ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file.