Created attachment 7305 [details]
poc, pass is virus

There is a read out of bounds in `mbox.c:3134` inside the function `rfc2047`:
```c
3136                 b = messageToBlob(m, 1);
3137                 len = blobGetDataSize(b);
3138                 cli_dbgmsg("Decoded as '%*.*s'\n", (int)len, (int)len,
3139                         (const char *)blobGetData(b));
3140                 memcpy(pout, blobGetData(b), len);
3141                 blobDestroy(b);
3142                 messageDestroy(m);
3143                 if(pout[len - 1] == '\n')
3144                         pout += len - 1;
3145                 else
3146                         pout += len;
```

The backtrace is as following:
```c
   #0 0x81a02ae in rfc2047 /tmp/clamav-devel/libclamav/mbox.c:3147:6
    #1 0x81a02ae in parseEmailHeader /tmp/clamav-devel/libclamav/mbox.c:1057
    #2 0x819af54 in parseEmailBody /tmp/clamav-devel/libclamav/mbox.c:1779:7
    #3 0x8194e47 in cli_parse_mbox /tmp/clamav-devel/libclamav/mbox.c:555:11
    #4 0x8194e47 in cli_mbox /tmp/clamav-devel/libclamav/mbox.c:353
    #5 0x8182f73 in cli_scanmail /tmp/clamav-devel/libclamav/scanners.c:2010:16
    #6 0x816e5d2 in magic_scandesc /tmp/clamav-devel/libclamav/scanners.c:3291:19
    #7 0x8167904 in cli_base_scandesc /tmp/clamav-devel/libclamav/scanners.c:3616:11
    #8 0x8176391 in cli_magic_scandesc /tmp/clamav-devel/libclamav/scanners.c:3625:12
    #9 0x8176391 in scan_common /tmp/clamav-devel/libclamav/scanners.c:3891
    #10 0x8177162 in cl_scandesc_callback /tmp/clamav-devel/libclamav/scanners.c:4032:12
    #11 0x8177162 in cl_scanfile_callback /tmp/clamav-devel/libclamav/scanners.c:4099
    #12 0x8177162 in cl_scanfile /tmp/clamav-devel/libclamav/scanners.c:4082
```

Parsing the PoC the variable `len` gets the value `0`. And the operation `pout[len - 1]` reads on byte before the start of the allocated buffer `pout`.

The len is 0 because the PoC has a rfc2047 encoded string without any content:
```c
=? ?b? ?=
```

The PoC is:
```
From: Francisco Oca <foca@salesforce.com> 
Content-Type: multipart/form-data; boundary="test"

--test
=? ?b? ?=
--test--
```

This bug does not crash ClamAv, but can be detected via memory sanitizers/compiling with ASAN.

A posible solution is to validate the len:
```c
3143                 if(len > 0 && pout[len - 1] == '\n')
3144                         pout += len - 1;
3145                 else
3146                         pout += len;
```