Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERROR

Forum for getting help with Project Gamera, Spamassassin, Clamav, qmail-scanner and other anti-spam tools.
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERROR

Unread post by faris »

I've seen a few entries similar to the one below in the logs after updating to 0.97.5 the other day:

Code: Select all

/var/spool/qscan/tmp/hostname.tld134010592679830512/image001.png: CL_EFORMAT: Bad format or broken data ERROR
Google shows a couple of recent posts on the subject in some clamav mailing lists but no actual info on the cause or what do so about it - if anything.

I don't suppose anyone here has any suggestions?
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by scott »

Have you tried turning it off and on again?!
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by faris »

Is it meant to be plugged in when I do that? And what's with the drinks tray on this thing? Why do I need one on a server?

On the off-chance that you meant restart clamd...makes no difference.

Looking in more detail the log entries are all being triggered by a particular (legit) email containing this particular PNG. It isn't PNGs in general as I've tried sending tests with PNG attachments and all is well with those.
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by mikeshinn »

Does scanning the png from the filesystem generate this error? If so, can you send an strace (you may need to install the debug symbols btw)?
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by faris »

That might be hard. It will be in a mime-encoded part of an incoming email which is being rejected by qmail-scanner.

I seem to remember someone telling me that a copy is stored somewhere even though I had thought they would not be. Can someone point me in the right direction please?
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by mikeshinn »

You could extract it from the email if you still have it, mimedecode or one of the other command line tools will do it.
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by faris »

Well unfortunately I don't have the email - I can't see a way of obtaining it either :-(

I'm hoping that the other people also seeing this issue will have a bit more luck in being able to provide better debug data.
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by faris »

One of the threads about this says that the following test file also triggers the same issue:

/usr/src/clamav-0.97.5/test/.split/split.clam_IScab_int.exeaa
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
User avatar
mikeshinn
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 4149
Joined: Thu Feb 07, 2008 7:49 pm
Location: Chantilly, VA

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by mikeshinn »

Its a bug in clamav. Being worked on, should have an update soon.
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by faris »

Interesting. Thanks for the update.

EDIT: Here's the link is anybody else is interested:
https://bugzilla.clamav.net/show_bug.cgi?id=5252
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
scott
Atomicorp Staff - Site Admin
Atomicorp Staff - Site Admin
Posts: 8355
Joined: Wed Dec 31, 1969 8:00 pm
Location: earth
Contact:

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by scott »

Backported into 0.95.5-7, try that out to see if it fixes it for you.
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by faris »

In progress....thanks.....
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
faris
Long Time Forum Regular
Long Time Forum Regular
Posts: 2321
Joined: Thu Dec 09, 2004 11:19 am

Re: Clamav 0.97.5 CL_EFORMAT: Bad format or broken data ERRO

Unread post by faris »

Looking good. No error in almost an hour, which indicates all is well, I think. Thank you!
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
Post Reply