Skip to content

libclamav: Add PDF stats for metadata collection. - #1546

Merged
val-ms merged 1 commit into
Cisco-Talos:mainfrom
jhumlick:CLAM-2540-add-pdf-metadata
Jan 21, 2026
Merged

libclamav: Add PDF stats for metadata collection.#1546
val-ms merged 1 commit into
Cisco-Talos:mainfrom
jhumlick:CLAM-2540-add-pdf-metadata

Conversation

@jhumlick

Copy link
Copy Markdown
Contributor

More PDF statistics were requested for feature parity. If metadata collection is enabled, the following additional PDF statistics will be collected:

  • Number of Automatic Actions
  • Number of Streams
  • Number of Objects
  • Number of Object Streams
  • Number of Trailers
  • Number of URIs
  • Number of Xrefs

Additionally, some of the parsing logic was fixed during testing of these features.

CLAM-2820

@jhumlick
jhumlick requested a review from val-ms July 31, 2025 00:15
@jhumlick jhumlick self-assigned this Jul 31, 2025

@val-ms val-ms left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two minor issues.

Comment thread libclamav/pdf.c Outdated
Comment thread libclamav/pdf.c Outdated
More PDF statistics were requested for feature parity.
If metadata collection is enabled, the following additional PDF
statistics will be collected:
  - Number of Automatic Actions
  - Number of Streams
  - Number of Objects
  - Number of Object Streams
  - Number of Trailers
  - Number of URIs
  - Number of Xrefs

Additionally, some of the parsing logic was fixed during testing of
these features.

CLAM-2820
@val-ms
val-ms force-pushed the CLAM-2540-add-pdf-metadata branch from 700b5d9 to 20f15cc Compare December 16, 2025 21:17
@val-ms

val-ms commented Dec 17, 2025

Copy link
Copy Markdown
Contributor

I was able to reproduce the failed windows test on my local windows machine. It is concerning, since there is no OS-specific logic in the pdf parser that I'm aware of which would cause it not to run that pdf.stats.nxref++; line 3913. Perhaps there is an issue with if (memcmp(q, "%%EOF", 5) == 0) on Windows?

I'm going to have to diff the debug logs on Windows vs another platform, or else debug-step through with breakpoints to find out what's different.

@val-ms val-ms left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am now unable to reproduce the failed windows build locally, and it passed on both github and jenkins CI/CD. The tests ran okay as well.

@val-ms
val-ms merged commit 17f74cf into Cisco-Talos:main Jan 21, 2026
22 of 24 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants