ZIP uncompressed data is wrong size (read 8759, expected 0)

Robert_Vilhelmsen

Hi

FireboxV running 10.12.2

I see lots of AV scannings errors. Is this expected or a bug?

2024-03-20 09:26:29 scand _copy_data_and_check_file_type: archive_read_data_block() failed, error(-20)='ZIP uncompressed data is wrong size (read 8759, expected 0) ' Debug
2024-03-20 09:26:29 scand scand_dearchive_file: copy_data failed, error='-20' Debug
2024-03-20 09:26:29 scand unpacker: fail to unpack file='tmp/scan_01.B7e2WX' Debug
2024-03-20 09:26:29 scand scan_wg: failed to dearchive file='tmp/scan_01.B7e2WX' Debug

2024-03-20 09:31:35 scand scand_is_android_apk: Local file header[2]: unknown signature='00002237' Debug
2024-03-20 09:31:35 scand _copy_data_and_check_file_type: archive_read_data_block() failed, error(-20)='ZIP uncompressed data is wrong size (read 8759, expected 0) ' Debug
2024-03-20 09:31:35 scand scand_dearchive_file: copy_data failed, error='-20' Debug
2024-03-20 09:31:35 scand unpacker: fail to unpack file='tmp/scan_02.gRpjPT' Debug
2024-03-20 09:31:35 scand scan_wg: failed to dearchive file='tmp/scan_02.gRpjPT' Debug

Regards
Robert

Bruce_Briggs

Is Diagnostic Logging for Gateway AV and DLP set to Error?

Robert_Vilhelmsen

Yes. Looks as there is something wrong with definitions files the firebox downloads even though fireware reports image valid for the files, if i turn up logging.

james.carson

Hi @Robert_Vilhelmsen

If you've verified these are ZIP files that can be opened, I'd suggest opening a support case for this. The AV service will attempt to expand any file it thinks could potentially be an archive, so it's not uncommon to see errors for things that don't end up being archives or can't be opened.

If the definitions on the firebox are somehow broken, support can help remove the bad definitions so the firebox will re-download them from the update servers.

Robert_Vilhelmsen

@james.carson

Thanks. I don´t know what the files are and did not think of this.
I will check it out.

/Robert