Clamscan Crashes on AIX When Scanning ZIP Files Containing MS-EXE/DLL Files

[caiusionduca]

Hello,

I am encountering an issue with ClamAV on AIX 7.2. Specifically, Clamscan crashes when scanning certain ZIP or JAR files that contain MS-EXE/DLL files inside. For example:

/var/ibm/InstallationManager/bundles/plugins/com.ibm.ws.check.os.v80_8.0.5024.20230413_1800.jar
/opt/freeware/lib/python3.7/ensurepip/_bundled/pip-22.0.4-py3-none-any.whl
This issue seems to occur only with files containing Windows executables or libraries (MS-EXE/DLL). Other ZIP or JAR files without these contents scan successfully.

I am using ClamAV version 1:1.0.7-2.ppc. The crashes do not produce meaningful error messages, making it difficult to identify the root cause.

Has anyone else experienced this issue on AIX or other platforms? Are there known workarounds or fixes for handling such files without causing Clamscan to crash?

I would greatly appreciate any guidance or suggestions from the community.

Thank you in advance for your help!

[KamathForAIX]

@micahsnyder ,

@caiusionduca has reported this issue correctly. The other AIX customers will also see this issue.

What is happening is we have a problem here

This load module function will not work properly in AIX since we do not have a LD_LIBRARY_PATH environment variable. We have a LIBPATH environment variable, which we can use.

Hence the below happens

LibClamAV debug: searching for unrar: /opt/freeware/lib/libclamunrar_iface.a.11 not found
LibClamAV debug: searching for unrar: /opt/freeware/lib/libclamunrar_iface.a not found
LibClamAV debug: searching for unrar: /opt/freeware/lib/libclamunrar_iface..a not found
LibClamAV debug: Cannot dlopen libclamunrar_iface:      0509-022 Cannot load module /opt/freeware/lib/libclamunrar_iface..a.
        0509-026 System error: A file or directory in the path name does not exist. - unrar support unavailable
LibClamAV debug: Initialized 1.0.7 engine
LibClamAV debug: Initializing phishcheck module
LibClamAV debug: Phishcheck: Compiling rege

And Clamscan crashes with a core dump.

I would like to make changes in that place to support this in AIX and raise a PR. I am working on the fix and testing.

Want to keep you informed, @micahsnyder :)

[micahsnyder]

@KamathForAIX I don't think the library load issue has anything to do with the crash. The dynamic unrar loading process is designed to keep going if unrar can't be found.

Can you test if the crash also occurs in 1.4? We've made a number of code quality improvements in the PE (EXE/DLL) parser since 1.0 along the lines of pointer alignment, overlapping memory copies, and more.

E.g.

• cli_check_mydoom_log: Avoid unaligned access. #1293
• 6bed758
• ba4a561