Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 638932 - app-antivirus/clamav-0.99.2-r1 hit SIGSEGV in libpcre2-10.30 library
Summary: app-antivirus/clamav-0.99.2-r1 hit SIGSEGV in libpcre2-10.30 library
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Antivirus Team
URL: https://bugzilla.clamav.net/show_bug....
Whiteboard:
Keywords: PATCH
Depends on:
Blocks:
 
Reported: 2017-11-27 00:37 UTC by Jiří Moravec
Modified: 2017-12-07 15:29 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
gdb and objdump outputs (debug.list,11.33 KB, text/plain)
2017-11-27 20:11 UTC, Jiří Moravec
Details
Patch correcting size of erroroffset variable on 64bit archs (clamav-0.99.2-pcre2-compile-erroffset.patch,540 bytes, patch)
2017-11-28 13:56 UTC, Jiří Moravec
Details | Diff
new ebuild (clamav-0.99.2-r1.ebuild,5.05 KB, text/plain)
2017-11-28 13:57 UTC, Jiří Moravec
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Jiří Moravec 2017-11-27 00:37:31 UTC
$ gdb /usr/sbin/clamd
....
(gdb) run --debug -c /etc/clamd.conf
....
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff45fdc69 in _pcre2_memctl_malloc_8 (size=size@entry=80, memctl=memctl@entry=0x555500000000) at /usr/src/debug/dev-libs/libpcre2-10.30/pcre2-10.30/src/pcre2_context.c:89
89      void *yield = (memctl == NULL)? malloc(size) :

(gdb)bt
#0  0x00007ffff45fdc69 in _pcre2_memctl_malloc_8 (size=size@entry=80, memctl=memctl@entry=0x555500000000) at /usr/src/debug/dev-libs/libpcre2-10.30/pcre2-10.30/src/pcre2_context.c:89
#1  0x00007ffff45fdd69 in pcre2_match_context_create_8 (gcontext=0x555500000000) at /usr/src/debug/dev-libs/libpcre2-10.30/pcre2-10.30/src/pcre2_context.c:182
#2  0x00007ffff728b20e in ?? () from /usr/lib64/libclamav.so.7
#3  0x00007ffff7289f78 in cli_pcre_build () from /usr/lib64/libclamav.so.7
#4  0x00007ffff715c2a5 in cl_engine_compile () from /usr/lib64/libclamav.so.7
#5  0x0000555555568302 in ?? ()
#6  0x00007ffff6abef1c in __libc_start_main () from /lib64/libc.so.6
#7  0x0000555555560eea in ?? ()

Which is funny because I found funct "pcre2_match_context_create_8" at 0x0fd58 offset in /usr/lib64/libpcre2-8.so.0, but not "*pcre2_memctl_malloc_8"

(gdb) info symbol 0x00007ffff45fdd69
pcre2_match_context_create_8 + 17 in section .text of /usr/lib64/libpcre2-8.so.0

So on address 0x00007ffff45fdd69 (library offset 0xfd69) is:
fd69:       48 85 c0                test   %rax,%rax

Address 0x00007ffff45fdc69 is just 0x100 bytes before - offset 0xfc69
fc69:       48 8b 76 10             mov    0x10(%rsi),%rsi

but according objdump this is function with beginning at
faf0 <pcre2_config_8@@Base>:

So now I'm really, really confused...
Comment 1 Jiří Moravec 2017-11-27 00:59:28 UTC
Clamav-0.90 version (+ 0.92-gcc6 patch) is immune from this problem. Really interesting...
Comment 2 Jiří Moravec 2017-11-27 01:14:30 UTC
0.99   (gcc6.patch) ... good
0.99.1 (gcc6.patch) ... good
0.99.2              ... good
0.99.2-r1           ... broken

All with gcc-6.4.0/binutils-2.29.1

PS: Previous "Comment 1" was wrong: s/0.90 version/0.99 version/
Comment 3 Jiří Moravec 2017-11-27 07:18:53 UTC
It's the configure line "--disable-gcc-vcheck". Remove it from ebuild and libpcre2 is without SIGSEGV hit.
Comment 4 Jiří Moravec 2017-11-27 13:15:43 UTC
Backtrace and symbols including clamav functs:

(gdb) bt
#0  0x00007ffff47f1c69 in _pcre2_memctl_malloc_8 (size=size@entry=80, memctl=memctl@entry=0x555500000000) at /usr/src/debug/dev-libs/libpcre2-10.30/pcre2-10.30/src/pcre2_context.c:89
#1  0x00007ffff47f1d69 in pcre2_match_context_create_8 (gcontext=0x555500000000) at /usr/src/debug/dev-libs/libpcre2-10.30/pcre2-10.30/src/pcre2_context.c:182
#2  0x00007ffff747f54e in cli_pcre_compile (pd=0x7fffefa944e0, match_limit=10000, match_limit_recursion=5000, options=0, opt_override=0) at regex_pcre.c:152
#3  0x00007ffff747e2b8 in cli_pcre_build (root=0x7ffff1f9e638, match_limit=10000, recmatch_limit=5000, dconf=0x7ffff7f9b3c4) at matcher-pcre.c:444
#4  0x00007ffff73505e5 in cl_engine_compile (engine=0x5555555d8770) at readdb.c:5109
#5  0x0000555555568302 in main (argc=4, argv=0x7fffffffd778) at clamd.c:632

(gdb) info symbol 0x00007ffff47f1c69
_pcre2_memctl_malloc_8 + 9 in section .text of /usr/lib64/libpcre2-8.so.0
(gdb) info symbol 0x00007ffff47f1d69
pcre2_match_context_create_8 + 17 in section .text of /usr/lib64/libpcre2-8.so.0
(gdb) info symbol 0x00007ffff747f54e
cli_pcre_compile + 557 in section .text of /usr/lib64/libclamav.so.7
(gdb) info symbol 0x00007ffff747e2b8
cli_pcre_build + 396 in section .text of /usr/lib64/libclamav.so.7
(gdb) info symbol 0x00007ffff73505e5
cl_engine_compile + 495 in section .text of /usr/lib64/libclamav.so.7
(gdb) info symbol 0x0000555555568302
main + 6746 in section .text of /usr/sbin/clamd
Comment 5 Victor Kustov 2017-11-27 14:39:31 UTC
Is ebuild builded with tests?

Only one difference between 0.99.2 and 0.99.2-r1: new patch.
https://github.com/gentoo/gentoo/commits/master/app-antivirus/clamav/files/clamav-0.99.2-bytecode_api.patch
Comment 6 Jiří Moravec 2017-11-27 15:52:47 UTC
(In reply to Victor Kustov from comment #5)
> Is ebuild builded with tests?
> 
> Only one difference between 0.99.2 and 0.99.2-r1: new patch.
> https://github.com/gentoo/gentoo/commits/master/app-antivirus/clamav/files/
> clamav-0.99.2-bytecode_api.patch

As I wrote in "Comment 3", when "--disable-gcc-vcheck" configure line is removed from 0.99.2-r1.ebuild, no SIGSEGV happened.
Comment 7 Jiří Moravec 2017-11-27 20:03:53 UTC
20b12c <cli_pcre_build@@CLAMAV_PRIVATE>:
    ...
  20b28e:	83 e0 02             	and    $0x2,%eax
  20b291:	85 c0                	test   %eax,%eax
  20b293:	74 28                	je     20b2bd <cli_pcre_build@@CLAMAV_PRIVATE+0x191>
  20b295:	48 8b 45 f8          	mov    -0x8(%rbp),%rax
  20b299:	48 8d 78 20          	ea    0x20(%rax),%rdi
  20b29d:	48 8b 55 c8          	mov    -0x38(%rbp),%rdx
  20b2a1:	48 8b 45 d0          	mov    -0x30(%rbp),%rax
  20b2a5:	41 b8 00 00 00 00    	mov    $0x0,%r8d
  20b2ab:	b9 00 00 00 00       	mov    $0x0,%ecx
  20b2b0:	48 89 c6             	mov    %rax,%rsi
  20b2b3:	e8 69 10 00 00       	callq  20c321 <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0xb43>---
  20b2b8:	89 45 f0             	mov    %eax,-0x10(%rbp)	(VA=0x00007ffff747e2)           |
clamav-0.99.2/libclamav/matcher-pcre.c:444                                                      |
443   pm_dbgmsg("cli_pcre_build: Compiling regex: /%s/\n", pm->pdata.expression);               |
444   ret = cli_pcre_compile(&(pm->pdata), match_limit, recmatch_limit, 0, 0);                  |
445:}                                                                                           |
                                                                                                |
      -------------------------------------------------------------------------------------------
      |
      V
20b7de <cli_pcre_scanbuf@@CLAMAV_PRIVATE>:
  20c321:	55                   	push   %rbp
  20c322:	48 89 e5             	mov    %rsp,%rbp
  20c325:	48 81 ec 50 01 00 00 	sub    $0x150,%rsp
  20c32c:	48 89 bd c8 fe ff ff 	mov    %rdi,-0x138(%rbp)
  20c333:	48 89 b5 c0 fe ff ff 	mov    %rsi,-0x140(%rbp)
  20c33a:	48 89 95 b8 fe ff ff 	mov    %rdx,-0x148(%rbp)
  20c341:	89 8d b4 fe ff ff    	mov    %ecx,-0x14c(%rbp)
  20c347:	44 89 85 b0 fe ff ff 	mov    %r8d,-0x150(%rbp)
  20c34e:	64 48 8b 04 25 28 00 	mov    %fs:0x28,%rax
  20c355:	00 00
  20c357:	48 89 45 f8          	mov    %rax,-0x8(%rbp)
  20c35b:	31 c0                	xor    %eax,%eax
  20c35d:	48 83 bd c8 fe ff ff 	cmpq   $0x0,-0x138(%rbp)
  20c364:	00
  20c365:	74 10                	je     20c377 <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0xb99>
  20c367:	48 8b 85 c8 fe ff ff 	mov    -0x138(%rbp),%rax
  20c36e:	48 8b 40 18          	mov    0x18(%rax),%rax
  20c372:	48 85 c0             	test   %rax,%rax
  20c375:	75 1b                	jne    20c392 <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0xbb4>
    ... 
  20c392:	ba 00 00 00 00       	mov    $0x0,%edx
  20c397:	48 8d 05 e4 fd ff ff 	lea    -0x21c(%rip),%rax        # 20c182 <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0x9a4>
  20c39e:	48 89 c6             	mov    %rax,%rsi
  20c3a1:	48 8d 05 bc fd ff ff 	lea    -0x244(%rip),%rax        # 20c164 <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0x986>
  20c3a8:	48 89 c7             	mov    %rax,%rdi
  20c3ab:	e8 a0 82 e9 ff       	callq  a4650 <pcre2_general_context_create_8@plt>
  20c3b0:	48 89 85 e0 fe ff ff 	mov    %rax,-0x120(%rbp)
  20c3b7:	48 83 bd e0 fe ff ff 	cmpq   $0x0,-0x120(%rbp)
  20c3be:	=
  20c3bf:	75 1b                	jne    20c3dc <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0xbfe>
    ...
  20c3dc:	48 8b 85 e0 fe ff ff 	mov    -0x120(%rbp),%rax
  20c3e3:	48 89 c7             	mov    %rax,%rdi
  20c3e6:	e8 75 82 e9 ff       	callq  a4660 <pcre2_compile_context_create_8@plt>
  20c3eb:	48 89 85 e8 fe ff ff 	mov    %rax,-0x118(%rbp)
  20c3f2:	48 83 bd e8 fe ff ff 	cmpq   $0x0,-0x118(%rbp)
  20c3f9:	00 
  20c3fa:	75 2a                	jne    20c426 <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0xc48>
    ...
  20c426:	83 bd b0 fe ff ff 00 	cmpl   $0x0,-0x150(%rbp)
  20c42d:	74 4a                	je     20c479 <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0xc9b>
    ...
  20c479:	48 8b 85 c8 fe ff ff 	mov    -0x138(%rbp),%rax
  20c480:	8b 40 10             	mov    0x10(%rax),%eax
  20c483:	89 c7                	mov    %eax,%edi
  20c485:	48 8b 85 c8 fe ff ff 	mov    -0x138(%rbp),%rax
  20c48c:	48 8b 40 18          	mov    0x18(%rax),%rax
  20c490:	48 8b b5 e8 fe ff ff 	mov    -0x118(%rbp),%rsi
  20c497:	48 8d 8d dc fe ff ff 	lea    -0x124(%rbp),%rcx
  20c49e:	48 8d 95 d8 fe ff ff 	lea    -0x128(%rbp),%rdx
  20c4a5:	49 89 f1             	mov    %rsi,%r9
  20c4a8:	49 89 c8             	mov    %rcx,%r8
  20c4ab:	48 89 d1             	mov    %rdx,%rcx
  20c4ae:	89 fa                	mov    %edi,%edx
  20c4b0:	48 c7 c6 ff ff ff ff 	mov    $0xffffffffffffffff,%rsi
  20c4b7:	48 89 c7             	mov    %rax,%rdi
  20c4ba:	e8 c1 81 e9 ff       	callq  a4680 <pcre2_compile_8@plt>
  20c4bf:	48 89 c2             	mov    %rax,%rdx
  20c4c2:	48 8b 85 c8 fe ff ff 	mov    -0x138(%rbp),%rax
  20c4c9:	48 89 10             	mov    %rdx,(%rax)
  20c4cc:	48 8b 85 c8 fe ff ff 	mov    -0x138(%rbp),%rax
  20c4d3:	48 8b 00             	mov    (%rax),%rax
  20c4d6:	48 85 c0             	test   %rax,%rax
  20c4d9:	75 64                	jne    20c53f <cli_pcre_scanbuf@@CLAMAV_PRIVATE+0xd61>
    ...
  20c53f:	48 8b 85 e0 fe ff ff 	mov    -0x120(%rbp),%rax
  20c546:	48 89 c7             	mov    %rax,%rdi
  20c549:	e8 62 81 e9 ff       	callq  a46b0 <pcre2_match_context_create_8@plt> --
  20c54e:	48 89 c2             	mov    %rax,%rdx 	(VA=0x00007ffff747f54e)  |
clamav-0.99.2/libclamav/regex_pcre.c:152                                                 |
151:/* setup matching context and set the match limits */                                |
152:pd->mctx = pcre2_match_context_create(gctx);                                         |
153:if (!pd->mctx) {                                                                     |
                                                                                         |
      ------------------------------------------------------------------------------------
      |
      V
<pcre2_match_context_create_8@@Base>
    fd58:	53                   	push   %rbx
    fd59:	48 89 fe             	mov    %rdi,%rsi
    fd5c:	48 89 fb             	mov    %rdi,%rbx
    fd5f:	bf 50 00 00 00       	mov    $0x50,%edi			  size(%edi) = 0x50
    fd64:	e8 f7 fe ff ff       	callq  fc60 <pcre2_config_8@@Base+0x170> ---------
    fd69:	48 85 c0             	test   %rax,%rax	(VA=0x00007ffff47f1d69)  |
pcre2-10.30/src/pcre2_context.c:182                                                      |
176:/* The create function copies the default into the new memory, but must              |
177:override the default memory handling functions if a gcontext was provided. */        |
178:	                                                                              |
179:PCRE2_EXP_DEFN pcre2_match_context * PCRE2_CALL_CONVENTION                           |
180:pcre2_match_context_create(pcre2_general_context *gcontext)                          |
181:{                                                                                    |
182:pcre2_match_context *mcontext = PRIV(memctl_malloc)(                                 |
183:  sizeof(pcre2_real_match_context), (pcre2_memctl *)gcontext);                       |
184:if (mcontext == NULL) return NULL;                                                   |
185:*mcontext = PRIV(default_match_context);                                             |
                                                                                         |
mcontext = 0x555500000000                                                                |
      ------------------------------------------------------------------------------------
      |
      V
<pcre2_config_8@@Base+0x170>
    fc60:	53                   	push   %rbx
    fc61:	48 85 f6             	test   %rsi,%rsi			  (memctl(%rsi) == NULL) ?
    fc64:	74 2a                	je     fc90 <pcre2_config_8@@Base+0x1a0>  malloc(size)
    fc66:	48 89 f3             	mov    %rsi,%rbx			  *malloc(%rbx) = memctl
    fc69:	48 8b 76 10          	mov    0x10(%rsi),%rsi !!SIGSEGV!!	  argv2(%rsi) = memctl->memory_data;
    fc6d:	ff 13                	callq  *(%rbx)				  malloc(size(%rdi), argv2(%rsi))
    fc6f:	48 85 c0             	test   %rax,%rax			  if (yield(%rax) == NULL)
    fc72:	74 16                	je     fc8a <pcre2_config_8@@Base+0x19a>  return NULL
    fc74:	48 8b 13             	mov    (%rbx),%rdx
    fc77:	48 89 10             	mov    %rdx,(%rax)
    fc7a:	48 8b 53 08          	mov    0x8(%rbx),%rdx
    fc7e:	48 89 50 08          	mov    %rdx,0x8(%rax)
    fc82:	48 8b 53 10          	mov    0x10(%rbx),%rdx
    fc86:	48 89 50 10          	mov    %rdx,0x10(%rax)
    fc8a:	5b                   	pop    %rbx
    fc8b:	c3                   	retq   
    fc8c:	0f 1f 40 00          	nopl   0x0(%rax)
    fc90:	e8 4b 23 ff ff       	callq  1fe0 <malloc@plt>		  yield(%rax)=malloc(size)
										  size(%edi) from 0xfd5f
    fc95:	48 85 c0             	test   %rax,%rax			  if (yield == NULL)
    fc98:	74 f0                	je     fc8a <pcre2_config_8@@Base+0x19a>  ? return NULL(%rax)
pcre2-10.30/src/pcre2_context.c:89
85:extern void *
86:PRIV(memctl_malloc)(size_t size, pcre2_memctl *memctl)
87:{
88:pcre2_memctl *newmemctl;
89:void *yield = (memctl == NULL)? malloc(size) :
90:  memctl->malloc(size, memctl->memory_data);
91:if (yield == NULL) return NULL;
92:newmemctl = (pcre2_memctl *)yield;

##########################################################################
(gdb) i r
rax	0x555500000000
rbx	0x555500000000
rcx	0x0
rdx	0x555555732490
rsi	0x555500000000	... pcre2_memctl *memctl	argv2
rdi	0x50		... size_t size			argv1
rbp	0x7fffffffd380
rsp	0x7fffffffd220
r8	0x7ffff483dcbc
r9	0x7fffffff884c
r10	0x555555732490
r11	0x22
r12	0x555555560ec0
r13	0x7fffffffd770
r14	0x0
r15	0x0
rip	0x7ffff47f1d69   0x7ffff47f1d69 <pcre2_match_context_create_8+17>

(gdb) info proc mappings
Start Addr         End Addr         Size       Offset   objfile
0x555555554000     0x55555558a000    0x36000        0x0 /usr/sbin/clamd
0x55555558a000     0x555555592000     0x8000    0x35000 /usr/sbin/clamd
0x555555592000     0x555555593000     0x1000    0x3d000 /usr/sbin/clamd
0x555555593000     0x5555557b2000   0x21f000        0x0 [heap]
0x7ffff47e2000     0x7ffff4863000    0x81000        0x0 /usr/lib64/libpcre2-8.so.0.6.0
0x7ffff4863000     0x7ffff4864000     0x1000    0x80000 /usr/lib64/libpcre2-8.so.0.6.0
0x7ffff4864000     0x7ffff4865000     0x1000    0x81000 /usr/lib64/libpcre2-8.so.0.6.0
0x7ffff7273000     0x7ffff7d59000   0xae6000        0x0 /usr/lib64/libclamav.so.7.1.1
0x7ffff7d59000     0x7ffff7dba000    0x61000   0xae5000 /usr/lib64/libclamav.so.7.1.1
0x7ffff7dba000     0x7ffff7dce000    0x14000   0xb46000 /usr/lib64/libclamav.so.7.1.1

#frame		VA		SO.offset	VA-SO.offset
#0	0x00007ffff47f1c69	0xfc69		0x7FFFF47E2000
#1	0x00007ffff47f1d69	0xfd69		0x7FFFF47E2000
#2	0x00007ffff747f54e	0x20c54e	0x7FFFF7273000
#3	0x00007ffff747e2b8	0x20b2b8	0x7FFFF7273000

#0:0x00007ffff47f1c69 in _pcre2_memctl_malloc_8 (size=size@entry=80, memctl=memctl@entry=0x555500000000) at /usr/src/debug/dev-libs/libpcre2-10.30/pcre2-10.30/src/pcre2_context.c:89 --- offset fc69
#1:0x00007ffff47f1d69 in pcre2_match_context_create_8 (gcontext=0x555500000000) at /usr/src/debug/dev-libs/libpcre2-10.30/pcre2-10.30/src/pcre2_context.c:182 ---- offset fd69
#2:0x00007ffff747f54e in cli_pcre_compile (pd=0x7fffefa944e0, match_limit=10000, match_limit_recursion=5000, options=0, opt_override=0) at regex_pcre.c:152  ---- offset 20c54e
#3:0x00007ffff747e2b8 in cli_pcre_build (root=0x7ffff1f9e638, match_limit=10000, recmatch_limit=5000, dconf=0x7ffff7f9b3c4) at matcher-pcre.c:444 ---- offset 20b2b8
#4:0x00007ffff73505e5 in cl_engine_compile (engine=0x5555555d8770) at readdb.c:5109
#5:0x0000555555568302 in main (argc=4, argv=0x7fffffffd778) at clamd.c:632
Comment 8 Jiří Moravec 2017-11-27 20:11:21 UTC
Created attachment 506858 [details]
gdb and objdump outputs
Comment 9 Jiří Moravec 2017-11-27 20:23:37 UTC
So it's look like clamav provided libpcre2 with wrong pointer to 'memctl' structure. Code of <pcre2_config_8@@Base+0x170> was entered with memctl assress in %rsi=0x555500000000 which is outside process mapped address space - it's starting at 0x555555554000!

Question is why...
Comment 10 Jiří Moravec 2017-11-28 13:29:28 UTC
On my system gctx value (pointer) was stored at 0x7fffffffd260 (64b).
But instruction "<pcre2_compile_8+115>: movq   $0x0,(%r8)" tried to write 64b zero to unaligned address %r8=0x7fffffffd25c. Overwriting lower 32bit of gctx value.

   <pcre2_compile_8+115>:
   0x7ffff47ec7ec +100>: test   %r8,%r8
   0x7ffff47ec7ef +103>: je     0x7ffff47ece88 <pcre2_compile_8+1792>
   0x7ffff47ec7f5 +109>: movl   $0x64,(%rax)
=> 0x7ffff47ec7fb +115>: movq   $0x0,(%r8)
   0x7ffff47ec802 +122>: test   %rdi,%rdi
   0x7ffff47ec805 +125>: je     0x7ffff47edd78 <pcre2_compile_8+5616>
   0x7ffff47ec80b +131>: cmpq   $0x0,0x20(%rsp)

And this value originated in <cli_pcre_compile+324>:
   0x7ffff747f485 +356>:       mov    -0x138(%rbp),%rax
   0x7ffff747f48c +363>:       mov    0x18(%rax),%rax
   0x7ffff747f490 +367>:       mov    -0x118(%rbp),%rsi    rsi=cctx
=> 0x7ffff747f497 +374>:       lea    -0x124(%rbp),%rcx    rcx=&erroffset
   0x7ffff747f49e +381>:       lea    -0x128(%rbp),%rdx    rdx=%errornum
   0x7ffff747f4a5 +388>:       mov    %rsi,%r9
=> 0x7ffff747f4a8 +391>:       mov    %rcx,%r8             copied into r8
Comment 11 Jiří Moravec 2017-11-28 13:53:34 UTC
OK...

pcre2-10.30/src/pcre2_compile.c:
pcre2_compile(PCRE2_SPTR pattern, PCRE2_SIZE patlen, uint32_t options,
   int *errorptr, PCRE2_SIZE *erroroffset, pcre2_compile_context *ccontext)

So erroroffset is pointer to PCRE2_SIZE type, which according header file 
pcre2-10.30/src/pcre2.h is "#define PCRE2_SIZE size_t". 

And how long is size_t on amd64 architecture? 64bit!

While clamav-0.99.2/libclamav/regex_pcre.c:115 contain:
"int errornum, erroffset;"

And how long is int on amd64 architecture? 32bit!
Shite.

Patch and ebuild follows.
PS: clamd is no longer SIGSEGVing...
Comment 12 Jiří Moravec 2017-11-28 13:56:11 UTC
Created attachment 506922 [details, diff]
Patch correcting size of erroroffset variable on 64bit archs
Comment 13 Jiří Moravec 2017-11-28 13:57:42 UTC
Created attachment 506924 [details]
new ebuild
Comment 14 Jiří Moravec 2017-11-28 15:24:00 UTC
Reported to upstream in https://bugzilla.clamav.net/show_bug.cgi?id=11965
Comment 15 Nico Baggus 2017-12-04 03:31:43 UTC
patch works for server, but the clamscan still fails:

[Dec 4 04:01] clamscan[488]: segfault at 55cc00000010 ip 00007f7ea0b21029 sp 00007fff8e7a31a0 error 4 in libpcre2-8.so.0.6.0[7f7ea0b11000+82000]
[Dec 4 04:05] clamscan[2193]: segfault at 55b000000010 ip 00007f19bcec3029 sp 00007ffdec9bd7d0 error 4 in libpcre2-8.so.0.6.0[7f19bceb3000+82000]
Comment 16 Attila Tóth 2017-12-04 08:14:11 UTC
(In reply to Nico Baggus from comment #15)
> patch works for server, but the clamscan still fails:
> 
> [Dec 4 04:01] clamscan[488]: segfault at 55cc00000010 ip 00007f7ea0b21029 sp
> 00007fff8e7a31a0 error 4 in libpcre2-8.so.0.6.0[7f7ea0b11000+82000]
> [Dec 4 04:05] clamscan[2193]: segfault at 55b000000010 ip 00007f19bcec3029
> sp 00007ffdec9bd7d0 error 4 in libpcre2-8.so.0.6.0[7f19bceb3000+82000]

Both clamd and clamscan works fine here.
What was the exact command you are using?
Comment 17 Jiří Moravec 2017-12-04 10:30:28 UTC
(In reply to Nico Baggus from comment #15)
> patch works for server, but the clamscan still fails:
> 
> [Dec 4 04:01] clamscan[488]: segfault at 55cc00000010 ip 00007f7ea0b21029 sp
> 00007fff8e7a31a0 error 4 in libpcre2-8.so.0.6.0[7f7ea0b11000+82000]
> [Dec 4 04:05] clamscan[2193]: segfault at 55b000000010 ip 00007f19bcec3029
> sp 00007ffdec9bd7d0 error 4 in libpcre2-8.so.0.6.0[7f19bceb3000+82000]

That's interesting because I have no problem with clamscan now. Can you provide full backtrace?
Comment 18 Craig Andrews gentoo-dev 2017-12-04 17:39:35 UTC
Pull request submitted upstream to clamav: https://github.com/vrtadmin/clamav-devel/pull/81
Comment 19 Nico Baggus 2017-12-04 19:41:46 UTC
(In reply to Attila Tóth from comment #16)
> (In reply to Nico Baggus from comment #15)
> > patch works for server, but the clamscan still fails:
> > 
> > [Dec 4 04:01] clamscan[488]: segfault at 55cc00000010 ip 00007f7ea0b21029 sp
> > 00007fff8e7a31a0 error 4 in libpcre2-8.so.0.6.0[7f7ea0b11000+82000]
> > [Dec 4 04:05] clamscan[2193]: segfault at 55b000000010 ip 00007f19bcec3029
> > sp 00007ffdec9bd7d0 error 4 in libpcre2-8.so.0.6.0[7f19bceb3000+82000]
> 
> Both clamd and clamscan works fine here.
> What was the exact command you are using?

Eehh. timing issue.....
I recompiled clamav with a missing patch... the errors were from a minute before installing (emerge message of installing) the correct one.
So the old version was still active ;-)

Sorry for the confusion.  - not related. (and wrong time to investigate an issue)..
Comment 20 Thomas Raschbacher gentoo-dev 2017-12-07 10:44:31 UTC
@candrews: looks fine to me, but I can't test it. I won't get around to it yet so feel free to commit it
Comment 21 Larry the Git Cow gentoo-dev 2017-12-07 15:29:07 UTC
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ed2ec9f4ebd6b7cf6c8bcbf06fcbb46d826d6d01

commit ed2ec9f4ebd6b7cf6c8bcbf06fcbb46d826d6d01
Author:     Craig Andrews <candrews@gentoo.org>
AuthorDate: 2017-11-30 16:19:34 +0000
Commit:     Craig Andrews <candrews@gentoo.org>
CommitDate: 2017-12-07 15:28:48 +0000

    app-antivirus/clamav: Fix SIGSEGV on 64bit archs
    
    Suggested-by: Jiří Moravec <qjim@volny.cz>
    Bug: https://bugzilla.clamav.net/show_bug.cgi?id=11965
    Closes: https://bugs.gentoo.org/638932
    Closes: https://bugs.gentoo.org/616564
    Closes: https://github.com/gentoo/gentoo/pull/6358
    Package-Manager: Portage-2.3.16, Repoman-2.3.6

 app-antivirus/clamav/Manifest                      |   2 +-
 app-antivirus/clamav/clamav-0.99.2-r2.ebuild       | 159 +++++++++++++++++++++
 .../clamav-0.99.2-pcre2-compile-erroffset.patch    |  12 ++
 3 files changed, 172 insertions(+), 1 deletion(-)