@@ -107,6 +107,7 @@ int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_rea

 {

     struct scan_cb_data *scandata = data->data;

     const char *virname;

+    const char **virpp = &virname;

     int ret;

     int type = scandata->type;

     struct cb_context context;

@@ -227,11 +228,18 @@ int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_rea

     thrmgr_setactivetask(filename, NULL);

     context.filename = filename;

     context.virsize = 0;

-    ret = cl_scanfile_callback(filename, &virname, &scandata->scanned, scandata->engine, scandata->options, &context);

+    ret = cl_scanfile_callback(filename, virpp, &scandata->scanned, scandata->engine, scandata->options, &context);

     thrmgr_setactivetask(NULL, NULL);

+    if (scandata->options & CL_SCAN_ALLMATCHES) {

+	virpp = (const char **)*virpp; /* temp hack for scanall mode until api augmentation */

+	virname = virpp[0];

+    }

+

     if (thrmgr_group_need_terminate(scandata->conn->group)) {

 	free(filename);

+	if (ret == CL_VIRUS && scandata->options & CL_SCAN_ALLMATCHES)

+	    free((void *)virpp);

 	logg("*Client disconnected while scanjob was active\n");

 	return ret == CL_ETIMEOUT ? ret : CL_BREAK;

     }

@@ -240,8 +248,19 @@ int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_rea

 	scandata->infected++;

 	if (conn_reply_virus(scandata->conn, filename, virname) == -1) {

 	    free(filename);

+	    if (scandata->options & CL_SCAN_ALLMATCHES)

+		free((void *)virpp);

 	    return CL_ETIMEOUT;

 	}

+	if (scandata->options & CL_SCAN_ALLMATCHES && virpp[1] != NULL) {

+	    int i = 1;

+	    while (NULL != virpp[i])

+		if (conn_reply_virus(scandata->conn, filename, virpp[i++]) == -1) {

+		    free(filename);

+		    free((void *)virpp);

+		    return CL_ETIMEOUT;

+		}

+	}

 	if(context.virsize)

 	    detstats_add(virname, filename, context.virsize, context.virhash);

 	if(context.virsize && optget(scandata->opts, "ExtendedDetectionInfo")->enabled)

@@ -249,6 +268,11 @@ int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_rea

 	else

 	    logg("~%s: %s FOUND\n", filename, virname);

 	virusaction(filename, virname, scandata->opts);

+	if (scandata->options & CL_SCAN_ALLMATCHES && virpp[1] != NULL) {

+	    int i = 1;

+	    while (NULL != virpp[i])

+                logg("~%s: %s FOUND\n", filename, virpp[i++]);

+	}

     } else if (ret != CL_CLEAN) {

 	scandata->errors++;

 	if (conn_reply(scandata->conn, filename, cl_strerror(ret), "ERROR") == -1) {

@@ -261,6 +285,8 @@ int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_rea

     }

     free(filename);

+    if (ret == CL_VIRUS && scandata->options & CL_SCAN_ALLMATCHES)

+	free((void *)virpp);

     if(ret == CL_EMEM) /* stop scanning */

 	return ret;

@@ -94,7 +94,8 @@ static struct {

     {CMD16, sizeof(CMD16)-1,	COMMAND_IDSESSION,  0,	0, 1},

     {CMD17, sizeof(CMD17)-1,	COMMAND_INSTREAM,   0,	0, 1},

     {CMD19, sizeof(CMD19)-1,	COMMAND_DETSTATSCLEAR,	0, 1, 1},

-    {CMD20, sizeof(CMD20)-1,	COMMAND_DETSTATS,   0, 1, 1}

+    {CMD20, sizeof(CMD20)-1,	COMMAND_DETSTATS,   0, 1, 1},

+    {CMD21, sizeof(CMD21)-1,	COMMAND_ALLMATCHSCAN,  1, 0, 1}

 };

 enum commands parse_command(const char *cmd, const char **argument, int oldstyle)

@@ -314,129 +315,135 @@ int command(client_conn_t *conn, int *virus)

 	    }

 	    return ret;

 #else

-	    conn_reply_error(conn, "FILDES support not compiled in.");

-	    close(conn->scanfd);

-	    return 0;

-#endif

-	case COMMAND_STATS:

-	    thrmgr_setactivetask(NULL, "STATS");

-	    if (conn->group)

-		mdprintf(desc, "%u: ", conn->id);

-	    thrmgr_printstats(desc, conn->term);

-	    return 0;

-	case COMMAND_STREAM:

-	    thrmgr_setactivetask(NULL, "STREAM");

-	    ret = scanstream(desc, NULL, engine, options, opts, conn->term);

-	    if (ret == CL_VIRUS)

-		*virus = 1;

-	    if (ret == CL_EMEM) {

-		if(optget(opts, "ExitOnOOM")->enabled)

-		    return -1;

-		else

-		    return 1;

-	    }

-	    return 0;

-	case COMMAND_INSTREAMSCAN:

-	    thrmgr_setactivetask(NULL, "INSTREAM");

-	    ret = scanfd(conn, NULL, engine, options, opts, desc, 1);

-	    if (ret == CL_VIRUS) {

-		*virus = 1;

-		ret = 0;

-	    } else if (ret == CL_EMEM) {

-		if(optget(opts, "ExitOnOOM")->enabled)

-		    ret = -1;

-		else

- 		    ret = 1;

-	    } else if (ret == CL_ETIMEOUT) {

-		thrmgr_group_terminate(conn->group);

-		ret = 1;

-	    } else

-		ret = 0;

-	    if (ftruncate(conn->scanfd, 0) == -1) {

-		/* not serious, we're going to close it and unlink it anyway */

-		logg("*ftruncate failed: %d\n", errno);

-	    }

-	    close(conn->scanfd);

-	    conn->scanfd = -1;

-	    cli_unlink(conn->filename);

-	    return ret;

-	default:

-	    logg("!Invalid command distpached: %d\n", conn->cmdtype);

-	    return 1;

-    }

-

-    scandata.type = type;

-    maxdirrec = optget(opts, "MaxDirectoryRecursion")->numarg;

-    if (optget(opts, "FollowDirectorySymlinks")->enabled)

-	flags |= CLI_FTW_FOLLOW_DIR_SYMLINK;

-    if (optget(opts, "FollowFileSymlinks")->enabled)

-	flags |= CLI_FTW_FOLLOW_FILE_SYMLINK;

-

-    if(!optget(opts, "CrossFilesystems")->enabled)

-	if(STAT(conn->filename, &sb) == 0)

-	    scandata.dev = sb.st_dev;

-

-    ret = cli_ftw(conn->filename, flags,  maxdirrec ? maxdirrec : INT_MAX, scan_callback, &data, scan_pathchk);

-    if (ret == CL_EMEM) {

-	if(optget(opts, "ExitOnOOM")->enabled)

-	    return -1;

-	else

-	    return 1;

-    }

-    if (scandata.group && type == TYPE_MULTISCAN) {

-	thrmgr_group_waitforall(group, &ok, &error, &total);

-	pthread_mutex_lock(&conn->thrpool->pool_mutex);

-	conn->thrpool->thr_multiscan--;

-	pthread_mutex_unlock(&conn->thrpool->pool_mutex);

-    } else {

-	error = scandata.errors;

-	total = scandata.total;

-	ok = total - error - scandata.infected;

-    }

-

-    if (ok + error == total && (error != total)) {

-	if (conn_reply_single(conn, conn->filename, "OK") == -1)

-	    ret = CL_ETIMEOUT;

-    }

-    *virus = total - (ok + error);

-

-    if (ret == CL_ETIMEOUT)

-	thrmgr_group_terminate(conn->group);

-    return error;

-}

-

-static int dispatch_command(client_conn_t *conn, enum commands cmd, const char *argument)

-{

-    int ret = 0;

-    int bulk;

-    client_conn_t *dup_conn = (client_conn_t *) malloc(sizeof(struct client_conn_tag));

-

-    if(!dup_conn) {

-	logg("!Can't allocate memory for client_conn\n");

-	return -1;

-    }

-    memcpy(dup_conn, conn, sizeof(*conn));

-    dup_conn->cmdtype = cmd;

-    if(cl_engine_addref(dup_conn->engine)) {

-	logg("!cl_engine_addref() failed\n");

-	free(dup_conn);

-	return -1;

-    }

-    dup_conn->scanfd = -1;

-    bulk = 1;

-    switch (cmd) {

-	case COMMAND_FILDES:

-	    if (conn->scanfd == -1) {

-		conn_reply_error(dup_conn, "No file descriptor received.");

-		ret = 1;

-	    }

-	    dup_conn->scanfd = conn->scanfd;

-	    /* consume FD */

-	    conn->scanfd = -1;

-	    break;

-	case COMMAND_SCAN:

-	case COMMAND_CONTSCAN:

-	case COMMAND_MULTISCAN:

+	     conn_reply_error(conn, "FILDES support not compiled in.");

+	     close(conn->scanfd);

+	     return 0;

+ #endif

+	 case COMMAND_STATS:

+	     thrmgr_setactivetask(NULL, "STATS");

+	     if (conn->group)

+		 mdprintf(desc, "%u: ", conn->id);

+	     thrmgr_printstats(desc, conn->term);

+	     return 0;

+	 case COMMAND_STREAM:

+	     thrmgr_setactivetask(NULL, "STREAM");

+	     ret = scanstream(desc, NULL, engine, options, opts, conn->term);

+	     if (ret == CL_VIRUS)

+		 *virus = 1;

+	     if (ret == CL_EMEM) {

+		 if(optget(opts, "ExitOnOOM")->enabled)

+		     return -1;

+		 else

+		     return 1;

+	     }

+	     return 0;

+	 case COMMAND_INSTREAMSCAN:

+	     thrmgr_setactivetask(NULL, "INSTREAM");

+	     ret = scanfd(conn, NULL, engine, options, opts, desc, 1);

+	     if (ret == CL_VIRUS) {

+		 *virus = 1;

+		 ret = 0;

+	     } else if (ret == CL_EMEM) {

+		 if(optget(opts, "ExitOnOOM")->enabled)

+		     ret = -1;

+		 else

+		     ret = 1;

+	     } else if (ret == CL_ETIMEOUT) {

+		 thrmgr_group_terminate(conn->group);

+		 ret = 1;

+	     } else

+		 ret = 0;

+	     if (ftruncate(conn->scanfd, 0) == -1) {

+		 /* not serious, we're going to close it and unlink it anyway */

+		 logg("*ftruncate failed: %d\n", errno);

+	     }

+	     close(conn->scanfd);

+	     conn->scanfd = -1;

+	     cli_unlink(conn->filename);

+	     return ret;

+	 case COMMAND_ALLMATCHSCAN:

+	     thrmgr_setactivetask(NULL, "ALLMATCHSCAN");

+	     scandata.options |= CL_SCAN_ALLMATCHES;

+	     type = TYPE_SCAN;

+	     break;

+	 default:

+	     logg("!Invalid command distpached: %d\n", conn->cmdtype);

+	     return 1;

+     }

+

+     scandata.type = type;

+     maxdirrec = optget(opts, "MaxDirectoryRecursion")->numarg;

+     if (optget(opts, "FollowDirectorySymlinks")->enabled)

+	 flags |= CLI_FTW_FOLLOW_DIR_SYMLINK;

+     if (optget(opts, "FollowFileSymlinks")->enabled)

+	 flags |= CLI_FTW_FOLLOW_FILE_SYMLINK;

+

+     if(!optget(opts, "CrossFilesystems")->enabled)

+	 if(STAT(conn->filename, &sb) == 0)

+	     scandata.dev = sb.st_dev;

+

+     ret = cli_ftw(conn->filename, flags,  maxdirrec ? maxdirrec : INT_MAX, scan_callback, &data, scan_pathchk);

+     if (ret == CL_EMEM) {

+	 if(optget(opts, "ExitOnOOM")->enabled)

+	     return -1;

+	 else

+	     return 1;

+     }

+     if (scandata.group && type == TYPE_MULTISCAN) {

+	 thrmgr_group_waitforall(group, &ok, &error, &total);

+	 pthread_mutex_lock(&conn->thrpool->pool_mutex);

+	 conn->thrpool->thr_multiscan--;

+	 pthread_mutex_unlock(&conn->thrpool->pool_mutex);

+     } else {

+	 error = scandata.errors;

+	 total = scandata.total;

+	 ok = total - error - scandata.infected;

+     }

+

+     if (ok + error == total && (error != total)) {

+	 if (conn_reply_single(conn, conn->filename, "OK") == -1)

+	     ret = CL_ETIMEOUT;

+     }

+     *virus = total - (ok + error);

+

+     if (ret == CL_ETIMEOUT)

+	 thrmgr_group_terminate(conn->group);

+     return error;

+ }

+

+ static int dispatch_command(client_conn_t *conn, enum commands cmd, const char *argument)

+ {

+     int ret = 0;

+     int bulk;

+     client_conn_t *dup_conn = (client_conn_t *) malloc(sizeof(struct client_conn_tag));

+

+     if(!dup_conn) {

+	 logg("!Can't allocate memory for client_conn\n");

+	 return -1;

+     }

+     memcpy(dup_conn, conn, sizeof(*conn));

+     dup_conn->cmdtype = cmd;

+     if(cl_engine_addref(dup_conn->engine)) {

+	 logg("!cl_engine_addref() failed\n");

+	 free(dup_conn);

+	 return -1;

+     }

+     dup_conn->scanfd = -1;

+     bulk = 1;

+     switch (cmd) {

+	 case COMMAND_FILDES:

+	     if (conn->scanfd == -1) {

+		 conn_reply_error(dup_conn, "No file descriptor received.");

+		 ret = 1;

+	     }

+	     dup_conn->scanfd = conn->scanfd;

+	     /* consume FD */

+	     conn->scanfd = -1;

+	     break;

+	 case COMMAND_SCAN:

+	 case COMMAND_CONTSCAN:

+	 case COMMAND_MULTISCAN:

+	 case COMMAND_ALLMATCHSCAN:

 	    dup_conn->filename = cli_strdup_to_utf8(argument);

 	    if (!dup_conn->filename) {

 		logg("!Failed to allocate memory for filename\n");

@@ -608,6 +615,7 @@ int execute_or_dispatch_command(client_conn_t *conn, enum commands cmd, const ch

 	case COMMAND_FILDES:

 	case COMMAND_SCAN:

 	case COMMAND_INSTREAMSCAN:

+	case COMMAND_ALLMATCHSCAN:

 	    return dispatch_command(conn, cmd, argument);

 	case COMMAND_IDSESSION:

 	    conn->group = thrmgr_group_new();

@@ -43,6 +43,8 @@

 #define CMD19 "DETSTATSCLEAR"

 #define CMD20 "DETSTATS"

+#define CMD21 "ALLMATCHSCAN"

+

 #include "libclamav/clamav.h"

 #include "shared/optparser.h"

 #include "server.h"

@@ -70,7 +72,8 @@ enum commands {

     COMMAND_DETSTATS,

     /* internal commands */

     COMMAND_MULTISCANFILE,

-    COMMAND_INSTREAMSCAN

+    COMMAND_INSTREAMSCAN,

+    COMMAND_ALLMATCHSCAN

 };

 typedef struct client_conn_tag {

@@ -236,7 +236,9 @@ int client(const struct optstruct *opts, int *infected, int *err)

     if(remote || scandash) {

 	scantype = STREAM;

 	session = optget(opts, "multiscan")->enabled;

-    } else if(optget(opts, "multiscan")->enabled) scantype = MULTI;

+    } 

+    else if(optget(opts, "multiscan")->enabled) scantype = MULTI;

+    else if(optget(opts, "allmatch")->enabled) scantype = ALLMATCH;

     else scantype = CONT;

     maxrec = optget(clamdopts, "MaxDirectoryRecursion")->numarg;

@@ -27,7 +27,9 @@ enum {

     CONT,

     MULTI,

     STREAM,

-    FILDES

+    FILDES,

+    ALLMATCH,

+    MAX_SCANTYPE = ALLMATCH

 };

 int client(const struct optstruct *opts, int *infected, int *err);

@@ -58,7 +58,7 @@ extern unsigned long int maxstream;

 int printinfected;

 extern struct optstruct *clamdopts;

-static const char *scancmd[] = { "CONTSCAN", "MULTISCAN" };

+static const char *scancmd[] = { "CONTSCAN", "MULTISCAN", "INSTREAM", "FILDES", "ALLMATCHSCAN" };

 /* Connects to clamd 

  * Returns a FD or -1 on error */

@@ -203,6 +203,7 @@ int dsresult(int sockd, int scantype, const char *filename, int *printok, int *e

     switch(scantype) {

     case MULTI:

     case CONT:

+    case ALLMATCH:

     if (!filename) {

 	logg("Filename cannot be NULL for MULTISCAN or CONTSCAN.\n");

 	return -1;

@@ -254,7 +255,13 @@ int dsresult(int sockd, int scantype, const char *filename, int *printok, int *e

 		colon = strrchr(bol, ':');

 	    }

 	    if(!colon) {

-		logg("Failed to parse reply\n");

+		char * unkco = "UNKNOWN COMMAND";

+		if (!strncmp(bol, unkco, sizeof(unkco) - 1))

+		    logg("clamd replied \"UNKNOWN COMMAND\". Command was %s\n", 

+			 (scantype < 0 || scantype > MAX_SCANTYPE) ? "unidentified" :

+			                                             scancmd[scantype]);

+		else

+		    logg("Failed to parse reply: \"%s\"\n", bol);

 		return -1;

 	    } else if(!memcmp(eol - 7, " FOUND", 6)) {

 		*(eol - 7) = 0;

@@ -217,6 +217,7 @@ static void scanfile(const char *filename, struct cl_engine *engine, const struc

 	unsigned i;

 	const struct optstruct *opt;

 	const char *virname;

+	const char **virpp = &virname;

 	STATBUF sb;

 	struct metachain chain;

@@ -291,7 +292,7 @@ static void scanfile(const char *filename, struct cl_engine *engine, const struc

     }

-    if((ret = cl_scandesc_callback(fd, &virname, &info.blocks, engine, options, &chain)) == CL_VIRUS) {

+    if((ret = cl_scandesc_callback(fd, virpp, &info.blocks, engine, options, &chain)) == CL_VIRUS) {

 	if(optget(opts, "archive-verbose")->enabled) {

 	    if (chain.n > 1) {

 		char str[128];

@@ -300,7 +301,16 @@ static void scanfile(const char *filename, struct cl_engine *engine, const struc

 	    } else if (chain.lastvir)

 		logg("~%s!(%d): %s FOUND\n", filename, chain.lastvir-1, virname);

 	}

-	logg("~%s: %s FOUND\n", filename, virname);

+	if (options & CL_SCAN_ALLMATCHES) {

+	    int i = 0;

+	    virpp = (const char **)*virpp; /* horrible */

+	    virname = virpp[0];

+	    while (virpp[i])

+		logg("~%s: %s FOUND\n", filename, virpp[i++]);

+	    free((void *)virpp);

+	}

+	else

+	    logg("~%s: %s FOUND\n", filename, virname);

 	info.files++;

 	info.ifiles++;

@@ -432,6 +442,8 @@ static int scanstdin(const struct cl_engine *engine, const struct optstruct *opt

 	int ret;

 	unsigned int fsize = 0;

 	const char *virname, *tmpdir;

+	const char **virpp = &virname;

+

 	char *file, buff[FILEBUFF];

 	size_t bread;

 	FILE *fs;

@@ -474,7 +486,17 @@ static int scanstdin(const struct cl_engine *engine, const struct optstruct *opt

     info.rblocks += fsize / CL_COUNT_PRECISION;

     if((ret = cl_scanfile(file, &virname, &info.blocks, engine, options)) == CL_VIRUS) {

-	logg("stdin: %s FOUND\n", virname);

+        if (options & CL_SCAN_ALLMATCHES) {

+            int i = 0;

+            virpp = (const char **)*virpp; /* temp hack for scanall mode until api augmentation */

+            virname = virpp[0];

+            while (virpp[i])

+                logg("stdin: %s FOUND\n", virpp[i++]);

+            free((void *)virpp);

+        }

+	else

+	    logg("stdin: %s FOUND\n", virname);

+

 	info.ifiles++;

 	if(bell)

@@ -710,6 +732,9 @@ int scanmanager(const struct optstruct *opts)

     }

     /* set scan options */

+    if(optget(opts, "allmatch")->enabled)

+	options |= CL_SCAN_ALLMATCHES;

+

     if(optget(opts,"phishing-ssl")->enabled)

 	options |= CL_SCAN_PHISHING_BLOCKSSL;

@@ -81,6 +81,7 @@ int cli_7unz (cli_ctx *ctx, size_t offset) {

     UInt16 utf16buf[UTFBUFSZ], *utf16name = utf16buf;

     int namelen = UTFBUFSZ, found = CL_CLEAN;

     Int64 begin_of_archive = offset;

+    UInt32 viruses_found = 0;

     /* Replacement for 

        FileInStream_CreateVTable(&archiveStream); */

@@ -150,14 +151,19 @@ int cli_7unz (cli_ctx *ctx, size_t offset) {

 		encrypted = 1;

 		if(DETECT_ENCRYPTED) {

 		    cli_dbgmsg("cli_7unz: Encrypted files found in archive.\n");

-		    *ctx->virname = "Heuristics.Encrypted.7Zip";

-		    found = CL_VIRUS;

-		    break;

+		    cli_append_virus(ctx, "Heuristics.Encrypted.7Zip");

+		    viruses_found++;

+		    if(!SCAN_ALL) {

+			found = CL_VIRUS;

+			break;

+		    }

 		}

 	    }

 	    if(cli_matchmeta(ctx, name, 0, f->Size, encrypted, i, f->CrcDefined ? f->Crc : 0, NULL)) {

 		found = CL_VIRUS;

-		break;

+		viruses_found++;

+		if (!SCAN_ALL)

+		    break;

 	    }

 	    if (res != SZ_OK)

 		cli_dbgmsg("cli_unz: extraction failed with %d\n", res);

@@ -169,14 +175,16 @@ int cli_7unz (cli_ctx *ctx, size_t offset) {

 		if(cli_writen(fd, outBuffer + offset, outSizeProcessed) != outSizeProcessed)

 		    found = CL_EWRITE;

 		else

-		    found = cli_magic_scandesc(fd, ctx);

+		    if ((found = cli_magic_scandesc(fd, ctx)) == CL_VIRUS)

+			viruses_found++;

 		close(fd);

 		if(!ctx->engine->keeptmp && cli_unlink(name))

 		    found = CL_EUNLINK;

 		free(name);

 		if(found != CL_CLEAN)

-		    break;

+		    if (!(SCAN_ALL && found == CL_VIRUS))

+			break;

 	    }

 	}

 	IAlloc_Free(&allocImp, outBuffer);

@@ -196,5 +204,7 @@ int cli_7unz (cli_ctx *ctx, size_t offset) {

     else

 	cli_dbgmsg("cli_7unz: error %d\n", res);

+    if (SCAN_ALL && viruses_found)

+	return CL_VIRUS;

     return found;

 }

@@ -2594,7 +2594,7 @@ int cli_bytecode_context_setfile(struct cli_bc_ctx *ctx, fmap_t *map)

 int cli_bytecode_runlsig(cli_ctx *cctx, struct cli_target_info *tinfo,

 			 const struct cli_all_bc *bcs, unsigned bc_idx,

-			 const char **virname, const uint32_t* lsigcnt,

+			 const uint32_t* lsigcnt,

 			 const uint32_t *lsigsuboff, fmap_t *map)

 {

     int ret;

@@ -2641,9 +2641,8 @@ int cli_bytecode_runlsig(cli_ctx *cctx, struct cli_target_info *tinfo,

     if (ctx.virname) {

 	int rc;

 	cli_dbgmsg("Bytecode found virus: %s\n", ctx.virname);

-	if (virname)

-	    *virname = ctx.virname;

-	if (!strncmp(*virname, "BC.Heuristics", 13))

+	cli_append_virus(cctx, ctx.virname);

+	if (!strncmp(ctx.virname, "BC.Heuristics", 13))

 	    rc = cli_found_possibly_unwanted(cctx);

 	else

 	    rc = CL_VIRUS;

@@ -2657,7 +2656,7 @@ int cli_bytecode_runlsig(cli_ctx *cctx, struct cli_target_info *tinfo,

 }

 int cli_bytecode_runhook(cli_ctx *cctx, const struct cl_engine *engine, struct cli_bc_ctx *ctx,

-			 unsigned id, fmap_t *map, const char **virname)

+			 unsigned id, fmap_t *map)

 {

     const unsigned *hooks = engine->hooks[id - _BC_START_HOOKS];

     unsigned i, hooks_cnt = engine->hooks_cnt[id - _BC_START_HOOKS];

@@ -2690,10 +2689,13 @@ int cli_bytecode_runhook(cli_ctx *cctx, const struct cl_engine *engine, struct c

 	}

 	if (ctx->virname) {

 	    cli_dbgmsg("Bytecode found virus: %s\n", ctx->virname);

-	    if (virname)

-		*virname = ctx->virname;

-	    cli_bytecode_context_clear(ctx);

-	    return CL_VIRUS;

+	    cli_append_virus(cctx, ctx->virname);

+	    if (!(cctx->options & CL_SCAN_ALLMATCHES)) {

+		cli_bytecode_context_clear(ctx);

+		return CL_VIRUS;

+	    }

+	    cli_bytecode_context_reset(ctx);

+	    continue;

 	}

 	ret = cli_bytecode_context_getresult_int(ctx);

 	/* TODO: use prefix here */

@@ -2726,10 +2728,15 @@ int cli_bytecode_runhook(cli_ctx *cctx, const struct cl_engine *engine, struct c

 		}

 		free(tempfile);

 		if (ret != CL_CLEAN) {

-		    if (ret == CL_VIRUS)

+		    if (ret == CL_VIRUS) {

 			cli_dbgmsg("Scanning unpacked file by bytecode %u found a virus\n", bc->id);

-		    cli_bytecode_context_clear(ctx);

-		    return ret;

+			if (cctx->options & CL_SCAN_ALLMATCHES) {

+			    cli_bytecode_context_reset(ctx);

+			    continue;

+			}

+			cli_bytecode_context_clear(ctx);

+		    	return ret;

+		    }

 		}

 		cli_bytecode_context_reset(ctx);

 		continue;

@@ -118,8 +118,8 @@ void cli_bytecode_describe(const struct cli_bc *bc);

 struct cli_exe_info;

 struct cli_ctx_tag;

 struct cli_target_info;

-int cli_bytecode_runlsig(struct cli_ctx_tag *ctx, struct cli_target_info *info, const struct cli_all_bc *bcs, unsigned bc_idx, const char **virname, const uint32_t* lsigcnt, const uint32_t *lsigsuboff, fmap_t *map);

-int cli_bytecode_runhook(struct cli_ctx_tag *cctx, const struct cl_engine *engine, struct cli_bc_ctx *ctx, unsigned id, fmap_t *map, const char **virname);

+int cli_bytecode_runlsig(struct cli_ctx_tag *ctx, struct cli_target_info *info, const struct cli_all_bc *bcs, unsigned bc_idx, const uint32_t* lsigcnt, const uint32_t *lsigsuboff, fmap_t *map);

+int cli_bytecode_runhook(struct cli_ctx_tag *cctx, const struct cl_engine *engine, struct cli_bc_ctx *ctx, unsigned id, fmap_t *map);

 #ifdef __cplusplus

 extern "C" {

@@ -511,8 +511,7 @@ int32_t cli_bcapi_extract_new(struct cli_bc_ctx *ctx, int32_t id)

 	cctx->recursion--;

 	cctx->container_type = current;

 	if (res == CL_VIRUS) {

-	    if (cctx->virname)

-		ctx->virname = *cctx->virname;

+	    ctx->virname = cli_get_last_virus(cctx);

 	    ctx->found = 1;

 	}

     }

@@ -142,6 +142,7 @@ typedef enum {

 #define CL_SCAN_PARTIAL_MESSAGE         0x40000

 #define CL_SCAN_HEURISTIC_PRECEDENCE    0x80000

 #define CL_SCAN_BLOCKMACROS		0x100000

+#define CL_SCAN_ALLMATCHES		0x200000

 #define CL_SCAN_PERFORMANCE_INFO        0x40000000 /* collect performance timings */

 #define CL_SCAN_INTERNAL_COLLECT_SHA    0x80000000 /* Enables hash output in sha-collect builds - for internal use only */

@@ -73,7 +73,7 @@ int cli_scanelf(cli_ctx *ctx)

 	uint8_t conv = 0, err;

 	unsigned int format;

 	fmap_t *map = *ctx->fmap;

-

+	uint32_t viruses_found = 0;

     cli_dbgmsg("in cli_scanelf\n");

@@ -214,8 +214,7 @@ int cli_scanelf(cli_ctx *ctx)

     if(phnum > 128) {

 	cli_dbgmsg("ELF: Suspicious number of program headers\n");

         if(DETECT_BROKEN) {

-	    if(ctx->virname)

-		*ctx->virname = "Heuristics.Broken.Executable";

+	    cli_append_virus(ctx, "Heuristics.Broken.Executable");

 	    return CL_VIRUS;

         }

 	return CL_EFORMAT;

@@ -227,8 +226,7 @@ int cli_scanelf(cli_ctx *ctx)

 	if(phentsize != sizeof(struct elf_program_hdr32)) {

 	    cli_dbgmsg("ELF: phentsize != sizeof(struct elf_program_hdr32)\n");

 	    if(DETECT_BROKEN) {

-		if(ctx->virname)

-		    *ctx->virname = "Heuristics.Broken.Executable";

+		cli_append_virus(ctx, "Heuristics.Broken.Executable");

 		return CL_VIRUS;

 	    }

 	    return CL_EFORMAT;

@@ -275,8 +273,7 @@ int cli_scanelf(cli_ctx *ctx)

 		cli_dbgmsg("ELF: Possibly broken ELF file\n");

 		free(program_hdr);

 		if(DETECT_BROKEN) {

-		    if(ctx->virname)

-			*ctx->virname = "Heuristics.Broken.Executable";

+		    cli_append_virus(ctx, "Heuristics.Broken.Executable");

 		    return CL_VIRUS;

 		}

 		return CL_CLEAN;

@@ -296,8 +293,7 @@ int cli_scanelf(cli_ctx *ctx)

 	if(err) {

 	    cli_dbgmsg("ELF: Can't calculate file offset of entry point\n");

 	    if(DETECT_BROKEN) {

-		if(ctx->virname)

-		    *ctx->virname = "Heuristics.Broken.Executable";

+                cli_append_virus(ctx, "Heuristics.Broken.Executable");

 		return CL_VIRUS;

 	    }

 	    return CL_EFORMAT;

@@ -319,8 +315,7 @@ int cli_scanelf(cli_ctx *ctx)

     if(shentsize != sizeof(struct elf_section_hdr32)) {

 	cli_dbgmsg("ELF: shentsize != sizeof(struct elf_section_hdr32)\n");

         if(DETECT_BROKEN) {

-	    if(ctx->virname)

-		*ctx->virname = "Heuristics.Broken.Executable";

+	    cli_append_virus(ctx, "Heuristics.Broken.Executable");

 	    return CL_VIRUS;

         }

 	return CL_EFORMAT;

@@ -369,8 +364,7 @@ int cli_scanelf(cli_ctx *ctx)

             cli_dbgmsg("ELF: Possibly broken ELF file\n");

             free(section_hdr);

             if(DETECT_BROKEN) {

-                if(ctx->virname)

-                    *ctx->virname = "Heuristics.Broken.Executable";

+                cli_append_virus(ctx, "Heuristics.Broken.Executable");

 		return CL_VIRUS;

             }

             return CL_CLEAN;

@@ -175,8 +175,7 @@ struct macho_fat_arch

     if(matcher)						    \

 	return -1;					    \

     if(DETECT_BROKEN) {					    \

-	if(ctx->virname)				    \

-	    *ctx->virname = "Heuristics.Broken.Executable"; \

+	cli_append_virus(ctx, "Heuristics.Broken.Executable"); \

 	return CL_VIRUS;				    \

     }							    \

     return CL_EFORMAT

@@ -1157,7 +1157,7 @@ void cli_ac_chkmacro(struct cli_matcher *root, struct cli_ac_data *data, unsigne

 }

-int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, struct cli_matched_type **ftoffset, unsigned int mode, const cli_ctx *ctx)

+int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, struct cli_matched_type **ftoffset, unsigned int mode, cli_ctx *ctx)

 {

 	struct cli_ac_node *current;

 	struct cli_ac_patt *patt, *pt;

@@ -1359,11 +1359,18 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 					pt = pt->next_same;

 					continue;

 				    } else {

-					if(virname)

-					    *virname = pt->virname;

+					if(virname) {

+					    if (ctx && SCAN_ALL && virname == ctx->virname)

+						cli_append_virus(ctx, (const char *)pt->virname);

+					    else

+						*virname = pt->virname;

+					}

 					if(customdata)

 					    *customdata = pt->customdata;

-					return CL_VIRUS;

+					if (!ctx || !SCAN_ALL)

+					    return CL_VIRUS;

+					pt = pt->next_same;

+					continue;

 				    }

 				}

 			    }

@@ -1403,11 +1410,18 @@ int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 				    pt = pt->next_same;

 				    continue;

 				} else {

-				    if(virname)

-					*virname = pt->virname;

+				    if(virname) {

+					if (ctx && SCAN_ALL && virname == ctx->virname)

+					    cli_append_virus(ctx, pt->virname);

+					else

+					    *virname = pt->virname;

+				    }

 				    if(customdata)

 					*customdata = pt->customdata;

-				    return CL_VIRUS;

+				    if (!ctx || !SCAN_ALL)

+					return CL_VIRUS;

+				    pt = pt->next_same;

+				    continue;

 				}

 			    }

 			}

@@ -93,7 +93,7 @@ int cli_ac_initdata(struct cli_ac_data *data, uint32_t partsigs, uint32_t lsigs,

 void cli_ac_chkmacro(struct cli_matcher *root, struct cli_ac_data *data, unsigned lsigid1);

 int cli_ac_chklsig(const char *expr, const char *end, uint32_t *lsigcnt, unsigned int *cnt, uint64_t *ids, unsigned int parse_only);

 void cli_ac_freedata(struct cli_ac_data *data);

-int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, struct cli_matched_type **ftoffset, unsigned int mode, const cli_ctx *ctx);

+int cli_ac_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, void **customdata, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, uint32_t offset, cli_file_t ftype, struct cli_matched_type **ftoffset, unsigned int mode, cli_ctx *ctx);

 int cli_ac_buildtrie(struct cli_matcher *root);

 int cli_ac_init(struct cli_matcher *root, uint8_t mindepth, uint8_t maxdepth, uint8_t dconf_prefiltering);

 int cli_ac_caloff(const struct cli_matcher *root, struct cli_ac_data *data, const struct cli_target_info *info);

@@ -244,7 +244,7 @@ void cli_bm_free(struct cli_matcher *root)

     }

 }

-int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_bm_patt **patt, const struct cli_matcher *root, uint32_t offset, const struct cli_target_info *info, struct cli_bm_off *offdata)

+int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_bm_patt **patt, const struct cli_matcher *root, uint32_t offset, const struct cli_target_info *info, struct cli_bm_off *offdata, uint32_t *viroffset)

 {

 	uint32_t i, j, off, off_min, off_max;

 	uint8_t found, pchain, shift;

@@ -374,8 +374,11 @@ int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **v

 			    continue;

 			}

 		    }

-		    if(virname)

+		    if(virname) {

 			*virname = p->virname;

+			if(viroffset)

+			    *viroffset = offset + i + j - BM_MIN_LENGTH + BM_BLOCK_SIZE;

+		    }

 		    if(patt)

 			*patt = p;

 		    return CL_VIRUS;

@@ -47,7 +47,7 @@ int cli_bm_addpatt(struct cli_matcher *root, struct cli_bm_patt *pattern, const

 int cli_bm_init(struct cli_matcher *root);

 int cli_bm_initoff(const struct cli_matcher *root, struct cli_bm_off *data, const struct cli_target_info *info);

 void cli_bm_freeoff(struct cli_bm_off *data);

-int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_bm_patt **patt, const struct cli_matcher *root, uint32_t offset, const struct cli_target_info *info, struct cli_bm_off *offdata);

+int cli_bm_scanbuff(const unsigned char *buffer, uint32_t length, const char **virname, const struct cli_bm_patt **patt, const struct cli_matcher *root, uint32_t offset, const struct cli_target_info *info, struct cli_bm_off *offdata, uint32_t *viroffset);

 void cli_bm_free(struct cli_matcher *root);

 #endif

@@ -91,13 +91,16 @@ static inline int matcher_run(const struct cli_matcher *root,

 			      unsigned int acmode,

 			      struct cli_ac_result **acres,

 			      fmap_t *map,

-			      struct cli_bm_off *offdata)

+			      struct cli_bm_off *offdata,

+			      uint32_t *viroffset,

+			      cli_ctx *ctx)

 {

     int ret;

     int32_t pos = 0;

     struct filter_match_info info;

     uint32_t orig_length, orig_offset;

     const unsigned char* orig_buffer;

+    unsigned int viruses_found = 0;

     if (root->filter) {

 	if(filter_search_ext(root->filter, buffer, length, &info) == -1) {

@@ -128,15 +131,30 @@ static inline int matcher_run(const struct cli_matcher *root,

 	    /* Don't use prefiltering for BM offset mode, since BM keeps tracks

 	     * of offsets itself, and doesn't work if we skip chunks of input

 	     * data */

-	    ret = cli_bm_scanbuff(orig_buffer, orig_length, virname, NULL, root, orig_offset, tinfo, offdata);

+	    ret = cli_bm_scanbuff(orig_buffer, orig_length, virname, NULL, root, orig_offset, tinfo, offdata, viroffset);

 	} else {

-	    ret = cli_bm_scanbuff(buffer, length, virname, NULL, root, offset, tinfo, offdata);

+	    ret = cli_bm_scanbuff(buffer, length, virname, NULL, root, offset, tinfo, offdata, viroffset);

+	}

+	if (ret == CL_VIRUS) {

+	    if (ctx) {

+		cli_append_virus(ctx, *virname);

+#if 1

+		if (SCAN_ALL)

+		    viruses_found++;

+		else

+#endif

+		    return ret;

+	    }

 	}

-	if (ret == CL_VIRUS)

-	    return ret;

     }