@@ -1,3 +1,10 @@

+Fri Sep 23 04:05:07 CEST 2005 (tk)

+----------------------------------

+  * libclamav/clamav.h: split cl_node into cli_matcher and cl_engine

+  * libclamav/readdb.c: read signatures into separate trees depending on

+			their type

+  * libclamav/matcher.c: scan data with suitable trees

+

 Mon Sep 19 01:15:02 CEST 2005 (tk)

 ----------------------------------

   * libclamav/elf.c: add cli_elfheader()

@@ -84,6 +84,7 @@ extern "C"

 #define CL_MAIL		CL_SCAN_MAIL

 #define CL_OLE2		CL_SCAN_OLE2

 #define CL_ENCRYPTED    CL_SCAN_BLOCKENCRYPTED

+#define cl_node		cl_engine

 struct cli_bm_patt {

@@ -126,8 +127,7 @@ struct cli_meta_node {

     struct cli_meta_node *next;

 };

-struct cl_node {

-    unsigned int refcount;

+struct cli_matcher {

     unsigned int maxpatlen; /* maximal length of pattern in db */

     /* Extended Boyer-Moore */

@@ -137,6 +137,13 @@ struct cl_node {

     /* Extended Aho-Corasick */

     struct cli_ac_node *ac_root, **ac_nodetable;

     unsigned int ac_partsigs, ac_nodes;

+};

+

+struct cl_engine {

+    unsigned int refcount; /* reference counter */

+

+    /* Roots table */

+    struct cli_matcher **root;

     /* MD5 */

     struct cli_md5_node **md5_hlist;

@@ -180,21 +187,21 @@ struct cl_cvd {

 };

 /* file scanning */

-extern int cl_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root);

+extern int cl_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_engine *engine);

-extern int cl_scandesc(int desc, const char **virname, unsigned long int *scanned, const struct cl_node *root, const struct cl_limits *limits, unsigned int options);

+extern int cl_scandesc(int desc, const char **virname, unsigned long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options);

-extern int cl_scanfile(const char *filename, const char **virname, unsigned long int *scanned, const struct cl_node *root, const struct cl_limits *limits, unsigned int options);

+extern int cl_scanfile(const char *filename, const char **virname, unsigned long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options);

 /* software versions */

 extern int cl_retflevel(void);

 extern const char *cl_retver(void);

 /* database */

-extern int cl_loaddb(const char *filename, struct cl_node **root, unsigned int *signo);

-extern int cl_loaddbdir(const char *dirname, struct cl_node **root, unsigned int *signo);

+extern int cl_loaddb(const char *filename, struct cl_engine **engine, unsigned int *signo);

+extern int cl_loaddbdir(const char *dirname, struct cl_engine **engine, unsigned int *signo);

 extern const char *cl_retdbdir(void);

-extern struct cl_node *cl_dup(struct cl_node *root);

+extern struct cl_engine *cl_dup(struct cl_engine *engine);

 /* CVD */

 extern struct cl_cvd *cl_cvdhead(const char *file);

@@ -212,8 +219,8 @@ extern void cl_debug(void);

 extern void cl_settempdir(const char *dir, short leavetemps);

-extern int cl_build(struct cl_node *root);

-extern void cl_free(struct cl_node *root);

+extern int cl_build(struct cl_engine *engine);

+extern void cl_free(struct cl_engine *engine);

 extern const char *cl_strerror(int clerror);

 extern const char *cl_perror(int clerror); /* deprecated */

@@ -335,7 +335,7 @@ int cl_cvdverify(const char *file)

     return ret;

 }

-int cli_cvdload(FILE *fd, struct cl_node **root, unsigned int *signo, short warn)

+int cli_cvdload(FILE *fd, struct cl_engine **engine, unsigned int *signo, short warn)

 {

         char *dir, *tmp, *buffer;

 	struct cl_cvd cvd;

@@ -430,7 +430,7 @@ int cli_cvdload(FILE *fd, struct cl_node **root, unsigned int *signo, short warn

 	    /* end */

     /* load extracted directory */

-    cl_loaddbdir(dir, root, signo);

+    cl_loaddbdir(dir, engine, signo);

     cli_rmdirs(dir);

     free(dir);

@@ -22,7 +22,7 @@

 #include <stdio.h>

 #include "clamav.h"

-int cli_cvdload(FILE *fd, struct cl_node **root, unsigned int *signo, short warn);

+int cli_cvdload(FILE *fd, struct cl_engine **engine, unsigned int *signo, short warn);

 int cli_untgz(int fd, const char *destdir);

 #endif

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2002 Tomasz Kojm <zolw@konarski.edu.pl>

+ *  Copyright (C) 2002 - 2005 Tomasz Kojm <tkojm@clamav.net>

  *

  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License as published by

@@ -20,7 +20,5 @@

 # define DATADIR "/usr/local/share/clamav"

 #endif

-#define VIRUSDB DATADIR "/viruses.db"

-

 #define CLI_IGN -200

 #define CLI_ALT -201

@@ -54,7 +54,7 @@ static inline uint32_t EC32(uint32_t v)

 	return ((v >> 24) | ((v & 0x00FF0000) >> 8) | ((v & 0x0000FF00) << 8) | (v << 24));

 }

-int cli_scanelf(int desc, const char **virname, long int *scanned, const struct cl_node *root, const struct cl_limits *limits, unsigned int options, unsigned int arec, unsigned int mrec)

+int cli_scanelf(int desc, const char **virname, long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options, unsigned int arec, unsigned int mrec)

 {

 	struct elf_file_hdr32 file_hdr;

 	struct elf_section_hdr32 *section_hdr;

@@ -56,7 +56,7 @@ struct elf_section_hdr32 {

     uint32_t sh_entsize;

 };

-int cli_scanelf(int desc, const char **virname, long int *scanned, const struct cl_node *root, const struct cl_limits *limits, unsigned int options, unsigned int arec, unsigned int mrec);

+int cli_scanelf(int desc, const char **virname, long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options, unsigned int arec, unsigned int mrec);

 int cli_elfheader(int desc, struct cli_exe_info *elfinfo);

@@ -272,9 +272,12 @@ cli_file_t cli_filetype2(int desc)

     return ret;

 }

-int cli_addtypesigs(struct cl_node *root)

+int cli_addtypesigs(struct cl_engine *engine)

 {

 	int i, ret;

+	struct cli_matcher *root;

+

+    root = engine->root[0];

     for(i = 0; cli_smagic[i].sig; i++) {

 	if((ret = cli_parse_add(root, cli_smagic[i].descr, cli_smagic[i].sig, cli_smagic[i].type, NULL, 0))) {

@@ -56,6 +56,6 @@ typedef enum {

 cli_file_t cli_filetype(const char *buf, size_t buflen);

 cli_file_t cli_filetype2(int desc);

-int cli_addtypesigs(struct cl_node *root);

+int cli_addtypesigs(struct cl_engine *engine);

 #endif

@@ -44,7 +44,7 @@ struct nodelist {

     struct nodelist *next;

 };

-int cli_ac_addpatt(struct cl_node *root, struct cli_ac_patt *pattern)

+int cli_ac_addpatt(struct cli_matcher *root, struct cli_ac_patt *pattern)

 {

 	struct cli_ac_node *pos, *next;

 	int i;

@@ -60,14 +60,14 @@ int cli_ac_addpatt(struct cl_node *root, struct cli_ac_patt *pattern)

 	if(!next) {

 	    next = (struct cli_ac_node *) cli_calloc(1, sizeof(struct cli_ac_node));

 	    if(!next) {

-		cli_dbgmsg("Unable to allocate pattern node (%d)\n", sizeof(struct cl_node));

+		cli_dbgmsg("Unable to allocate pattern node (%d)\n", sizeof(struct cli_matcher));

 		return CL_EMEM;

 	    }

 	    root->ac_nodes++;

 	    root->ac_nodetable = (struct cli_ac_node **) cli_realloc(root->ac_nodetable, (root->ac_nodes) * sizeof(struct cli_ac_node *));

 	    if(root->ac_nodetable == NULL) {

-		cli_dbgmsg("Unable to realloc nodetable (%d)\n", (root->ac_nodes) * sizeof(struct cl_node *));

+		cli_dbgmsg("Unable to realloc nodetable (%d)\n", (root->ac_nodes) * sizeof(struct cli_matcher *));

 		return CL_EMEM;

 	    }

 	    root->ac_nodetable[root->ac_nodes - 1] = next;

@@ -128,7 +128,7 @@ static struct cli_ac_node *cli_dequeue(struct nodelist **bfs)

     }

 }

-static int cli_maketrans(struct cl_node *root)

+static int cli_maketrans(struct cli_matcher *root)

 {

 	struct nodelist *bfs = NULL;

 	struct cli_ac_node *ac_root = root->ac_root, *child, *node;

@@ -166,7 +166,7 @@ static int cli_maketrans(struct cl_node *root)

     return 0;

 }

-int cli_ac_buildtrie(struct cl_node *root)

+int cli_ac_buildtrie(struct cli_matcher *root)

 {

 	int ret;

@@ -178,9 +178,6 @@ int cli_ac_buildtrie(struct cl_node *root)

 	return 0;

     }

-    if((ret = cli_addtypesigs(root)))

-	return ret;

-

     return cli_maketrans(root);

 }

@@ -209,7 +206,7 @@ static void cli_freepatt(struct cli_ac_patt *list)

     }

 }

-void cli_ac_free(struct cl_node *root)

+void cli_ac_free(struct cli_matcher *root)

 {

 	unsigned int i;

@@ -263,7 +260,7 @@ inline static int cli_findpos(const char *buffer, int offset, int length, const

     return 1;

 }

-int cli_ac_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, int *partcnt, short otfrec, unsigned long int offset, unsigned long int *partoff, unsigned short ftype, int fd, unsigned long int *ftoffset)

+int cli_ac_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cli_matcher *root, int *partcnt, short otfrec, unsigned long int offset, unsigned long int *partoff, unsigned short ftype, int fd, unsigned long int *ftoffset)

 {

 	struct cli_ac_node *current;

 	struct cli_ac_patt *pt;

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2002 - 2004 Tomasz Kojm <tkojm@clamav.net>

+ *  Copyright (C) 2002 - 2005 Tomasz Kojm <tkojm@clamav.net>

  *

  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License as published by

@@ -22,9 +22,9 @@

 #include "clamav.h"

 #include "matcher.h"

-int cli_ac_addpatt(struct cl_node *root, struct cli_ac_patt *pattern);

-int cli_ac_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, int *partcnt, short otfrec, unsigned long int offset, unsigned long int *partoff, unsigned short ftype, int fd, unsigned long int *ftoffset);

-int cli_ac_buildtrie(struct cl_node *root);

-void cli_ac_free(struct cl_node *root);

+int cli_ac_addpatt(struct cli_matcher *root, struct cli_ac_patt *pattern);

+int cli_ac_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cli_matcher *root, int *partcnt, short otfrec, unsigned long int offset, unsigned long int *partoff, unsigned short ftype, int fd, unsigned long int *ftoffset);

+int cli_ac_buildtrie(struct cli_matcher *root);

+void cli_ac_free(struct cli_matcher *root);

 #endif

@@ -35,7 +35,7 @@

 #define DHASH(a,b,c) 211 * a + 37 * b + c

-int cli_bm_addpatt(struct cl_node *root, struct cli_bm_patt *pattern)

+int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern)

 {

 	int i;

 	uint16_t idx;

@@ -76,7 +76,7 @@ int cli_bm_addpatt(struct cl_node *root, struct cli_bm_patt *pattern)

     return 0;

 }

-int cli_bm_init(struct cl_node *root)

+int cli_bm_init(struct cli_matcher *root)

 {

 	unsigned int i;

 	unsigned int size = DHASH(256, 256, 256);

@@ -99,7 +99,7 @@ int cli_bm_init(struct cl_node *root)

     return 0;

 }

-void cli_bm_free(struct cl_node *root)

+void cli_bm_free(struct cli_matcher *root)

 {

 	struct cli_bm_patt *b1, *b2;

 	unsigned int i;

@@ -128,7 +128,7 @@ void cli_bm_free(struct cl_node *root)

     }

 }

-int cli_bm_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, unsigned long int offset, unsigned short ftype, int fd)

+int cli_bm_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cli_matcher *root, unsigned long int offset, unsigned short ftype, int fd)

 {

 	unsigned int i, j, shift, off, found = 0;

 	uint16_t idx;

@@ -1,5 +1,5 @@

 /*

- *  Copyright (C) 2004 Tomasz Kojm <tkojm@clamav.net>

+ *  Copyright (C) 2004 - 2005 Tomasz Kojm <tkojm@clamav.net>

  *

  *  This program is free software; you can redistribute it and/or modify

  *  it under the terms of the GNU General Public License as published by

@@ -22,9 +22,9 @@

 #include "clamav.h"

 #include "matcher.h"

-int cli_bm_addpatt(struct cl_node *root, struct cli_bm_patt *pattern);

-int cli_bm_init(struct cl_node *root);

-int cli_bm_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, unsigned long int offset, unsigned short ftype, int fd);

-void cli_bm_free(struct cl_node *root);

+int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern);

+int cli_bm_init(struct cli_matcher *root);

+int cli_bm_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cli_matcher *root, unsigned long int offset, unsigned short ftype, int fd);

+void cli_bm_free(struct cli_matcher *root);

 #endif

@@ -39,9 +39,9 @@

 #include "special.h"

 #define MD5_BLOCKSIZE 4096

+#define MAX(a,b) ((a > b) ? a : b)

-#define TARGET_TABLE_SIZE 7

-static int targettab[TARGET_TABLE_SIZE] = { 0, CL_TYPE_MSEXE, CL_TYPE_MSOLE2, CL_TYPE_HTML, CL_TYPE_MAIL, CL_TYPE_GRAPHICS, CL_TYPE_ELF };

+static int targettab[CL_TARGET_TABLE_SIZE] = { 0, CL_TYPE_MSEXE, CL_TYPE_MSOLE2, CL_TYPE_HTML, CL_TYPE_MAIL, CL_TYPE_GRAPHICS, CL_TYPE_ELF };

 extern short cli_debug_flag;

@@ -50,42 +50,84 @@ extern short cli_debug_flag;

 static pthread_mutex_t cli_ref_mutex = PTHREAD_MUTEX_INITIALIZER;

 #endif

-int cli_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, unsigned short ftype)

+int cli_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_engine *engine, unsigned short ftype)

 {

-	int ret, *partcnt;

+	int ret, i, tid = 0, *partcnt;

 	unsigned long int *partoff;

+	struct cli_matcher *groot, *troot = NULL;

-    if((partcnt = (int *) cli_calloc(root->ac_partsigs + 1, sizeof(int))) == NULL) {

-	cli_dbgmsg("cl_scanbuff(): unable to cli_calloc(%d, %d)\n", root->ac_partsigs + 1, sizeof(int));

+    if(!engine) {

+	cli_errmsg("cli_scanbuff: engine == NULL\n");

+	return CL_ENULLARG;

+    }

+

+    groot = engine->root[0]; /* generic signatures */

+

+    if(ftype) {

+	for(i = 0; i < CL_TARGET_TABLE_SIZE; i++) {

+	    if(targettab[i] == ftype) {

+		tid = i;

+		break;

+	    }

+	}

+	if(tid)

+	    troot = engine->root[tid];

+    }

+

+    if(troot) {

+

+	if((partcnt = (int *) cli_calloc(troot->ac_partsigs + 1, sizeof(int))) == NULL) {

+	    cli_dbgmsg("cl_scanbuff(): unable to cli_calloc(%d, %d)\n", troot->ac_partsigs + 1, sizeof(int));

+	    return CL_EMEM;

+	}

+

+	if((partoff = (unsigned long int *) cli_calloc(troot->ac_partsigs + 1, sizeof(unsigned long int))) == NULL) {

+	    cli_dbgmsg("cl_scanbuff(): unable to cli_calloc(%d, %d)\n", troot->ac_partsigs + 1, sizeof(unsigned long int));

+	    free(partcnt);

+	    return CL_EMEM;

+	}

+

+	if((ret = cli_bm_scanbuff(buffer, length, virname, troot, 0, ftype, -1)) != CL_VIRUS)

+	    ret = cli_ac_scanbuff(buffer, length, virname, troot, partcnt, 0, 0, partoff, ftype, -1, NULL);

+

+	free(partcnt);

+	free(partoff);

+

+	if(ret == CL_VIRUS)

+	    return ret;

+    }

+

+    if((partcnt = (int *) cli_calloc(groot->ac_partsigs + 1, sizeof(int))) == NULL) {

+	cli_dbgmsg("cl_scanbuff(): unable to cli_calloc(%d, %d)\n", groot->ac_partsigs + 1, sizeof(int));

 	return CL_EMEM;

     }

-    if((partoff = (unsigned long int *) cli_calloc(root->ac_partsigs + 1, sizeof(unsigned long int))) == NULL) {

-	cli_dbgmsg("cl_scanbuff(): unable to cli_calloc(%d, %d)\n", root->ac_partsigs + 1, sizeof(unsigned long int));

+    if((partoff = (unsigned long int *) cli_calloc(groot->ac_partsigs + 1, sizeof(unsigned long int))) == NULL) {

+	cli_dbgmsg("cl_scanbuff(): unable to cli_calloc(%d, %d)\n", groot->ac_partsigs + 1, sizeof(unsigned long int));

 	free(partcnt);

 	return CL_EMEM;

     }

-    if((ret = cli_bm_scanbuff(buffer, length, virname, root, 0, ftype, -1)) != CL_VIRUS)

-	ret = cli_ac_scanbuff(buffer, length, virname, root, partcnt, 0, 0, partoff, ftype, -1, NULL);

+    if((ret = cli_bm_scanbuff(buffer, length, virname, groot, 0, ftype, -1)) != CL_VIRUS)

+	ret = cli_ac_scanbuff(buffer, length, virname, groot, partcnt, 0, 0, partoff, ftype, -1, NULL);

     free(partcnt);

     free(partoff);

     return ret;

 }

-int cl_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root)

+int cl_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_engine *engine)

 {

-    return cli_scanbuff(buffer, length, virname, root, 0);

+    return cli_scanbuff(buffer, length, virname, engine, 0);

 }

-static struct cli_md5_node *cli_vermd5(const unsigned char *md5, const struct cl_node *root)

+static struct cli_md5_node *cli_vermd5(const unsigned char *md5, const struct cl_engine *engine)

 {

 	struct cli_md5_node *pt;

-    if(!(pt = root->md5_hlist[md5[0] & 0xff]))

+    if(!(pt = engine->md5_hlist[md5[0] & 0xff]))

 	return NULL;

     while(pt) {

@@ -183,20 +225,20 @@ static long int cli_caloff(const char *offstr, int fd, unsigned short ftype)

     return -1;

 }

-int cli_checkfp(int fd, const struct cl_node *root)

+int cli_checkfp(int fd, const struct cl_engine *engine)

 {

 	struct cli_md5_node *md5_node;

 	char *digest;

-    if(root->md5_hlist) {

+    if(engine->md5_hlist) {

 	if(!(digest = cli_md5digest(fd))) {

 	    cli_errmsg("cli_checkfp(): Can't generate MD5 checksum\n");

 	    return 0;

 	}

-	if((md5_node = cli_vermd5(digest, root)) && md5_node->fp) {

+	if((md5_node = cli_vermd5(digest, engine)) && md5_node->fp) {

 		struct stat sb;

 	    if(fstat(fd, &sb))

@@ -220,20 +262,6 @@ int cli_checkfp(int fd, const struct cl_node *root)

 int cli_validatesig(unsigned short target, unsigned short ftype, const char *offstr, unsigned long int fileoff, int desc, const char *virname)

 {

-

-    if(target) {

-	if(target >= TARGET_TABLE_SIZE) {

-	    cli_dbgmsg("Unknown target in signature (%s)\n", virname);

-	    return 0;

-	} else {

-	    if(targettab[target] != ftype) {

-		cli_dbgmsg("Type: %d, expected: %d (%s)\n", ftype, targettab[target], virname);

-		return 0;

-	    }

-	} 

-

-    }

-

     if(offstr && desc != -1) {

 	    long int off = cli_caloff(offstr, desc, ftype);

@@ -251,49 +279,90 @@ int cli_validatesig(unsigned short target, unsigned short ftype, const char *off

     return 1;

 }

-int cli_scandesc(int desc, const char **virname, long int *scanned, const struct cl_node *root, short otfrec, unsigned short ftype, unsigned long int *ftoffset)

+int cli_scandesc(int desc, const char **virname, long int *scanned, const struct cl_engine *engine, short otfrec, unsigned short ftype, unsigned long int *ftoffset)

 {

  	char *buffer, *buff, *endbl, *pt;

-	int bytes, buffsize, length, ret, *partcnt, type = CL_CLEAN;

-	unsigned long int *partoff, offset = 0;

+	int bytes, buffsize, length, ret, *gpartcnt, *tpartcnt;

+	int type = CL_CLEAN, i, tid = 0;

+	unsigned int maxpatlen;

+	unsigned long int *gpartoff, *tpartoff, offset = 0;

 	MD5_CTX ctx;

 	unsigned char digest[16];

 	struct cli_md5_node *md5_node;

+	struct cli_matcher *groot, *troot = NULL;

-    if(!root) {

-	cli_errmsg("cli_scandesc: root == NULL\n");

+    if(!engine) {

+	cli_errmsg("cli_scandesc: engine == NULL\n");

 	return CL_ENULLARG;

     }

+    groot = engine->root[0]; /* generic signatures */

+

+    if(ftype) {

+	for(i = 0; i < CL_TARGET_TABLE_SIZE; i++) {

+	    if(targettab[i] == ftype) {

+		tid = i;

+		break;

+	    }

+	}

+	if(tid)

+	    troot = engine->root[tid];

+    }

+

+    if(troot)

+	maxpatlen = MAX(troot->maxpatlen, groot->maxpatlen);

+    else

+	maxpatlen = groot->maxpatlen;

+

     /* prepare the buffer */

-    buffsize = root->maxpatlen + SCANBUFF;

+    buffsize = maxpatlen + SCANBUFF;

     if(!(buffer = (char *) cli_calloc(buffsize, sizeof(char)))) {

 	cli_dbgmsg("cli_scandesc(): unable to cli_calloc(%d)\n", buffsize);

 	return CL_EMEM;

     }

-    if((partcnt = (int *) cli_calloc(root->ac_partsigs + 1, sizeof(int))) == NULL) {

-	cli_dbgmsg("cli_scandesc(): unable to cli_calloc(%d, %d)\n", root->ac_partsigs + 1, sizeof(int));

+    if((gpartcnt = (int *) cli_calloc(groot->ac_partsigs + 1, sizeof(int))) == NULL) {

+	cli_dbgmsg("cli_scandesc(): unable to cli_calloc(%d, %d)\n", groot->ac_partsigs + 1, sizeof(int));

 	free(buffer);

 	return CL_EMEM;

     }

-    if((partoff = (unsigned long int *) cli_calloc(root->ac_partsigs + 1, sizeof(unsigned long int))) == NULL) {

-	cli_dbgmsg("cli_scandesc(): unable to cli_calloc(%d, %d)\n", root->ac_partsigs + 1, sizeof(unsigned long int));

+    if((gpartoff = (unsigned long int *) cli_calloc(groot->ac_partsigs + 1, sizeof(unsigned long int))) == NULL) {

+	cli_dbgmsg("cli_scandesc(): unable to cli_calloc(%d, %d)\n", groot->ac_partsigs + 1, sizeof(unsigned long int));

 	free(buffer);

-	free(partcnt);

+	free(gpartcnt);

 	return CL_EMEM;

     }

-    if(root->md5_hlist)

+    if(troot) {

+

+	if((tpartcnt = (int *) cli_calloc(troot->ac_partsigs + 1, sizeof(int))) == NULL) {

+	    cli_dbgmsg("cli_scandesc(): unable to cli_calloc(%d, %d)\n", troot->ac_partsigs + 1, sizeof(int));

+	    free(buffer);

+	    free(gpartcnt);

+	    free(gpartoff);

+	    return CL_EMEM;

+	}

+

+	if((tpartoff = (unsigned long int *) cli_calloc(troot->ac_partsigs + 1, sizeof(unsigned long int))) == NULL) {

+	    cli_dbgmsg("cli_scandesc(): unable to cli_calloc(%d, %d)\n", troot->ac_partsigs + 1, sizeof(unsigned long int));

+	    free(buffer);

+	    free(gpartcnt);

+	    free(gpartoff);

+	    free(tpartcnt);

+	    return CL_EMEM;

+	}

+    }

+

+    if(engine->md5_hlist)

 	MD5_Init(&ctx);

     buff = buffer;

-    buff += root->maxpatlen; /* pointer to read data block */

-    endbl = buff + SCANBUFF - root->maxpatlen; /* pointer to the last block

-						* length of root->maxpatlen

+    buff += maxpatlen; /* pointer to read data block */

+    endbl = buff + SCANBUFF - maxpatlen; /* pointer to the last block

+						* length of maxpatlen

 						*/

     pt = buff;

@@ -306,14 +375,34 @@ int cli_scandesc(int desc, const char **virname, long int *scanned, const struct

 	if(bytes < SCANBUFF)

 	    length -= SCANBUFF - bytes;

-	if(cli_bm_scanbuff(pt, length, virname, root, offset, ftype, desc) == CL_VIRUS ||

-	   (ret = cli_ac_scanbuff(pt, length, virname, root, partcnt, otfrec, offset, partoff, ftype, desc, ftoffset)) == CL_VIRUS) {

-	    free(buffer);

-	    free(partcnt);

-	    free(partoff);

+	if(troot) {

+	    if(cli_bm_scanbuff(pt, length, virname, troot, offset, ftype, desc) == CL_VIRUS ||

+	    (ret = cli_ac_scanbuff(pt, length, virname, troot, tpartcnt, otfrec, offset, tpartoff, ftype, desc, ftoffset)) == CL_VIRUS) {

+		free(buffer);

+		free(gpartcnt);

+		free(gpartoff);

+		free(tpartcnt);

+		free(tpartoff);

+

+		lseek(desc, 0, SEEK_SET);

+		if(cli_checkfp(desc, engine))

+		    return CL_CLEAN;

+		else

+		    return CL_VIRUS;

+	    }

+	}

+	if(cli_bm_scanbuff(pt, length, virname, groot, offset, ftype, desc) == CL_VIRUS ||

+	   (ret = cli_ac_scanbuff(pt, length, virname, groot, gpartcnt, otfrec, offset, gpartoff, ftype, desc, ftoffset)) == CL_VIRUS) {

+	    free(buffer);

+	    free(gpartcnt);

+	    free(gpartoff);

+	    if(troot) {

+		free(tpartcnt);

+		free(tpartoff);

+	    }

 	    lseek(desc, 0, SEEK_SET);

-	    if(cli_checkfp(desc, root))

+	    if(cli_checkfp(desc, engine))

 		return CL_CLEAN;

 	    else

 		return CL_VIRUS;

@@ -324,26 +413,30 @@ int cli_scandesc(int desc, const char **virname, long int *scanned, const struct

 	}

 	if(bytes == SCANBUFF) {

-	    memmove(buffer, endbl, root->maxpatlen);

+	    memmove(buffer, endbl, maxpatlen);

 	    if(pt == buffer) {

 		offset += SCANBUFF;

 	    } else {

-		offset += SCANBUFF - root->maxpatlen;

+		offset += SCANBUFF - maxpatlen;

 		pt = buffer;

 		length = buffsize;

 	    }

 	}

-	if(root->md5_hlist)

+	if(engine->md5_hlist)

 	    MD5_Update(&ctx, buff, bytes);

     }

     free(buffer);

-    free(partcnt);

-    free(partoff);

+    free(gpartcnt);

+    free(gpartoff);

+    if(troot) {

+	free(tpartcnt);

+	free(tpartoff);

+    }

-    if(root->md5_hlist) {

+    if(engine->md5_hlist) {

 	MD5_Final(digest, &ctx);

 	if(cli_debug_flag) {

@@ -359,7 +452,7 @@ int cli_scandesc(int desc, const char **virname, long int *scanned, const struct

 	    cli_dbgmsg("Calculated MD5 checksum: %s\n", md5str);

 	}

-	if((md5_node = cli_vermd5(digest, root)) && !md5_node->fp) {

+	if((md5_node = cli_vermd5(digest, engine)) && !md5_node->fp) {

 		struct stat sb;

 	    if(fstat(desc, &sb))

@@ -379,15 +472,26 @@ int cli_scandesc(int desc, const char **virname, long int *scanned, const struct

     return otfrec ? type : CL_CLEAN;

 }

-int cl_build(struct cl_node *root)

+int cl_build(struct cl_engine *engine)

 {

-    return cli_ac_buildtrie(root);

+	int i, ret;

+	struct cli_matcher *root;

+

+    for(i = 0; i < CL_TARGET_TABLE_SIZE; i++)

+	if((root = engine->root[i]))

+	    cli_ac_buildtrie(root);

+    /* FIXME: check return values of cli_ac_buildtree */

+

+    if((ret = cli_addtypesigs(engine)))

+	return ret;

+

+    return 0;

 }

-struct cl_node *cl_dup(struct cl_node *root)

+struct cl_engine *cl_dup(struct cl_engine *engine)

 {

-    if(!root) {

-	cli_errmsg("cl_dup: root == NULL\n");

+    if(!engine) {

+	cli_errmsg("cl_dup: engine == NULL\n");

 	return NULL;

     }

@@ -395,23 +499,24 @@ struct cl_node *cl_dup(struct cl_node *root)

     pthread_mutex_lock(&cli_ref_mutex);

 #endif

-    root->refcount++;

-    

+    engine->refcount++;

+

 #ifdef CL_THREAD_SAFE

     pthread_mutex_unlock(&cli_ref_mutex);

 #endif

-    return root;

+    return engine;

 }

-void cl_free(struct cl_node *root)

+void cl_free(struct cl_engine *engine)

 {

 	int i;

 	struct cli_md5_node *md5pt, *md5h;

 	struct cli_meta_node *metapt, *metah;

+	struct cli_matcher *root;

-    if(!root) {

-	cli_errmsg("cl_free: root == NULL\n");

+    if(!engine) {

+	cli_errmsg("cl_free: engine == NULL\n");

 	return;

     }

@@ -419,8 +524,8 @@ void cl_free(struct cl_node *root)

     pthread_mutex_lock(&cli_ref_mutex);

 #endif

-    root->refcount--;

-    if (root->refcount) {

+    engine->refcount--;

+    if(engine->refcount) {

 #ifdef CL_THREAD_SAFE

 	pthread_mutex_unlock(&cli_ref_mutex);

 #endif

@@ -431,12 +536,16 @@ void cl_free(struct cl_node *root)

     pthread_mutex_unlock(&cli_ref_mutex);

 #endif

-    cli_ac_free(root);

-    cli_bm_free(root);

+    for(i = 0; i < CL_TARGET_TABLE_SIZE; i++) {

+	if((root = engine->root[i])) {

+	    cli_ac_free(root);

+	    cli_bm_free(root);

+	}

+    }

-    if(root->md5_hlist) {

+    if(engine->md5_hlist) {

 	for(i = 0; i < 256; i++) {

-	    md5pt = root->md5_hlist[i];

+	    md5pt = engine->md5_hlist[i];

 	    while(md5pt) {

 		md5h = md5pt;

 		md5pt = md5pt->next;

@@ -447,10 +556,10 @@ void cl_free(struct cl_node *root)

 		free(md5h);

 	    }

 	}

-	free(root->md5_hlist);

+	free(engine->md5_hlist);

     }

-    metapt = root->zip_mlist;

+    metapt = engine->zip_mlist;

     while(metapt) {

 	metah = metapt;

 	metapt = metapt->next;

@@ -460,7 +569,7 @@ void cl_free(struct cl_node *root)

 	free(metah);

     }

-    metapt = root->rar_mlist;

+    metapt = engine->rar_mlist;

     while(metapt) {

 	metah = metapt;

 	metapt = metapt->next;

@@ -470,15 +579,15 @@ void cl_free(struct cl_node *root)

 	free(metah);

     }

-    free(root);

+    free(engine);

 }

-int cl_buildtrie(struct cl_node *root) /* for backward compatibility */

+int cl_buildtrie(struct cl_engine *engine) /* for backward compatibility */

 {

-    return cl_build(root);

+    return cl_build(engine);

 }

-void cl_freetrie(struct cl_node *root) /* for backward compatibility */

+void cl_freetrie(struct cl_engine *engine) /* for backward compatibility */

 {

-    cl_free(root);

+    cl_free(engine);

 }

@@ -21,12 +21,14 @@

 #include "clamav.h"

-int cli_scandesc(int desc, const char **virname, long int *scanned, const struct cl_node *root, short otfrec, unsigned short ftype, unsigned long int *ftoffset);

+#define CL_TARGET_TABLE_SIZE 7

-int cli_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_node *root, unsigned short ftype);

+int cli_scandesc(int desc, const char **virname, long int *scanned, const struct cl_engine *engine, short otfrec, unsigned short ftype, unsigned long int *ftoffset);

+

+int cli_scanbuff(const char *buffer, unsigned int length, const char **virname, const struct cl_engine *engine, unsigned short ftype);

 int cli_validatesig(unsigned short target, unsigned short ftype, const char *offstr, unsigned long int fileoff, int desc, const char *virname);

-int cli_checkfp(int fd, const struct cl_node *root);

+int cli_checkfp(int fd, const struct cl_engine *engine);

 #endif

@@ -148,7 +148,7 @@ static int cli_ddump(int desc, int offset, int size, const char *file)

 }

 */

-int cli_scanpe(int desc, const char **virname, long int *scanned, const struct cl_node *root, const struct cl_limits *limits, unsigned int options, unsigned int arec, unsigned int mrec)

+int cli_scanpe(int desc, const char **virname, long int *scanned, const struct cl_engine *engine, const struct cl_limits *limits, unsigned int options, unsigned int arec, unsigned int mrec)

 {

 	uint16_t e_magic; /* DOS signature ("MZ") */

 	uint16_t nsections;

@@ -695,7 +695,7 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

 			lseek(ndesc, 0, SEEK_SET);

 			cli_dbgmsg("***** Scanning rebuilt PE file *****\n");

-			if(cli_magic_scandesc(ndesc, virname, scanned, root, limits, options, arec, mrec) == CL_VIRUS) {

+			if(cli_magic_scandesc(ndesc, virname, scanned, engine, limits, options, arec, mrec) == CL_VIRUS) {

 			    free(section_hdr);

 			    close(ndesc);

 			    if(!cli_leavetemps_flag)

@@ -884,7 +884,7 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

 			lseek(ndesc, 0, SEEK_SET);

 			cli_dbgmsg("***** Scanning rebuilt PE file *****\n");

-			if(cli_magic_scandesc(ndesc, virname, scanned, root, limits, options, arec, mrec) == CL_VIRUS) {

+			if(cli_magic_scandesc(ndesc, virname, scanned, engine, limits, options, arec, mrec) == CL_VIRUS) {

 			    free(section_hdr);

 			    close(ndesc);

 			    if(!cli_leavetemps_flag)

@@ -1077,7 +1077,7 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

 			lseek(ndesc, 0, SEEK_SET);

 			cli_dbgmsg("***** Scanning rebuilt PE file *****\n");

-			if(cli_magic_scandesc(ndesc, virname, scanned, root, limits, options, arec, mrec) == CL_VIRUS) {

+			if(cli_magic_scandesc(ndesc, virname, scanned, engine, limits, options, arec, mrec) == CL_VIRUS) {

 			    free(section_hdr);

 			    close(ndesc);

 			    if(!cli_leavetemps_flag)

@@ -1284,7 +1284,7 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

 		cli_dbgmsg("UPX/FSG: Decompressed data saved in %s\n", tempfile);

 	    cli_dbgmsg("***** Scanning decompressed file *****\n");

-	    if((ret = cli_magic_scandesc(ndesc, virname, scanned, root, limits, options, arec, mrec)) == CL_VIRUS) {

+	    if((ret = cli_magic_scandesc(ndesc, virname, scanned, engine, limits, options, arec, mrec)) == CL_VIRUS) {

 		close(ndesc);

 		if(!cli_leavetemps_flag)

 		    unlink(tempfile);

@@ -1382,7 +1382,7 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

 	    fsync(ndesc);

 	    lseek(ndesc, 0, SEEK_SET);

-	    if(cli_magic_scandesc(ndesc, virname, scanned, root, limits, options, arec, mrec) == CL_VIRUS) {

+	    if(cli_magic_scandesc(ndesc, virname, scanned, engine, limits, options, arec, mrec) == CL_VIRUS) {

 		free(section_hdr);

 		close(ndesc);

 		if(!cli_leavetemps_flag) {

@@ -1448,7 +1448,7 @@ int cli_scanpe(int desc, const char **virname, long int *scanned, const struct c

 	    fsync(ndesc);

 	    lseek(ndesc, 0, SEEK_SET);