[Pkg-clamav-devel] Bug#824196: Bug#824196: clamav-daemon: clamd crashes daily

[Will Aoki]

On Tue, May 24, 2016 at 12:01:37AM +0200, Sebastian Andrzej Siewior wrote:
> After "clamdscan /usr/share/clamav-testfiles/*" (from the
> clamav-testfiles package) it remains at nine. I bet that you have one
> test file which keeps the number of descriptors growing. Could you
> please figure out which one it is?

After a fresh start, it's steady at 9 until I scan the file at
<https://nhmu.utah.edu/sites/default/files/attachments/2015.NHMU_.AccessionForm_distributed-2.pdf>,
after which it increases. Scanning other PDFs from <https://nhmu.utah.edu/collections/policies-forms>
also makes clamd leak file descriptors, as do all the PDFs from outside
sources that I've tried.

The second time I scan a file, the number of file descriptors does not
increase.

This explains why it was crashing even before we included one of these
PDFs in the test corpus: clamav-milter presumably gets enough PDFs that
trigger this in routine e-mail traffic that clamd falls over after a few
days.