Skip to content

FreshClam: use the configured outdated hook in daemon mode - #1770

Open
val-ms wants to merge 1 commit into
Cisco-Talos:mainfrom
val-ms:CLAM-3025-freshclam-onoutdated-hook
Open

FreshClam: use the configured outdated hook in daemon mode#1770
val-ms wants to merge 1 commit into
Cisco-Talos:mainfrom
val-ms:CLAM-3025-freshclam-onoutdated-hook

Conversation

@val-ms

@val-ms val-ms commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Fix the FreshClam daemon update loop to pass OnOutdatedExecute to the database update helper when the outdated-version hook is enabled.
  • Preserve the existing non-daemon behavior, which already passed the correct hook.

Rationale

The non-daemon update path correctly passes OnOutdatedExecute when the outdated hook is configured. The daemon loop checked whether OnOutdatedExecute was enabled, but accidentally passed the OnUpdateExecute command string. That could cause daemon-mode outdated-version events to run the update hook, or to run no hook when only OnOutdatedExecute was configured.

Validation

  • git diff --check
  • cmake --build build --target freshclam-bin -j12

Credit

Reported by Nir Yehoshua, Cipher Security Labs.

FreshClam's non-daemon update path passes OnOutdatedExecute to the database update helper when the outdated-version hook is enabled. The daemon update loop checked the OnOutdatedExecute option but accidentally passed the OnUpdateExecute command string instead.

This could cause daemon-mode outdated-version events to run the update hook, or to run no hook when only OnOutdatedExecute was configured. Pass the OnOutdatedExecute command string in the daemon path so both update modes use the same hook selection.

Credit: Nir Yehoshua, Cipher Security Labs

CLAM-3025

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes FreshClam’s daemon-mode update loop to pass the correct configured “outdated version” hook (OnOutdatedExecute) into perform_database_update(), matching the already-correct non-daemon behavior and ensuring outdated-version events don’t incorrectly run the update hook.

Changes:

  • In daemon mode, pass OnOutdatedExecute (not OnUpdateExecute) as the onOutdatedExecute parameter to perform_database_update().
  • Preserve the non-daemon update path behavior (already correct).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants