@@ -279,15 +279,15 @@ void help(void)

     mprintf("    --max-ziptypercg=#n                  Maximum size zip to type reanalyze\n");

     mprintf("    --max-partitions=#n                  Maximum number of partitions in disk image to be scanned\n");

     mprintf("    --max-iconspe=#n                     Maximum number of icons in PE file to be scanned\n");

-    mprintf("    --enable-stats                       Enable statistical reporting of malware\n");

-    mprintf("    --disable-pe-stats                   Disable submission of individual PE sections in stats submissions\n");

-    mprintf("    --stats-timeout=#n                   Number of seconds to wait for waiting a response back from the stats server\n");

-    mprintf("    --stats-host-id=UUID                 Set the Host ID used when submitting statistical info.\n");

 #if HAVE_PCRE

     mprintf("    --pcre-match-limit=#n                Maximum calls to the PCRE match function.\n");

     mprintf("    --pcre-recmatch-limit=#n             Maximum recursive calls to the PCRE match function.\n");

-    mprintf("    --pcre-max-filesize=#n               Maximum size file to perform PCRE sunsig matching.\n");

+    mprintf("    --pcre-max-filesize=#n               Maximum size file to perform PCRE subsig matching.\n");

 #endif /* HAVE_PCRE */

+    mprintf("    --enable-stats                       Enable statistical reporting of malware\n");

+    mprintf("    --disable-pe-stats                   Disable submission of individual PE sections in stats submissions\n");

+    mprintf("    --stats-timeout=#n                   Number of seconds to wait for waiting a response back from the stats server\n");

+    mprintf("    --stats-host-id=UUID                 Set the Host ID used when submitting statistical info.\n");

     mprintf("\n");

     mprintf("(*) Default scan settings\n");

     mprintf("(**) Certain files (e.g. documents, archives, etc.) may in turn contain other\n");

@@ -598,6 +598,45 @@ WARNING: setting this limit too high may result in severe damage or impact perfo

 .br

 Default: 100

 .TP

+\fBPCREMatchLimit SIZE\fR

+This option sets the maximum calls to the PCRE match function during an instance of regex matching.

+.br

+Instances using more than this limit will be terminated and alert the user but the scan will continue.

+.br

+For more information on match_limit, see the PCRE documentation.

+.br

+Negative values are not allowed.

+.br

+WARNING: setting this limit too high may severely impact performance.

+.br

+Default: 10000

+.TP

+\fBPCRERecMatchLimit NUMBER\fR

+This option sets the maximum recursive calls to the PCRE match function during an instance of regex matching.

+.br

+Instances using more than this limit will be terminated and alert the user but the scan will continue.

+.br

+For more information on match_limit_recursion, see the PCRE documentation.

+.br

+Negative values are not allowed and values > PCREMatchLimit are superfluous.

+.br

+WARNING: setting this limit too high may severely impact performance.

+.br

+Default: 5000

+.TP

+\fBPCREMaxFileSize NUMBER\fR

+This option sets the maximum filesize for which PCRE subsigs will be executed.

+.br

+Files exceeding this limit will not have PCRE subsigs executed unless a subsig is encompassed to a smaller buffer.

+.br

+Negative values are not allowed.

+.br

+Setting this value to zero disables the limit.

+.br

+WARNING: setting this limit too high or disabling it may severely impact performance.

+.br

+Default: 25M

+.TP

 \fBClamukoScanOnAccess (OBSOLETE)\fR

 \fBWARNING:\fR This option is no longer accepted. See \fBScanOnAccess\fR.

 .TP 

@@ -214,6 +214,15 @@ This option sets the maximum number of partitions of a raw disk image to be scan

 \fB\-\-max\-iconspe=#n\fR

 This option sets the maximum number of icons within a PE to be scanned. This must be a positive integer (default: 100).

 .TP

+\fB\-\-pcre-match-limit=#n\fR

+Maximum calls to the PCRE match function (default: 10000).

+.TP

+\fB\-\-pcre-recmatch-limit=#n\fR

+Maximum recursive calls to the PCRE match function (default: 5000).

+.TP

+\fB\-\-pcre-max-filesize=#n\fR

+Maximum size file to perform PCRE subsig matching (default: 25 MB, max: <4 GB).

+.TP

 \fB\-\-enable\-stats\fR

 This option enables submission of statistical data. (Default: stats submissions disabled)

 .TP