Skip to content

Fix alert-exceeds-max feature for files > 2GB and < max-filesize#1032

Merged
val-ms merged 1 commit intoCisco-Talos:mainfrom
val-ms:CLAM-2449-max-filesize-gt-2G
Oct 19, 2023
Merged

Fix alert-exceeds-max feature for files > 2GB and < max-filesize#1032
val-ms merged 1 commit intoCisco-Talos:mainfrom
val-ms:CLAM-2449-max-filesize-gt-2G

Conversation

@val-ms
Copy link
Contributor

@val-ms val-ms commented Sep 23, 2023

The --alert-exceeds-max feature should alert for all files larger than 2GB because 2GB is the internal limit for individual files. This isn't working correctly because the goto done; exit condition after recording the exceeds-max heuristic skips over the logic that reports the alert.

This fix moves the ">2GB" check up to the location where the max-filesize engine option is set by clamd or clamscan. If max-filesize > 2GB - 1 is requested, then max-filesize is set to 2GB - 1.

Additionally, a warning is printed if max-filesize > 2GB is requested (with an exception for when it's maxed out by setting --max-filesize=0).

Resolves: #1030

The --alert-exceeds-max feature should alert for all files larger than
2GB because 2GB is the internal limit for individual files.
This isn't working correctly because the `goto done;` exit condition
after recording the exceeds-max heuristic skips over the logic that
reports the alert.

This fix moves the ">2GB" check up to the location where the
max-filesize engine option is set by clamd or clamscan.
If max-filesize > 2GB - 1 is requested, then max-filesize is set to
2GB - 1.

Additionally, a warning is printed if max-filesize > 2GB is requested
(with an exception for when it's maxed out by setting --max-filesize=0).

Resolves: Cisco-Talos#1030
@val-ms
Copy link
Contributor Author

val-ms commented Sep 23, 2023

Note: I'm actually a little bit on the fence about the warning when setting max-filesize > 2GB. I expect it will draw a lot of attention. However, a lot of people mistakenly think the limit is 4GB or even unlimited because there is presently no warning.

@ragusaa ragusaa self-requested a review September 27, 2023 19:25
@ragusaa
Copy link
Contributor

ragusaa commented Sep 27, 2023

Note: I'm actually a little bit on the fence about the warning when setting max-filesize > 2GB. I expect it will draw a lot of attention. However, a lot of people mistakenly think the limit is 4GB or even unlimited because there is presently no warning.

I like having a warning that a file is not being scanned due to a size limit, so that the user is aware.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🍒cherry-pick-candidate A PR that should be backported once approved.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Heuristics.Limits.Exceeded.MaxFileSize not emitted for 2GB+ files

2 participants