Mailing List Archive

Any hard size limit for scanned files?
Hi there,

my company is considering moving away from ClamAV. They claim there's a
file size limitation for scanned files in ClamAV that a commercial
product could overcome.

Is that true? I found this comment on an Ubuntu forum, which is not too
old. It claims there is a hard 4 GByte limit:

https://askubuntu.com/questions/1423199/clamav-file-size-restrictions

I need to be able to scan files up to 5 GBytes, with the possibility
that this limit will later be pushed higher (like 8 or 10 GBytes)

a) Is ClamAV really unable to do this? Is there really a hard 4 GByte
size limitation?
b) If a) is correct, are there any plans to overcome this size
limitation in a future version of ClamAV?

Best,
Ray
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat
Re: Any hard size limit for scanned files? [ In reply to ]
On Tue, 29 Aug 2023, Ray wrote:
> my company is considering moving away from ClamAV. They claim there's a file
> size limitation for scanned files in ClamAV that a commercial product could
> overcome.
>
> Is that true? I found this comment on an Ubuntu forum, which is not too old.
> It claims there is a hard 4 GByte limit:
>
> https://askubuntu.com/questions/1423199/clamav-file-size-restrictions
>
> I need to be able to scan files up to 5 GBytes, with the possibility that
> this limit will later be pushed higher (like 8 or 10 GBytes)
>
> a) Is ClamAV really unable to do this? Is there really a hard 4 GByte size
> limitation?
> b) If a) is correct, are there any plans to overcome this size limitation in

Yes, there really is a hard limit.
I may not remember correctly, but I think that for some file types
the limit may even be 2GB not 4GB.

From v1.2.0 (released this week) this limit no longer applies to
archives and disk images, such as .zip and .iso files,
though it still applies to the ordinary files inside them.

I understand that removing this limit is planned, but I am not privy
to the priorities of the ClamAV team.

Do you have experience of large infected files ?
I can see that there could be a macro virus in a large spreadsheet
but IIRC some virus checkers only look at the first so much of a file
since malware deeper into the file cannot (or could not) be executed.

--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat
Re: Any hard size limit for scanned files? [ In reply to ]
Hi,

The max file size is 2GByte. If you would like to be notified when a file is over the limit, you should use 'AlertExceedsMax'.

We are currently not working on increasing the file size limit.

Thanks,
Andy
________________________________
From: clamav-users <clamav-users-bounces@lists.clamav.net> on behalf of Andrew C Aitchison via clamav-users <clamav-users@lists.clamav.net>
Sent: Tuesday, August 29, 2023 6:15 AM
To: ClamAV users ML <clamav-users@lists.clamav.net>
Cc: Andrew C Aitchison <clamav@aitchison.me.uk>
Subject: Re: [clamav-users] Any hard size limit for scanned files?


On Tue, 29 Aug 2023, Ray wrote:
> my company is considering moving away from ClamAV. They claim there's a file
> size limitation for scanned files in ClamAV that a commercial product could
> overcome.
>
> Is that true? I found this comment on an Ubuntu forum, which is not too old.
> It claims there is a hard 4 GByte limit:
>
> https://askubuntu.com/questions/1423199/clamav-file-size-restrictions
>
> I need to be able to scan files up to 5 GBytes, with the possibility that
> this limit will later be pushed higher (like 8 or 10 GBytes)
>
> a) Is ClamAV really unable to do this? Is there really a hard 4 GByte size
> limitation?
> b) If a) is correct, are there any plans to overcome this size limitation in

Yes, there really is a hard limit.
I may not remember correctly, but I think that for some file types
the limit may even be 2GB not 4GB.

From v1.2.0 (released this week) this limit no longer applies to
archives and disk images, such as .zip and .iso files,
though it still applies to the ordinary files inside them.

I understand that removing this limit is planned, but I am not privy
to the priorities of the ClamAV team.

Do you have experience of large infected files ?
I can see that there could be a macro virus in a large spreadsheet
but IIRC some virus checkers only look at the first so much of a file
since malware deeper into the file cannot (or could not) be executed.

--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk
_______________________________________________

Manage your clamav-users mailing list subscription / unsubscribe:
https://lists.clamav.net/mailman/listinfo/clamav-users


Help us build a comprehensive ClamAV guide:
https://github.com/Cisco-Talos/clamav-documentation

https://docs.clamav.net/#mailing-lists-and-chat