fumiyas/samba-virusfilter — pull request #2 by steve999lee (2013-04-19 10:44:21+00:00)
Title: Update svf-utils.c

We experience a problem with scan on close = yes (and scan on open = no) where the samba process is terminated and coredump produced. This seems to happen only on slower network connections when saving microsoft office documents.
On investigation it looks like an access after free error when accessing the cache and this is caused when the last entry of the cache is deleted (and freed) and the *end pointer is set to the *prev pointer of the entry about to be deleted. In samba 3.6 the *prev pointer points the itself for the last entry (see DLIST_ADD) which means that *end is set to an entry which has been removed and freed.
This fix seems to fix it and so does disabling the cache (svf-clamav:cache entry limit = -1).
I'm still not entirely sure why it only happens on slow connections?

I'm not really sure why you would want to use the cache when just using scan on close - seems like it should never get used.