Re: libclamav and INSTREAM

On 11/20/2013 10:42 PM, Erik Aigner wrote:

> The clamav daemon has an INSTREAM feature for scanning a stream of data.
> I’m developing Go bindings for libclamav (https://github.com/eaigner/clam) and was
> wondering why there isn’t such a feature in libclamav?
> 
> I searched the libclamav headers for something equal but didn’t find anything similar.
> It seems I can only scan by file handle. If I use a pipe handle, it will fail.
> 
> Is that correct? Do I really have to write (potentially huge) files to disk to scan for clamav?  

I've been advocating for a function in libclamav that would scan a memory region
instead of a file years ago. But this idea was never picked up, as far as I
know. I think that the best you can do is mmap() your memory buffer into a
temporary file and give the handle to scan_file().

Scanning a stream would probably be much harder if not impossible. If libclamav
was designed with abstract I/O layer, a la OpenSSL's BIO, it would have been
marvellous, but it is not.

Disclaimer: I am only a user, without the knowledge of clamav's internals.

Eugene

_______________________________________________
http://lurker.clamav.net/list/clamav-devel.html
Please submit your patches to our Bugzilla: http://bugs.clamav.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEVAwUBUo0N/zy8vXtX5W5FAQLxGAgAmWXXwlnCsPbvOL17krrHPnvbAN6zrtsw
oPVTQbECfGOG0Iz6hSqly1J4omqojDNMYal65ZEdurTw9MZfS+fhBulyGnzJ5wXf
6EwEUaToLd8RdPbPTRf4W/3rWukY/k6T8nZ8mE337cxv1rh/ylQL6a3PkanGyrlN
lxbyHV6VRBytZHlI/yUgh2ljOLLgi24IV+D7o7XfImyQy0C7o9wSe1fquqoD+422
RInlRGEMQunsxcLqQVtR9pT4CPoyUFJSaVOBXicCTnkP6KeKiW2Yo05KFo2i8Yhf
8XUhEvkpBNropE78ZS/te/wskEERnyndKCg3E9ZpftMqyeOXt6ad2g==
=I2bj
-----END PGP SIGNATURE-----