_GB_ZEROFILL, and S_THREAD_LOCAL_ZEROFILL as occupying no file bytes while continuing to validate their alignment. The original alignment issue was reported by Tristan (@TristanInSec). CLAM-3002

• Val S.(07 Aug 26)

  Libclamav: guard PDF hex string newline skip (#69) The PDF hex-string reader skips newlines immediately after the opening angle bracket. A malformed string can consume the remaining bounded input before the parser searches for the closing bracket. Return early when the bounded length is exhausted so the parser does not pass an underflowed length to memchr(). Reported-by: Tristan (@TristanInSec) CLAM-3002

• Val S.(07 Aug 26)

  Libclamav: fix ZIP catalogue invalid free (#68) The ZIP local-header indexing path merges records from the central directory with records found by scanning local file headers. The merge used shallow struct copies, so the combined catalogue and source catalogues could share the same original_filename pointer. If overlap detection failed after the merge copied entries, cleanup could free the source catalogue names and then free the same pointers again from the combined catalogue. Add a small zip_record_move() helper and use it for the merge so ownership of original_filename transfers to the combined catalogue before any later cleanup. CLAM-3003

• Val S.(07 Aug 26)

  Libclamav: fix PESpin rebuilt section size overflow (#67) The PESpin unpacker accumulated rebuilt section sizes in a signed int before allocating the intermediate rebuilt image buffer. A crafted PE with many sections could wrap the total to a small value and then copy full section contents into that undersized allocation. Track the rebuilt size in a 64-bit accumulator and reject additions that would exceed CLI_MAX_ALLOCATION before allocating. Also avoid related undefined behavior in the PESpin checksum and resource bitmap paths, and share bitmap-based cleanup through one helper. Reported-by: Feng Xue CLAM-3008

• Val S.(07 Aug 26)

  Libclamav: fix GPT partition name conversion index (#66) The GPT partition parser converted the UTF-16 partition name with the outer partition loop index instead of the inner name loop index. A GPT with enough partition entries could read and write past the end of the stack-allocated partition entry while scanning disk images. Use the name loop index so each UTF-16 code unit is converted in bounds. Credit: Atuin - Automated Vulnerability Discovery Engine, Tianchu Chen of Tencent Xuanwu Lab. CLAM-2999

• Valerie Snyder(06 Aug 26)

  unit_tests: Avoid Linux TCP timeout in STATS test Do not artificially shrink the receive buffer in the slow-client test. Linux TCP flow control can otherwise delay the intentionally large response long enough for mdprintf() to time out after only a partial write. Keeping the sender buffer limited and nonblocking preserves the partial-write and slow-client coverage while allowing the reader to drain the complete STATS response. CLAM-3052

• Valerie Snyder(04 Aug 26)

  unit_tests: Remove dead stores from clamd stress test Remove obsolete bookkeeping for expected send failures in the FILDES stress test. The test has verified daemon responsiveness with a fresh PING connection since the flag's assertion was removed.

• Valerie Snyder(04 Aug 26)

  clamd: Synchronize STATS pool snapshots Protect thread-pool counters and queue traversal with the pool mutex while STATS captures its response. Preserve the pools_lock-to-pool_mutex lock order during worker initialization and pool destruction. Make worker retirement recheck queued work before decrementing the live-thread count so dispatch cannot leave work stranded in the retirement window. Retain engine references while collecting memory-pool statistics instead of racing on the reference count. Add regression coverage for queue churn and work dispatched while a worker is retiring. CLAM-3052

• Valerie Snyder(04 Aug 26)

  common: Bound partial mdprintf sends After a partial socket write, mdprintf advances its output buffer but continued passing the original formatted length to send(). A nonblocking client could therefore make send() read beyond the allocated buffer. Pass only the remaining byte count. Make the clamd STATS slow-client test use a production-like nonblocking socket, prove the writer remains blocked while pool work proceeds, and validate the complete response. CLAM-3052

• Valerie Snyder(04 Aug 26)

  clamd: Own task filenames reported by STATS The thread manager stores active task filenames supplied by scan handlers. Some callers pass stack-backed strings, while the STATS command reads task descriptors from another worker. A delayed STATS response can therefore read caller storage after it has been reused and disclose process address bytes. Give each task descriptor an owned filename and protect its mutable state with a per-task mutex. Build an immutable STATS response while pool and task state is protected, then release all daemon bookkeeping locks before writing to the client. Retain engine references needed by the response so database reloads remain safe. Add deterministic tests for caller-storage reuse and for a non-reading STATS client that must not block pool registration. CLAM-3052

• John Humlick(31 Jul 26)

  libclamav: Verify scanning of extracted XLM formulas Add a valid ptgStr regression case and use a signature matching its disassembled output to verify detection through clamscan and scan-map. Flush the extracted XLM stream before scanning so buffered formula output is visible to the scanner. CLAM-3011