Re: Why ClamAV 's anachronistic 2GB size limit for file scanning can be harmful
Paul via clamav-users <[email protected]> Sun, 14 Dec 2025 17:55:36 -0500
| Newsgroups | gmane.comp.security.virus.clamav.user |
|---|---|
| Message-ID | <36f6707d-5c4b-4760-bcd4-8dbdd374e407@Spark> |
--===============1439229995879245247== Content-Type: multipart/alternative; boundary="693f406d_5e884adc_2259" --693f406d_5e884adc_2259 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline 2GB might be a bit on the lower end, but the concept of limits is incredi= bly important. It's why all the major cloud providers have quotas on ever= y service they have. There will always be a bigger payload. OWASP gives a much better explanation than I can. I'd argue that if you have to consistently scan files that are 50+ GB you= may need to re-evaluate your business requirements. I'm not Val or even = that smart on virus scanning but eventually it'll be like finding a needl= e in a haystack. Talk is cheap, send patches=22. Val and team have made it clear many time= s that increasing the 2GB limit is a large task and isn't worth prioritiz= ing, but nothing stops anyone from making a pull request. On Dec 14, 2025 at 4:59=E2=80=AFPM -0500, Paul Kosinski via clamav-users = <clamav-users=40lists.clamav.net>, wrote: > Modern video files can be *very* big, even with efficient modern compre= ssion technology such as H.264 (AVC), H.265 (HEVC), and AV1. > > Conventional HD (1080p) movies can occupy 4-8 GB, while 4K movies (e.g.= , on Blu-ray discs) can occupy 50-100 GB=21 > > Cf. https://darkskiesfilm.com/how-large-are-4k-movies/ > > - ---------------------------------------------------------------------= ---- > Debian Security Advisory DSA-6082-1 security=40debian.org > https://www.debian.org/security/ Moritz Muehlenhoff > December 14, 2025 https://www.debian.org/security/faq > - ---------------------------------------------------------------------= ---- > > Package : vlc > CVE ID : not yet available > Debian Bug : 1013898 1021601 > > Multiple vulnerabilities were discovered in the VLC media player, which= > could result in denial of service or potentially the execution of > arbitrary code if a malformed video file is opened. > =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F > > Manage your clamav-users mailing list subscription / unsubscribe: > https://lists.clamav.net/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/Cisco-Talos/clamav-documentation > > https://docs.clamav.net/=23mailing-lists-and-chat > --693f406d_5e884adc_2259 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline <html xmlns=3D=22http://www.w3.org/1999/xhtml=22> <head> <title></title> </head> <body> <div name=3D=22messageBodySection=22> <div><span style=3D=22font-size:16px;=22>2GB might be a bit on the lower = end, but the concept of limits is incredibly important. It's why all the = major cloud providers have quotas on every service they have. There will = always be a bigger payload.&=23160;</span></div> <div>&=23160;</div> <div><a href=3D=22https://owasp.org/API-Security/editions/2019/en/0xa4-la= ck-of-resources-and-rate-limiting/=22><span style=3D=22font-size:16px;=22= >OWASP gives a much better explanation than I can.</span></a><span style=3D= =22font-size:16px;=22>&=23160;</span></div> <div>&=23160;</div> <div><span style=3D=22font-size:16px;=22>I'd argue that if you have to co= nsistently scan files that are 50+ GB you may need to re-evaluate your bu= siness requirements. I'm not Val or even that smart on virus scanning but= eventually it'll be like finding a needle in a haystack.&=23160;</span><= /div> <div><a href=3D=22https://x.com/=46=46mpeg/status/1762805900035686805=3Fs= =3D20=22><span style=3D=22font-size:16px;=22>Talk is cheap, send patches<= /span></a><span style=3D=22font-size:16px;=22>=22. Val and team have made= it clear many times that increasing the 2GB limit is a large task and is= n't worth prioritizing, but nothing stops anyone from making a pull reque= st.&=23160;</span></div> </div> <div name=3D=22messageReplySection=22> <div>On Dec 14, 2025 at 4:59=E2=80=AFPM -0500, Paul Kosinski via clamav-u= sers <<a href=3D=22mailto:clamav-users=40lists.clamav.net=22>clamav-us= ers=40lists.clamav.net</a>>, wrote:<br /> &=23160;</div> <blockquote style=3D=22margin: 5px 5px; padding-left: 10px; border-left-w= idth: thin; border-left-style: solid; border-left-color: =231abc9c;=22> <div>Modern video files can be *very* big, even with efficient modern com= pression technology such as H.264 (AVC), H.265 (HEVC), and AV1.<br /> <br /> Conventional HD (1080p) movies can occupy 4-8 GB, while 4K movies (e.g., = on Blu-ray discs) can occupy 50-100 GB=21<br /> <br /> Cf. https://darkskiesfilm.com/how-large-are-4k-movies/<br /> <br /> - -----------------------------------------------------------------------= --<br /> Debian Security Advisory DSA-6082-1 security=40debian.org<br /> https://www.debian.org/security/ Moritz Muehlenhoff<br /> December 14, 2025 https://www.debian.org/security/faq<br /> - -----------------------------------------------------------------------= --<br /> <br /> Package : vlc<br /> CVE ID : not yet available<br /> Debian Bug : 1013898 1021601<br /> <br /> Multiple vulnerabilities were discovered in the VLC media player, which<b= r /> could result in denial of service or potentially the execution of<br /> arbitrary code if a malformed video file is opened.<br /> =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F<br /> <br /> Manage your clamav-users mailing list subscription / unsubscribe:<br /> https://lists.clamav.net/mailman/listinfo/clamav-users<br /> <br /> <br /> Help us build a comprehensive ClamAV guide:<br /> https://github.com/Cisco-Talos/clamav-documentation<br /> <br /> https://docs.clamav.net/=23mailing-lists-and-chat<br /> &=23160;</div> </blockquote> </div> </body> </html> --693f406d_5e884adc_2259-- --===============1439229995879245247== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat --===============1439229995879245247==--