Left shift causes an undefined-behavior in function cli_hex2num()

[skorpion98]

Describe the bug

We found an undefined-behavior caused by a left shift operation in function cli_hex2num()

clamav/libclamav/str.c

Line 211 in 19b25ce

ret = (ret << 4) | hexval;

after testing one of the harnesses provided on the OSS-Fuzz repository (clamav_dbload_YARA_fuzzer).
More specifically, the program performs a left shift of 4 places of a variable of type ‘int’, but the result cannot be represented by the destination type ‘int’.

How to reproduce the problem

In the attached archive you will find:

• the executable on which we performed our tests
• the input file that caused the bug
• the output of ASan confirming our finding

To reproduce the error, simply run the given binary with the testcase files with a command like: `./clamav_dbload_YARA_fuzzer /path_to_testcases/input

The program has been tested on the standard Docker image provided on OSS-Fuzz using Ubuntu 20.04, providing AFL++ as fuzzing engine and build flag --sanitizer=undefined.

The hash commit used to perform the tests is 25ca17b

Environment

• OS: Linux
• Version/Distribution: Ubuntu 20.04
• Architecture: x86_64