carlos / platform Public

| Finding | Disposition | Reason | |---|---|---| | 6 | Declined-and-sound | A matched malware signature can take precedence over a limit heuristic with HeuristicScanPrecedence no. Recording that result as infected satisfies revised D8. ClamAV implementation. | | 7 | Partly closed | §4.3 maps MaxScanTime to StatusError → VerdictFailed, which subsequent sweeps retry. Previously skipped objects still remain skipped after configuration limits increase; §11 explicitly defers that part. | | 8 | Closed | §6.2 now requires adoption, restart and verification of the actual running executable against the exact build SHA before wiring, then repeats the executable check after wiring. |

Reviewed draft 3 at ae1cb880. No files changed or live scans performed.

1. P2 — §§3.2, 4.3 and 7: ZIP extraction can silently truncate despite AlertExceedsMax yes.

ClamAV 1.4.3’s deflate extraction loop stops when expanded output exceeds MaxFileSize, sets Z_STREAM_END, and subsequently scans the truncated temporary file. That branch does not record a limit heuristic. See libclamav/unzip.c:209–227 and :326–335.

For example, the spec permits MaxFileSize=26214400 with MaxScanSize=400M. A small ZIP containing a 500 MiB zero-filled member is truncated to approximately 25 MiB before scanning. The scanned prefix stays below both limits, so the result can be OK. The proposed prefix mapping never runs: internal/clamd/clamd.go:278 classifies it as clean, and internal/objstore/clamav.go:364 records and signs it.

This is a newly identified mechanism that defeats the accepted AlertExceedsMax remedy. It violates D8 without involving malware precedence. The mixed archive can also return infected from its separate EICAR member without ever exercising limit-heuristic precedence.

Fix: Require a tested engine/configuration that reports this truncation as unscanned. One configuration to validate is MaxFileSize sufficiently above MaxScanSize, so the truncated output itself exceeds the aggregate limit. Add separate real-engine fixtures for a single oversized ZIP member and aggregate expansion across smaller members; require their raw limit replies before accepting §7.

Verdict: accept with fixes.