Skip to content

Increase bytecode statistics limit#1711

Open
val-ms wants to merge 1 commit intoCisco-Talos:mainfrom
val-ms:issue-1402-bytecode-statistics-limit
Open

Increase bytecode statistics limit#1711
val-ms wants to merge 1 commit intoCisco-Talos:mainfrom
val-ms:issue-1402-bytecode-statistics-limit

Conversation

@val-ms
Copy link
Copy Markdown
Contributor

@val-ms val-ms commented Apr 16, 2026

The max number of bytecodes which can be tracked (64) is insufficient for the number of bytecode signatures currently published (84).

Increased the limit to double the current number of bytecode signatures in bytecode.cvd.

Fixes: #1402

The max number of bytecodes which can be tracked (64) is insufficient for the
number of bytecode signatures currently published (84).

Increased the limit to double the current number of bytecode signatures in
bytecode.cvd.

Fixes: Cisco-Talos#1402
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Increases the maximum number of bytecode signatures tracked for sigperf statistics to prevent “events table full” errors with the current published bytecode signature set.

Changes:

  • Raised MAX_TRACKED_BC to accommodate the current bytecode signature database size (and some headroom).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread libclamav/bytecode.c

#ifndef MAX_TRACKED_BC
#define MAX_TRACKED_BC 64
#define MAX_TRACKED_BC (84 * 2) /* 84 is the number of signatures in the bytecode database as of 2026-04-15 */
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MAX_TRACKED_BC is now tied to the current bytecode signature count (84) and annotated with a specific date, which will quickly become stale as the database changes. Consider switching to a fixed headroom constant (e.g., 168 or a round number like 256) with a comment that it must remain >= the number of bytecode signatures, relying on the existing #ifndef override for builds that want to tune it.

Suggested change
#define MAX_TRACKED_BC (84 * 2) /* 84 is the number of signatures in the bytecode database as of 2026-04-15 */
#define MAX_TRACKED_BC 256 /* Must remain >= the number of bytecode signatures; override at build time if needed. */

Copilot uses AI. Check for mistakes.
Comment thread libclamav/bytecode.c
#define MAX_TRACKED_BC (84 * 2) /* 84 is the number of signatures in the bytecode database as of 2026-04-15 */
#endif
#define BC_EVENTS_PER_SIG 2
#define MAX_BC_SIGEVENT_ID MAX_TRACKED_BC *BC_EVENTS_PER_SIG
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MAX_BC_SIGEVENT_ID is defined without parentheses, which can lead to unexpected precedence if it’s used in more complex expressions. Define it as a fully parenthesized macro (including parentheses around the whole expression and each operand) to make expansion safe.

Suggested change
#define MAX_BC_SIGEVENT_ID MAX_TRACKED_BC *BC_EVENTS_PER_SIG
#define MAX_BC_SIGEVENT_ID ((MAX_TRACKED_BC) * (BC_EVENTS_PER_SIG))

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Error "events table full" when running clamscan in Win 11 - important?

2 participants