[Pkg-clamav-devel] Bug#675558: Is this also causing these other errors?

[Andreas Cadhalpun]

Hi Karl,

On 30.04.2014 04:27, Karl Schmidt wrote:
>> LibClamAV info: scancws: Error decompressing SWF file
>> LibClamAV info: scancws: Error decompressing SWF file
>> LibClamAV info: scancws: Error decompressing SWF file
>> LibClamAV info: scancws: Error decompressing SWF file
>> LibClamAV Warning: cli_scanxz: decompress file size exceeds limits -
>> only scanning 27262976 bytes
>> LibClamAV info: scancws: Error decompressing SWF file
>> LibClamAV Error: cli_scanswf: GETBITS: Can't read file
>
> One has to do something like:
>
> $ clamscan -r / > clamav.log 2>&1
>
> And then grep for the errors to find the directory involved - but all of
> these errors have to do with decompression and I can't recreate the
> errors using other tools - there appears to be no problems with the files.

Can you provide an example SWF file that produces this errors?
Can you disassemble these files with flasm?

> If they are not using the normal libs for expanding compressed files, it
> could explain these errors as well?

Anyway I'm pretty sure this error has nothing to do with libmspack, 
because this is not used to decompress SWF files (instead clamav uses 
some code based on flasm for this).

About the "embedded copy" of libmspack in clamav:
It is a modified version of what libmspack had been back in 2004 and has 
very little correlation with the package libmspack currently in Debian, 
so it can't be simply replaced with that.

Best regards,
Andreas