/opt/local/var/macports/software/gdk-pixbuf2/gdk-pixbuf2-2.42.0_0+x11.darwin_15.x86_64.tbz2: BC.Gif.Exploit.Agent-1425366.Agent FOUND

[dbl001 (dbl)]

Most likely a false positive from ClamAV.

$ sudo port list gdk-pixbuf2
Password:
gdk-pixbuf2                    @2.42.0         graphics/gdk-pixbuf2

/opt/local/libexec/installed-tests/gdk-pixbuf/test-images/gif-test-suite/max-width.gif: BC.Gif.Exploit.Agent-1425366.Agent FOUND
traverse_unlink: Failed to unlink: /opt/local/libexec/installed-tests/gdk-pixbuf/test-images/gif-test-suite/max-width.gif
/opt/local/var/macports/software/gdk-pixbuf2/gdk-pixbuf2-2.42.0_0+x11.darwin_15.x86_64.tbz2: BC.Gif.Exploit.Agent-1425366.Agent FOUND

[nortcele]

It seems that clamav is right in finding a potential problem and that gdk-pixbuf is making legitimate use of a potentially dangerous code. See ​https://bugs.gentoo.org/685722.

[michaelld (Michael Dickens)]

Thanks for the report. Let me quote from the GenToo bug report, since it's relevant here:

"there's nothing we can do about it:

Upstream has added a test case for ​https://bugzilla.gnome.org/show_bug.cgi?id=775693. However, the test could also be used as exploit, that's why clamav is detecting that file.

Because there's a valid reason for ClamAV to detect that code and there's a valid reason for gdk-pixbuf upstream to carry such a test, we cannot do anything."

[mascguy (Christopher Nielsen)]

Take over Dave's tickets for GTK and friends, now that he's formally dropped maintainership. Boo! ;-)

[mascguy (Christopher Nielsen)]

Replying to michaelld:

Thanks for the report. Let me quote from the GenToo bug report, since it's relevant here:

"there's nothing we can do about it:

Upstream has added a test case for ​https://bugzilla.gnome.org/show_bug.cgi?id=775693. However, the test could also be used as exploit, that's why clamav is detecting that file.

Because there's a valid reason for ClamAV to detect that code and there's a valid reason for gdk-pixbuf upstream to carry such a test, we cannot do anything."

Closing, since there's nothing we can do to fix this.

[ballapete (Peter "Pete" Dyballa)]

Isn't it possible to not install the test files? I presume they are only used for a case like make test or make check so that there's not much sense in installing it – or would anyone go and test the software after it has been installed?

Two other options are to patch that intrusive file that ClamAV cannot find the virus or not installing it at all, neither on disk nor in the tbz2 archive file.

[ballapete (Peter "Pete" Dyballa)]

Emmanuele Bassi from GNOME Team explains here, ​https://discourse.gnome.org/t/gdk-pixbuf-test-file-gdk-pixbuf-2-42-2-tests-test-images-gif-test-suite-max-width-gif-with-a-virus/12152/4, i.e. use -Dinstalled_tests=false when configuring the build, how to disable installation of test files.

[ballapete (Peter "Pete" Dyballa)]

Replying to ballapete:

It works using this additional configure argument.

[ballapete (Peter "Pete" Dyballa)]

Some weeks ago I tried to report the problem to the ClamAV people – no answer yet.