Ubuntu
clamav package

check_clamav test fails

Bug #1692073 reported by jean-christophe manciot
20
This bug affects 2 people
Affects Status Importance Assigned to Milestone
ClamAV
Fix Released
Medium
clamav (Gentoo Linux)
Unknown
Medium
clamav (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Ubuntu 17.04
clamav sources 0.99.2+dfsg-6ubuntu1 from launchpad: https://launchpad.net/ubuntu/+source/clamav/0.99.2+dfsg-6ubuntu1

Building with:
sudo -u actionmystique -H dpkg-buildpackage --build=binary -m"Jean-Christophe Manciot <email address hidden>"

leads to:
...
make check-TESTS
make[4]: Entering directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
make[5]: Entering directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
FAIL: check_clamav
PASS: check_freshclam.sh
PASS: check_sigtool.sh
SKIP: check_unit_vg.sh
PASS: check1_clamscan.sh
PASS: check2_clamd.sh
PASS: check3_clamd.sh
PASS: check4_clamd.sh
SKIP: check5_clamd_vg.sh
SKIP: check6_clamd_vg.sh
SKIP: check7_clamd_hg.sh
SKIP: check8_clamd_hg.sh
SKIP: check9_clamscan_vg.sh
==============================================
   ClamAV 0.99.2: unit_tests/test-suite.log
==============================================

# TOTAL: 13
# PASS: 6
# SKIP: 6
# XFAIL: 0
# FAIL: 1
# XPASS: 0
# ERROR: 0

.. contents:: :depth: 2

FAIL: check_clamav
==================

Using test case timeout of 900 seconds set by user
Running suite(s): cl_api
 cli
 jsnorm
 str
 regex
 disasm
 unique
 matchers
 htmlnorm
 bytecode
99%: Checks: 964, Failures: 1, Errors: 1
check_bytecode.c:127:F:arithmetic:test_inflate_jit:0: cli_bytecode_run failed, expected: 0, have: 28

check_bytecode.c:108:E:arithmetic:test_inflate_int:0: (after this point) Received signal 11 (Segmentation fault)
NOTICE: Use the 'T' environment variable to adjust testcase timeout
FAIL check_clamav (exit status: 1)

SKIP: check_unit_vg.sh
======================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check_unit_vg.sh (exit status: 77)

SKIP: check5_clamd_vg.sh
========================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check5_clamd_vg.sh (exit status: 77)

SKIP: check6_clamd_vg.sh
========================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check6_clamd_vg.sh (exit status: 77)

SKIP: check7_clamd_hg.sh
========================

SKIP check7_clamd_hg.sh (exit status: 77)

SKIP: check8_clamd_hg.sh
========================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check8_clamd_hg.sh (exit status: 77)

SKIP: check9_clamscan_vg.sh
===========================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check9_clamscan_vg.sh (exit status: 77)

============================================================================
Testsuite summary for ClamAV 0.99.2
============================================================================
# TOTAL: 13
# PASS: 6
# SKIP: 6
# XFAIL: 0
# FAIL: 1
# XPASS: 0
# ERROR: 0
============================================================================
See unit_tests/test-suite.log
Please report to http://bugs.clamav.net/
============================================================================
Makefile:1085: recipe for target 'test-suite.log' failed
make[5]: *** [test-suite.log] Error 1
make[5]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
Makefile:1191: recipe for target 'check-TESTS' failed
make[4]: *** [check-TESTS] Error 2
make[4]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
Makefile:1348: recipe for target 'check-am' failed
make[3]: *** [check-am] Error 2
make[3]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
Makefile:753: recipe for target 'check-recursive' failed
make[2]: *** [check-recursive] Error 1
make[2]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1'
dh_auto_test: make -j1 check VERBOSE=1 V=1 VERBOSE=1 returned exit code 2
debian/rules:150: recipe for target 'override_dh_auto_test' failed
make[1]: *** [override_dh_auto_test] Error 2
make[1]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1'
debian/rules:71: recipe for target 'build' failed
make: *** [build] Error 2

BTW, there is no such file as "unit_tests/test-suite.log".

Tags: ftbfs patch

CVE References

Revision history for this message
Seth Arnold (seth-arnold) wrote : Bug is not a security issue

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

information type: Private Security → Public
Revision history for this message
Christian Ehrhardt  (paelzer) wrote : Re: check_clamav fails

Hi Jean,
that matches the error in [1].
But please do note that this is only in artful-proposed and the error prevents it from migrating there. I can only assume that the uploader is working on it anyway.

Until then please use the older version that is released [2], although this was still build when there was no artful release yet. Maybe it became a FTBFS [3] due to other changes in artful and this is why Gianfranco is working on it.

I'll subscribe him so he can share what he knows.

[1]: https://launchpadlibrarian.net/317947922/buildlog_ubuntu-artful-amd64.clamav_0.99.2+dfsg-6ubuntu1_BUILDING.txt.gz
[2]: https://launchpad.net/ubuntu/+source/clamav/0.99.2+dfsg-6
[3]: http://packaging.ubuntu.com/html/fixing-ftbfs.html

Changed in clamav (Ubuntu):
status: New → Confirmed
Revision history for this message
Gianfranco Costamagna (costamagnagianfranco) wrote :

The reasons for it not building are outside my knowledge, doko did a llvm-defaults transition without checking and rebuilding rdeps, so I don't know when this started to be broken, and I don't know how to fix it.
Just FYI, even zesty is broken right now, in the mean that a no-change rebuild of clamav has the same testsuite failure.

Just use the package in release pocket should work, because this change is mostly to pick up versioned symbols in llvm, but this change is retro-compatible (just you wont' benefit from the versioned symbols, and then you might have runtime segfaults in case you mess up with many llvm installations)

so, @paelzer, please try to ask somebody else how to debug when it started failing, I don't plan to do more work here, specially because I don't know how/where to start :(

I did ask to the Debian maintainer help for this, with no answer so far

Nish Aravamudan (nacc)
tags: added: ftbfs
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

For anybody else who is trying to build clamav in current artful, you will need at least the attached fixes to reach the reported test error stage.

Pardon the incomplete DEP3 header as this is work in progress.

Ubuntu Foundations Team Bug Bot (crichton)
tags: added: patch
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

I tried rebuilding with llvm 3.8 and the same test fails. Given that the debian unstable package uses LVM 3.8, something else is going on here in the case of artful.

summary: - check_clamav fails
+ check_clamav test fails
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

I also rebuilt the debian package with llvm-3.9, and the test also passes.

Revision history for this message
jean-christophe manciot (manciot-jeanchristophe) wrote :

I tried to build it with:

apt-cache policy llvm
llvm:
  Installed: 1:4.0-34ubuntu2

I also had no issue when building from the exact same clamav sources (0.99.2+dfsg-6) while on Ubuntu yakkety which uses llvm-3.9.

It seems that the issue originates from incompatibility(ies) between clamav and llvm-4.0.

Bug Watch Updater (bug-watch-updater)
Changed in clamav (Gentoo Linux):
importance: Unknown → Medium
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

No, the test fails in artful even with llvm 3.8 or 3.9. It's something else in the toolchain I believe.

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

The failed test is caused by zlib 1.2.11 in zesty. Downgrading to 1.2.8 allows it to build successfully.

Revision history for this message
In , Marc Deslauriers (mdeslaur) wrote :

Created attachment 7289
patch for newer zlib

When building ClamAV with zlib 1.2.9+, the following test fails during build:

check_bytecode.c:127:F:arithmetic:test_inflate_jit:0: cli_bytecode_run failed, expected: 0, have: 28

check_bytecode.c:108:E:arithmetic:test_inflate_int:0: (after this point) Received signal 11 (Segmentation fault)

Downstream bug:
https://bugs.launchpad.net/ubuntu/+source/clamav/+bug/1692073

This is caused by the following commit to zlib 1.2.9:
https://github.com/madler/zlib/commit/b516b4bdd7c0c9f0858adfebf732089014f7b282

Attached is the patch I used to fix this issue in Ubuntu. Thanks.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package clamav - 0.99.2+dfsg-6ubuntu2

---------------
clamav (0.99.2+dfsg-6ubuntu2) artful; urgency=medium

  * SECURITY UPDATE: DoS via crafted e-mail message
    - debian/patches/CVE-2017-6418.patch: fix invalid read in
      libclamav/message.c.
    - CVE-2017-6418
  * SECURITY UPDATE: DoS via WWPack compression
    - debian/patches/CVE-2017-6420.patch: add bounds checks to
      libclamav/wwunpack.c.
    - debian/patches/CVE-2017-6420-2.patch: fix unit tests in
      libclamav/wwunpack.c, unit_tests/check_jsnorm.c.
    - CVE-2017-6420
  * debian/patches/fix_newer_zlib.patch: fix compatibility with zlib
    1.2.9 and newer (LP: #1692073).

 -- Marc Deslauriers <email address hidden> Tue, 15 Aug 2017 16:04:46 -0400

Changed in clamav (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
jean-christophe manciot (manciot-jeanchristophe) wrote :

Building 0.99.2+dfsg-6ubuntu2 in **Zesty**:

dpkg-shlibdeps: error: no dependency information found for /usr/lib/libxml2.so.2 (used by debian/libclamav7/usr/lib/x86_64-linux-gnu/libclamav.so.7.1.1)
Hint: check if the library actually comes from a package.
dh_shlibdeps: dpkg-shlibdeps -Tdebian/libclamav7.substvars debian/libclamav7/usr/lib/x86_64-linux-gnu/libclamav.so.7.1.1 returned exit code 2
dh_shlibdeps: Aborting due to earlier error
debian/rules:71: recipe for target 'binary' failed
make: *** [binary] Error 25
dpkg-buildpackage: error: fakeroot debian/rules binary gave error exit status 2

Although:
# apt-cache policy libxml2-dev
libxml2-dev:
  Installed: 2.9.4+dfsg1-2.2

It turns out that the requested file does not exist in Zesty:
# apt-file search /usr/lib/libxml2.so.2
#

However, the same requested lib file is offered in another location by libxml2:
1) in Zesty:
-----------
# apt-file search libxml2.so.2
...
libxml2: /usr/lib/x86_64-linux-gnu/libxml2.so.2
...

2) in Artful:
------------
# dpkg --contents libxml2_2.9.4+dfsg1-3build2_amd64.deb | grep libxml2.so.2
-rw-r--r-- root/root 1801528 2017-08-02 22:08 ./usr/lib/x86_64-linux-gnu/libxml2.so.2.9.4
lrwxrwxrwx root/root 0 2017-08-02 22:08 ./usr/lib/x86_64-linux-gnu/libxml2.so.2 -> libxml2.so.2.9.4

In both Ubuntu releases, the file libxml2.so.2 is located in:
/usr/lib/x86_64-linux-gnu

Revision history for this message
jean-christophe manciot (manciot-jeanchristophe) wrote :

If, and only if, I add the following 2 lines to debian/rules, the build passes:
override_dh_shlibdeps:
        dh_shlibdeps --dpkg-shlibdeps-params=--ignore-missing-info

Revision history for this message
In , Stevmorg (stevmorg) wrote :

Marc,

Thanks for reporting this and for sending a patch. Targeting for the 0.99.3 release pending tests.

Revision history for this message
In , Stevmorg (stevmorg) wrote :

*** Bug 11891 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Stevmorg (stevmorg) wrote :

*** Bug 11742 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Stevmorg (stevmorg) wrote :

Patch applied in commit 48fef7b8ec06dbfbf899986cdcbe05071a633eb4, shipping with 0.99.3.

Revision history for this message
In , Stevmorg (stevmorg) wrote :

*** Bug 11893 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Stevmorg (stevmorg) wrote :

*** Bug 11947 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Stevmorg (stevmorg) wrote :

*** Bug 11865 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Stevmorg (stevmorg) wrote :

*** Bug 11736 has been marked as a duplicate of this bug. ***

Bug Watch Updater (bug-watch-updater)
Changed in clamav:
importance: Unknown → Medium
status: Unknown → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.