[squid-users] ClamAV crash in eCAP Adapter

[Alex Rousskov]

On 3/1/23 11:31, Rafael Akchurin wrote:
> Hello everyone,
> 
> May I ask for your experiences with the latest update of ClamAV with eCAP adapter enabled. Running Squid 5.7 on Ubuntu 20.04.
> Starting from today (01-March-2023) the following crash stops Squid process.

For ClamAV eCAP adapter support, please use that adapter support 
channels rather that squid-users: https://www.e-cap.org/support/
It may help if you define "crash" more precisely when following up there.


> #0  0x00007fab13a44ff0 in cli_bm_scanbuff () from /lib/x86_64-linux-gnu/libclamav.so.9
> #1  0x00007fab13a4c8da in ?? () from /lib/x86_64-linux-gnu/libclamav.so.9
> #2  0x00007fab13a52023 in ?? () from /lib/x86_64-linux-gnu/libclamav.so.9
> #3  0x00007fab13a545a9 in ?? () from /lib/x86_64-linux-gnu/libclamav.so.9
> #4  0x00007fab13a5a589 in ?? () from /lib/x86_64-linux-gnu/libclamav.so.9
> #5  0x00007fab13a5b4cf in ?? () from /lib/x86_64-linux-gnu/libclamav.so.9
> #6  0x00007fab13a54251 in ?? () from /lib/x86_64-linux-gnu/libclamav.so.9
> #7  0x00007fab13a5767a in cl_load () from /lib/x86_64-linux-gnu/libclamav.so.9
> #8  0x00007fab13c123e5 in Adapter::ClamAv::loadDatabase (this=this at entry=0x56119a5f4290) at ClamAv.cc:137
> #9  0x00007fab13c12658 in Adapter::ClamAv::configure (this=0x56119a5f4290, cfg=...) at ClamAv.cc:83
> #10 0x00007fab13c0939d in Adapter::Service::configure (this=0x56119a5ef940, cfg=warning: RTTI symbol not found for class 'Adaptation::Ecap::ConfigRep'
> ...) at /usr/include/c++/9/tr1/shared_ptr.h:668
> #11 0x000056119979bd04 in Adaptation::Ecap::ServiceRep::tryConfigureAndStart() ()
> #12 0x000056119979c38b in Adaptation::Ecap::ServiceRep::finalize() ()
> #13 0x0000561199783126 in Adaptation::Config::Finalize(bool) ()
> #14 0x000056119951ba3f in SquidMain(int, char**) ()
> #15 0x00005611993a8ef6 in main ()
> 
> Am I correct to think the crash might be related to some definition file update issued by ClamAV team?


It might be. In the past, the changes in the ClamAV database file 
location and/or name resulted in crashes with similar symptoms as 
detailed at https://bugs.launchpad.net/ecap/+bug/1426095

That information may no longer be relevant, but according to the triage 
of that (very old!) issue, you may want to enable Squid debugging and 
search for errors like the following:

LibClamAV Error: cl_load(): No such file or directory: 
/usr/local/clamav/share/clamav


HTH,

Alex.