Skip to content

Fix short writes in scanner temp output paths#1697

Open
val-ms wants to merge 1 commit intoCisco-Talos:mainfrom
val-ms:CLAM-2946-egg-parser-issue
Open

Fix short writes in scanner temp output paths#1697
val-ms wants to merge 1 commit intoCisco-Talos:mainfrom
val-ms:CLAM-2946-egg-parser-issue

Conversation

@val-ms
Copy link
Copy Markdown
Contributor

@val-ms val-ms commented Mar 30, 2026

Fix an EGG comment temp-file bug where the write length used the number of comments instead of the length of the current comment.

Also switch nearby raw write paths in scanners.c to cli_writen() so short writes are handled correctly for RAR comments, extracted EGG temp files, normalized script output, and UTF-16 HTML temp output.

CLAM-2946

@jhumlick
Copy link
Copy Markdown
Contributor

jhumlick commented Apr 9, 2026

libclamav/scanners.c, hunk @@ -690,8 +690,10 @@ static cl_error_t cli_scanegg(...): this fixes the EGG comment length bug, but it still leaves the same short-write class in place for that temp-file path because it continues to call raw write() instead of cli_writen(). A positive short write will still truncate the kept temp file silently after only logging an error. Since the PR’s goal is to harden temp output writes, I’d recommend changing this line to cli_writen(comment_fd, comments[i], comment_len) != comment_len as well.

Fix an EGG comment temp-file bug where the write length used the
number of comments instead of the length of the current comment.

Also switch raw write paths in scanners.c to cli_writen() so short
writes are handled correctly for RAR comments, kept EGG comments,
extracted EGG temp files, normalized script output, and UTF-16 HTML
temp output.

CLAM-2946
@val-ms val-ms force-pushed the CLAM-2946-egg-parser-issue branch from 6bb9a4c to 82b175c Compare April 23, 2026 15:12
@val-ms val-ms requested a review from jhumlick April 23, 2026 16:22
@val-ms
Copy link
Copy Markdown
Contributor Author

val-ms commented Apr 23, 2026

I think this is fixed and ready for re-review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants