check_clamav test fails

Bug #1692073 reported by jean-christophe manciot on 2017-05-19
20
This bug affects 2 people
Affects Status Importance Assigned to Milestone
ClamAV
Unknown
Unknown
clamav (Gentoo Linux)
Unknown
Medium
clamav (Ubuntu)
Undecided
Unassigned

Bug Description

Ubuntu 17.04
clamav sources 0.99.2+dfsg-6ubuntu1 from launchpad: https://launchpad.net/ubuntu/+source/clamav/0.99.2+dfsg-6ubuntu1

Building with:
sudo -u actionmystique -H dpkg-buildpackage --build=binary -m"Jean-Christophe Manciot <email address hidden>"

leads to:
...
make check-TESTS
make[4]: Entering directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
make[5]: Entering directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
FAIL: check_clamav
PASS: check_freshclam.sh
PASS: check_sigtool.sh
SKIP: check_unit_vg.sh
PASS: check1_clamscan.sh
PASS: check2_clamd.sh
PASS: check3_clamd.sh
PASS: check4_clamd.sh
SKIP: check5_clamd_vg.sh
SKIP: check6_clamd_vg.sh
SKIP: check7_clamd_hg.sh
SKIP: check8_clamd_hg.sh
SKIP: check9_clamscan_vg.sh
==============================================
   ClamAV 0.99.2: unit_tests/test-suite.log
==============================================

# TOTAL: 13
# PASS: 6
# SKIP: 6
# XFAIL: 0
# FAIL: 1
# XPASS: 0
# ERROR: 0

.. contents:: :depth: 2

FAIL: check_clamav
==================

Using test case timeout of 900 seconds set by user
Running suite(s): cl_api
 cli
 jsnorm
 str
 regex
 disasm
 unique
 matchers
 htmlnorm
 bytecode
99%: Checks: 964, Failures: 1, Errors: 1
check_bytecode.c:127:F:arithmetic:test_inflate_jit:0: cli_bytecode_run failed, expected: 0, have: 28

check_bytecode.c:108:E:arithmetic:test_inflate_int:0: (after this point) Received signal 11 (Segmentation fault)
NOTICE: Use the 'T' environment variable to adjust testcase timeout
FAIL check_clamav (exit status: 1)

SKIP: check_unit_vg.sh
======================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check_unit_vg.sh (exit status: 77)

SKIP: check5_clamd_vg.sh
========================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check5_clamd_vg.sh (exit status: 77)

SKIP: check6_clamd_vg.sh
========================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check6_clamd_vg.sh (exit status: 77)

SKIP: check7_clamd_hg.sh
========================

SKIP check7_clamd_hg.sh (exit status: 77)

SKIP: check8_clamd_hg.sh
========================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check8_clamd_hg.sh (exit status: 77)

SKIP: check9_clamscan_vg.sh
===========================

*** valgrind tests skipped by default, use 'make check VG=1' to activate
SKIP check9_clamscan_vg.sh (exit status: 77)

============================================================================
Testsuite summary for ClamAV 0.99.2
============================================================================
# TOTAL: 13
# PASS: 6
# SKIP: 6
# XFAIL: 0
# FAIL: 1
# XPASS: 0
# ERROR: 0
============================================================================
See unit_tests/test-suite.log
Please report to http://bugs.clamav.net/
============================================================================
Makefile:1085: recipe for target 'test-suite.log' failed
make[5]: *** [test-suite.log] Error 1
make[5]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
Makefile:1191: recipe for target 'check-TESTS' failed
make[4]: *** [check-TESTS] Error 2
make[4]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
Makefile:1348: recipe for target 'check-am' failed
make[3]: *** [check-am] Error 2
make[3]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1/unit_tests'
Makefile:753: recipe for target 'check-recursive' failed
make[2]: *** [check-recursive] Error 1
make[2]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1'
dh_auto_test: make -j1 check VERBOSE=1 V=1 VERBOSE=1 returned exit code 2
debian/rules:150: recipe for target 'override_dh_auto_test' failed
make[1]: *** [override_dh_auto_test] Error 2
make[1]: Leaving directory '/home/actionmystique/src/ClamAV/clamav-0.99.2+dfsg-6ubuntu1'
debian/rules:71: recipe for target 'build' failed
make: *** [build] Error 2

BTW, there is no such file as "unit_tests/test-suite.log".

CVE References

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

information type: Private Security → Public

Hi Jean,
that matches the error in [1].
But please do note that this is only in artful-proposed and the error prevents it from migrating there. I can only assume that the uploader is working on it anyway.

Until then please use the older version that is released [2], although this was still build when there was no artful release yet. Maybe it became a FTBFS [3] due to other changes in artful and this is why Gianfranco is working on it.

I'll subscribe him so he can share what he knows.

[1]: https://launchpadlibrarian.net/317947922/buildlog_ubuntu-artful-amd64.clamav_0.99.2+dfsg-6ubuntu1_BUILDING.txt.gz
[2]: https://launchpad.net/ubuntu/+source/clamav/0.99.2+dfsg-6
[3]: http://packaging.ubuntu.com/html/fixing-ftbfs.html

Changed in clamav (Ubuntu):
status: New → Confirmed

The reasons for it not building are outside my knowledge, doko did a llvm-defaults transition without checking and rebuilding rdeps, so I don't know when this started to be broken, and I don't know how to fix it.
Just FYI, even zesty is broken right now, in the mean that a no-change rebuild of clamav has the same testsuite failure.

Just use the package in release pocket should work, because this change is mostly to pick up versioned symbols in llvm, but this change is retro-compatible (just you wont' benefit from the versioned symbols, and then you might have runtime segfaults in case you mess up with many llvm installations)

so, @paelzer, please try to ask somebody else how to debug when it started failing, I don't plan to do more work here, specially because I don't know how/where to start :(

I did ask to the Debian maintainer help for this, with no answer so far

Nish Aravamudan (nacc) on 2017-06-20
tags: added: ftbfs
Andreas Hasenack (ahasenack) wrote :

For anybody else who is trying to build clamav in current artful, you will need at least the attached fixes to reach the reported test error stage.

Pardon the incomplete DEP3 header as this is work in progress.

tags: added: patch
Andreas Hasenack (ahasenack) wrote :

I tried rebuilding with llvm 3.8 and the same test fails. Given that the debian unstable package uses LVM 3.8, something else is going on here in the case of artful.

summary: - check_clamav fails
+ check_clamav test fails
Andreas Hasenack (ahasenack) wrote :

I also rebuilt the debian package with llvm-3.9, and the test also passes.

I tried to build it with:

apt-cache policy llvm
llvm:
  Installed: 1:4.0-34ubuntu2

I also had no issue when building from the exact same clamav sources (0.99.2+dfsg-6) while on Ubuntu yakkety which uses llvm-3.9.

It seems that the issue originates from incompatibility(ies) between clamav and llvm-4.0.

Changed in clamav (Gentoo Linux):
importance: Unknown → Medium
Andreas Hasenack (ahasenack) wrote :

No, the test fails in artful even with llvm 3.8 or 3.9. It's something else in the toolchain I believe.

Marc Deslauriers (mdeslaur) wrote :

The failed test is caused by zlib 1.2.11 in zesty. Downgrading to 1.2.8 allows it to build successfully.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package clamav - 0.99.2+dfsg-6ubuntu2

---------------
clamav (0.99.2+dfsg-6ubuntu2) artful; urgency=medium

  * SECURITY UPDATE: DoS via crafted e-mail message
    - debian/patches/CVE-2017-6418.patch: fix invalid read in
      libclamav/message.c.
    - CVE-2017-6418
  * SECURITY UPDATE: DoS via WWPack compression
    - debian/patches/CVE-2017-6420.patch: add bounds checks to
      libclamav/wwunpack.c.
    - debian/patches/CVE-2017-6420-2.patch: fix unit tests in
      libclamav/wwunpack.c, unit_tests/check_jsnorm.c.
    - CVE-2017-6420
  * debian/patches/fix_newer_zlib.patch: fix compatibility with zlib
    1.2.9 and newer (LP: #1692073).

 -- Marc Deslauriers <email address hidden> Tue, 15 Aug 2017 16:04:46 -0400

Changed in clamav (Ubuntu):
status: Confirmed → Fix Released

Building 0.99.2+dfsg-6ubuntu2 in **Zesty**:

dpkg-shlibdeps: error: no dependency information found for /usr/lib/libxml2.so.2 (used by debian/libclamav7/usr/lib/x86_64-linux-gnu/libclamav.so.7.1.1)
Hint: check if the library actually comes from a package.
dh_shlibdeps: dpkg-shlibdeps -Tdebian/libclamav7.substvars debian/libclamav7/usr/lib/x86_64-linux-gnu/libclamav.so.7.1.1 returned exit code 2
dh_shlibdeps: Aborting due to earlier error
debian/rules:71: recipe for target 'binary' failed
make: *** [binary] Error 25
dpkg-buildpackage: error: fakeroot debian/rules binary gave error exit status 2

Although:
# apt-cache policy libxml2-dev
libxml2-dev:
  Installed: 2.9.4+dfsg1-2.2

It turns out that the requested file does not exist in Zesty:
# apt-file search /usr/lib/libxml2.so.2
#

However, the same requested lib file is offered in another location by libxml2:
1) in Zesty:
-----------
# apt-file search libxml2.so.2
...
libxml2: /usr/lib/x86_64-linux-gnu/libxml2.so.2
...

2) in Artful:
------------
# dpkg --contents libxml2_2.9.4+dfsg1-3build2_amd64.deb | grep libxml2.so.2
-rw-r--r-- root/root 1801528 2017-08-02 22:08 ./usr/lib/x86_64-linux-gnu/libxml2.so.2.9.4
lrwxrwxrwx root/root 0 2017-08-02 22:08 ./usr/lib/x86_64-linux-gnu/libxml2.so.2 -> libxml2.so.2.9.4

In both Ubuntu releases, the file libxml2.so.2 is located in:
/usr/lib/x86_64-linux-gnu

If, and only if, I add the following 2 lines to debian/rules, the build passes:
override_dh_shlibdeps:
        dh_shlibdeps --dpkg-shlibdeps-params=--ignore-missing-info

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.