>Number:         28587
>Category:       pkg
>Synopsis:       clamav unaligned access warnings on alpha
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Dec 08 14:00:00 +0000 2004
>Originator:     Nicolas Joly
>Release:        NetBSD 2.99.11
>Organization:
	Institut Pasteur
>Environment:
System: NetBSD thanos.sis.pasteur.fr 2.99.11 NetBSD 2.99.11 (THANOS) #10: Mon Dec 6 11:17:29 CET 2004 njoly@thanos.sis.pasteur.fr:/local/src/NetBSD/obj/alpha/sys/arch/alpha/compile/THANOS alpha
Architecture: alpha
Machine: alpha
>Description:
clamscan may generate `unaligned access' warnings, while scanning PE
executables.

I tracked this problem and found at least 2 different locations, that may
trigger this problem:

* cli_readint32() function (libclamav/others.c:502):
	ret = *(int32_t *) buff;

* doubleebx() function (libclamav/upx.c:77):
	*myebx = oldebx*2+1;

>How-To-Repeat:

njoly@thanos [~/virus]> clamscan -V
ClamAV 0.80/621/Tue Dec  7 13:55:16 2004
njoly@thanos [~/virus]> clamscan --no-summary 2k.exe
pid 1219 (clamscan): unaligned access: va=0x1ffffe00a pc=0x160073a90 ra=0x16009581c sp=0x1ffffddf8 op=ldl
2k.exe: Trojan.LdPinch-19 FOUND
njoly@thanos [~/virus]> clamscan --no-summary under.bat        
pid 1346 (clamscan): unaligned access: va=0x120026615 pc=0x16009fab4 ra=0x16009f
b48 sp=0x1ffffdda0 op=ldl
pid 1346 (clamscan): unaligned access: va=0x120026619 pc=0x16009fab4 ra=0x16009f
b9c sp=0x1ffffdda0 op=ldl
pid 1346 (clamscan): unaligned access: va=0x12002661d pc=0x16009fab4 ra=0x16009f
b9c sp=0x1ffffdda0 op=ldl
[...]
pid 1346 (clamscan): unaligned access: va=0x1200267f1 pc=0x16009fab4 ra=0x1600a0
174 sp=0x1ffffdd90 op=ldl
pid 1346 (clamscan): unaligned access: va=0x1200267f5 pc=0x16009fab4 ra=0x1600a0
1c0 sp=0x1ffffdd90 op=ldl
pid 1346 (clamscan): unaligned access: va=0x1200267f9 pc=0x16009fab4 ra=0x1600a0
19c sp=0x1ffffdd90 op=ldl
under.bat: OK

>Fix: