Fix misaligned uint32_t load of dex map_list.size

[Rakesh717]

The map list size was read by casting dex->data + map_offset to uint32_t* and dereferencing, but map_offset comes straight from the DEX header and is never alignment checked, so any file whose map_offset is not a multiple of 4 is undefined behavior. Found with an ASan+UBSan build fuzzing the dex module over tests/oss-fuzz/dex_fuzzer_corpus; UBSan reports the load at dex.c:1163 and 1165, and the loop bound at 1171 reads the same pointer:

libyara/modules/dex/dex.c:1163:5: runtime error: load of misaligned address
0x000100fd0005 for type 'uint32_t', which requires 4 byte alignment

A 160-byte DEX with map_offset = 5 reproduces it deterministically:

import struct
buf = bytearray(160)
buf[0:8] = b'dex\n035\x00'
buf[32:36] = struct.pack('<I', 160)          # file_size
buf[36:40] = struct.pack('<I', 112)          # header_size
buf[40:44] = struct.pack('<I', 0x12345678)   # endian_tag
buf[52:56] = struct.pack('<I', 5)            # map_offset: odd, misaligned
open('misaligned.dex', 'wb').write(bytes(buf))

echo 'import "dex" rule t { condition: dex.map_list.size }' > r.yar
./yara -w r.yar misaligned.dex    # UBSan fires before the patch, silent after

The size is now read through memcpy into a local with yr_le32toh applied once, which also collapses the repeated yr_le32toh(*map_list_size) in the loop bound. This is the only bare (uint32_t*) cast-deref in the module; every other structure access goes through the #pragma pack(1) types in yara/dex.h, whose member loads tolerate any alignment. Same bytes, same endian conversion, same fits_in_dex bounds checks, so no behavior change: the reproducer is UBSan-silent after the fix and every file in tests/oss-fuzz/dex_fuzzer_corpus still parses.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Rakesh717]

@google-cla bot check