@@ -86,7 +86,7 @@ ClamAV 0.100, including but not limited to:

 - Raw scanning of PostScript files.

 - Fix clamsubmit to use the new virus and false positive submission web

   interface.

-- Optionally, flag files with the virus "Heuristic.Limits.Exceeded" when

+- Optionally, flag files with the virus "Heuristics.Limits.Exceeded" when

   size limitations are exceeded.

 - Improved decoders for PDF files.

 - Reduced number of compile time warnings.

@@ -1147,7 +1147,7 @@ Detailed list of changes:

   - Support for Sensory Networks' NodalCore hardware acceleration technology

   - Advanced phishing detection module (experimental)

   - Signatures are stored in separate trees depending on their target type

-  - Algorithmic detection can be controlled with CL_SCAN_ALGORITHMIC

+  - Algorithmic detection can be controlled with CL_SCAN_GENERAL_HEURISTICS

   - Support for new obfuscators: SUE, Y0da Cryptor, CryptFF

   - Support for new packers: NsPack, wwpack32, MEW, Upack

   - Support for SIS files (SymbianOS packages)

@@ -1598,11 +1598,11 @@ the new version of ClamAV have detected and blocked 100% of Mydoom attacks!

 New features in this release include:

 - libclamav

-  - Portable Executable analyser (CL_SCAN_PE) featuring:

+  - Portable Executable analyser (CL_SCAN_PARSE_PE) featuring:

   - UPX decompression (all versions)

   - Petite decompression (2.x)

   - FSG decompression (1.3, 1.31, 1.33)

-  - detection of broken executables (CL_SCAN_BLOCKBROKEN)

+  - detection of broken executables (CL_SCAN_HEURISTIC_BROKEN)

   - new, memory efficient, pattern matching algorithm (multipattern variant

     of Boyer-Moore) - it's now primary matcher and Aho-Corasick is only used

     for regular expression extended signatures

@@ -1618,7 +1618,7 @@ New features in this release include:

   - new method of mail files detection

   - all e-mail attachments are now scanned (previously only the first ten

     attachments were scanned)

-  - added support for scanning URLs in e-mails (CL_SCAN_MAILURL)

+  - added support for scanning URLs in e-mails (CL_SCAN_PARSE_MAILURL)

   - detection of Worm.Mydoom.M.log

   - updated API (still backward compatible but please consult clamdoc.pdf

     (Section 6) and adapt your software)

@@ -39,6 +39,7 @@

 #include "shared/optparser.h"

 #include "shared/misc.h"

+#include "clamav-config.h"

 #include "libclamav/str.h"

 #include "libclamav/clamav.h"

 #include "libclamav/others.h"

@@ -68,7 +68,7 @@ static void onas_ddd_handle_in_moved_to(struct ddd_thrarg *tharg, const char *pa

 static void onas_ddd_handle_in_create(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd, uint64_t in_mask);

 static void onas_ddd_handle_in_moved_from(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd);

 static void onas_ddd_handle_in_delete(struct ddd_thrarg *tharg, const char *path, const char *child_path, const struct inotify_event *event, int wd);

-static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int options);

+static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int extra_options);

 static void onas_ddd_exit(int sig);

@@ -527,8 +527,9 @@ static void onas_ddd_handle_in_moved_to(struct ddd_thrarg *tharg,

 	return;

 }

-static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int options) {

+static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char *pathname, int extra_options) {

+	int thread_started = 1;

 	struct scth_thrarg *scth_tharg = NULL;

 	pthread_attr_t scth_attr;

 	pthread_t scth_pid = 0;

@@ -537,20 +538,37 @@ static void onas_ddd_handle_extra_scanning(struct ddd_thrarg *tharg, const char

 		if (pthread_attr_init(&scth_attr)) break;

 		pthread_attr_setdetachstate(&scth_attr, PTHREAD_CREATE_JOINABLE);

-		if (!(scth_tharg = (struct scth_thrarg *) malloc(sizeof(struct scth_thrarg)))) break;

+		/* Allocate memory for arguments. Thread is responsible for freeing it. */

+		if (!(scth_tharg = (struct scth_thrarg *) calloc(sizeof(struct scth_thrarg), 1))) break;

+		if (!(scth_tharg->options = (struct cl_scan_options *) calloc(sizeof(struct cl_scan_options), 1))) break;

-		scth_tharg->options = options;

+		(void) memcpy(scth_tharg->options, tharg->options, sizeof(struct cl_scan_options));

+

+		scth_tharg->extra_options = extra_options;

 		scth_tharg->opts = tharg->opts;

 		scth_tharg->pathname = strdup(pathname);

 		scth_tharg->engine = tharg->engine;

-		if (!pthread_create(&scth_pid, &scth_attr, onas_scan_th, scth_tharg)) break;

-

-		free(scth_tharg);

-		scth_tharg = NULL;

+		thread_started = pthread_create(&scth_pid, &scth_attr, onas_scan_th, scth_tharg);

 	} while(0);

-	if (!scth_tharg) logg("!ScanOnAccess: Unable to kick off extra scanning.\n");

+	if (0 != thread_started) {

+		/* Failed to create thread. Free anything we may have allocated. */

+		logg("!ScanOnAccess: Unable to kick off extra scanning.\n");

+		if (NULL != scth_tharg) {

+			if (NULL != scth_tharg->pathname){

+				free(scth_tharg->pathname);

+				scth_tharg->pathname = NULL;

+			}

+			if (NULL != scth_tharg->options) {

+				free(scth_tharg->options);

+				scth_tharg->options = NULL;

+			}

+			free(scth_tharg);

+			scth_tharg = NULL;

+		}

+	}

+	

 	return;

 }

@@ -22,19 +22,24 @@

 #ifndef __ONAS_IN_H

 #define __ONAS_IN_H

-#define ONAS_IN 0x01

-#define ONAS_FAN 0x02

+#include "shared/optparser.h"

+#include "libclamav/clamav.h"

+

+/*

+ * Extra options for onas_scan_th(). 

+ */

+#define ONAS_IN 	0x01

+#define ONAS_FAN 	0x02

 #define MAX_WATCH_LEN 7

 struct ddd_thrarg {

 	int sid;

-	int options;

+	struct cl_scan_options *options;

 	int fan_fd;

 	uint64_t fan_mask;

 	const struct optstruct *opts;

 	const struct cl_engine *engine;

-	const struct cl_limits *limits;

 };

@@ -171,24 +171,36 @@ void *onas_fan_th(void *arg)

 	    }

     } else if (!optget(tharg->opts, "OnAccessDisableDDD")->enabled) {

+		int thread_started = 1;

 	    do {

 		    if(pthread_attr_init(&ddd_attr)) break;

 		    pthread_attr_setdetachstate(&ddd_attr, PTHREAD_CREATE_JOINABLE);

-		    if(!(ddd_tharg = (struct ddd_thrarg *) malloc(sizeof(struct ddd_thrarg)))) break;

+			/* Allocate memory for arguments. Thread is responsible for freeing it. */

+		    if (!(ddd_tharg = (struct ddd_thrarg *) calloc(sizeof(struct ddd_thrarg), 1))) break;

+			if (!(ddd_tharg->options = (struct cl_scan_options *) calloc(sizeof(struct cl_scan_options), 1))) break;

+			(void) memcpy(ddd_tharg->options, tharg->options, sizeof(struct cl_scan_options));

 		    ddd_tharg->fan_fd = onas_fan_fd;

 		    ddd_tharg->fan_mask = fan_mask;

 		    ddd_tharg->opts = tharg->opts;

 		    ddd_tharg->engine = tharg->engine;

-		    ddd_tharg->options = tharg->options;

-		    if(!pthread_create(&ddd_pid, &ddd_attr, onas_ddd_th, ddd_tharg)) break;

-

-		    free(ddd_tharg);

-		    ddd_tharg=NULL;

+		    thread_started = pthread_create(&ddd_pid, &ddd_attr, onas_ddd_th, ddd_tharg);

 	    } while(0);

-	    if (!ddd_tharg) logg("!Unable to start dynamic directory determination.\n");

+

+		if (0 != thread_started) {

+			/* Failed to create thread. Free anything we may have allocated. */

+			logg("!Unable to start dynamic directory determination.\n");

+			if (NULL != ddd_tharg) {

+				if (NULL != ddd_tharg->options) {

+					free(ddd_tharg->options);

+					ddd_tharg->options = NULL;

+				}

+				free(ddd_tharg);

+				ddd_tharg = NULL;

+			}

+		}

     } else {

 	    if((pt = optget(tharg->opts, "OnAccessIncludePath"))->enabled) {

@@ -94,7 +94,7 @@ int onas_fan_checkowner(int pid, const struct optstruct *opts)

     return CHK_CLEAN;

 }

-int onas_scan(const char *fname, int fd, const char **virname, const struct cl_engine *engine, int options, int extinfo)

+int onas_scan(const char *fname, int fd, const char **virname, const struct cl_engine *engine, struct cl_scan_options *options, int extinfo)

 {

     int ret = 0;

     struct cb_context context;

@@ -22,6 +22,7 @@

 #define __CLAMD_ONAS_OTHERS_H

 #include "shared/optparser.h"

+#include "libclamav/clamav.h"

 typedef enum {

     CHK_CLEAN,

@@ -30,6 +31,6 @@ typedef enum {

 } cli_check_t;

 int onas_fan_checkowner(int pid, const struct optstruct *opts);

-int onas_scan(const char *fname, int fd, const char **virname, const struct cl_engine *engine, int options, int extinfo);

+int onas_scan(const char *fname, int fd, const char **virname, const struct cl_engine *engine, struct cl_scan_options *options, int extinfo);

 #endif

@@ -38,6 +38,7 @@

 #include "priv_fts.h"

 #include "onaccess_scth.h"

+#include "onaccess_others.h"

 #include "libclamav/clamav.h"

@@ -132,16 +133,31 @@ void *onas_scan_th(void *arg) {

 	sigaction(SIGUSR1, &act, NULL);

 	sigaction(SIGSEGV, &act, NULL);

-	if (tharg->options & ONAS_SCTH_ISDIR) {

+	if (NULL == tharg || NULL == tharg->pathname || NULL == tharg->opts || NULL == tharg->engine) {

+		logg("ScanOnAccess: Invalid thread arguments for extra scanning\n");

+		goto done;

+	}

+

+	if (tharg->extra_options & ONAS_SCTH_ISDIR) {

 		logg("*ScanOnAccess: Performing additional scanning on directory '%s'\n", tharg->pathname);

 		onas_scth_handle_dir(tharg->pathname, tharg);

-	} else if (tharg->options & ONAS_SCTH_ISFILE) {

+	} else if (tharg->extra_options & ONAS_SCTH_ISFILE) {

 		logg("*ScanOnAccess: Performing additional scanning on file '%s'\n", tharg->pathname);

 		onas_scth_handle_file(tharg->pathname, tharg);

 	}

-	free(tharg->pathname);

-	tharg->pathname = NULL;

+done:

+	if (NULL != tharg->pathname){

+		free(tharg->pathname);

+		tharg->pathname = NULL;

+	}

+	if (NULL != tharg->options) {

+		free(tharg->options);

+		tharg->options = NULL;

+	}

+	if (NULL != tharg) {

+		free(tharg);

+	}

 	return NULL;

 }

@@ -21,13 +21,17 @@

 #ifndef __ONAS_SCTH_H

 #define __ONAS_SCTH_H

+#include "shared/optparser.h"

+#include "libclamav/clamav.h"

+

 #define ONAS_SCTH_ISDIR  0x01

 #define ONAS_SCTH_ISFILE 0x02

 struct scth_thrarg {

-	int options;

+	uint32_t extra_options;

+	struct cl_scan_options *options;

 	const struct optstruct *opts;

-        const struct cl_engine *engine;

+	const struct cl_engine *engine;

 	char *pathname;

 };

@@ -117,7 +117,7 @@ void clamd_virus_found_cb(int fd, const char *virname, void *ctx)

     if (d == NULL)

         return;

-    if (!(d->options & CL_SCAN_ALLMATCHES) && !(d->options & CL_SCAN_HEURISTIC_PRECEDENCE))

+    if (!(d->options->general & CL_SCAN_GENERAL_ALLMATCHES) && !(d->options->general & CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE))

         return;

     if (virname == NULL)

         return;

@@ -277,7 +277,7 @@ int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_rea

     if (ret == CL_VIRUS) {

-         if (scandata->options & CL_SCAN_ALLMATCHES || (scandata->infected && scandata->options & CL_SCAN_HEURISTIC_PRECEDENCE)) {

+         if (scandata->options->general & CL_SCAN_GENERAL_ALLMATCHES || (scandata->infected && scandata->options->general & CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE)) {

             if(optget(scandata->opts, "PreludeEnable")->enabled){

                 prelude_logging(filename, virname, context.virhash, context.virsize);

             }

@@ -353,9 +353,14 @@ int scan_pathchk(const char *path, struct cli_ftw_cbdata *data)

     return 0;

 }

-int scanfd(const client_conn_t *conn, unsigned long int *scanned,

-	   const struct cl_engine *engine,

-	   unsigned int options, const struct optstruct *opts, int odesc, int stream)

+int scanfd(

+	const client_conn_t *conn,

+	unsigned long int *scanned,

+	const struct cl_engine *engine,

+	struct cl_scan_options *options,

+	const struct optstruct *opts,

+	int odesc,

+	int stream)

 {

     int ret, fd = conn->scanfd;

 	const char *virname = NULL;

@@ -418,7 +423,13 @@ int scanfd(const client_conn_t *conn, unsigned long int *scanned,

 	return ret;

 }

-int scanstream(int odesc, unsigned long int *scanned, const struct cl_engine *engine, unsigned int options, const struct optstruct *opts, char term)

+int scanstream(

+	int odesc,

+	unsigned long int *scanned,

+	const struct cl_engine *engine,

+	struct cl_scan_options *options,

+	const struct optstruct *opts,

+	char term)

 {

 	int ret, sockfd, acceptd;

 	int tmpd, bread, retval, firsttimeout, timeout, btread;

@@ -24,6 +24,7 @@

 #include <sys/types.h>

+#include "libclamav/others.h"

 #include "libclamav/clamav.h"

 #include "shared/optparser.h"

 #include "thrmgr.h"

@@ -42,7 +43,7 @@ struct scan_cb_data {

     const client_conn_t *conn;

     const char *toplevel_path;

     unsigned long scanned;

-    unsigned int options;

+    struct cl_scan_options *options;

     struct cl_engine *engine;

     const struct optstruct *opts;

     threadpool_t *thr_pool;

@@ -57,8 +58,8 @@ struct cb_context {

     struct scan_cb_data *scandata;

 };

-int scanfd(const client_conn_t *conn, unsigned long int *scanned, const struct cl_engine *engine, unsigned int options, const struct optstruct *opts, int odesc, int stream);

-int scanstream(int odesc, unsigned long int *scanned, const struct cl_engine *engine, unsigned int options, const struct optstruct *opts, char term);

+int scanfd(const client_conn_t *conn, unsigned long int *scanned, const struct cl_engine *engine, struct cl_scan_options *options, const struct optstruct *opts, int odesc, int stream);

+int scanstream(int odesc, unsigned long int *scanned, const struct cl_engine *engine, struct cl_scan_options *options, const struct optstruct *opts, char term);

 int scan_callback(STATBUF *sb, char *filename, const char *msg, enum cli_ftw_reason reason, struct cli_ftw_cbdata *data);

 int scan_pathchk(const char *path, struct cli_ftw_cbdata *data);

 void hash_callback(int fd, unsigned long long size, const unsigned char *md5, const char *virname, void *ctx);

@@ -718,7 +718,7 @@ static int handle_stream(client_conn_t *conn, struct fd_buf *buf, const struct o

 int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsigned int dboptions, const struct optstruct *opts)

 {

 	int max_threads, max_queue, readtimeout, ret = 0;

-	unsigned int options = 0;

+	struct cl_scan_options options;

 	char timestr[32];

 #ifndef	_WIN32

 	struct sigaction sigact;

@@ -742,7 +742,7 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

 	threadpool_t *thr_pool;

 #if defined(FANOTIFY) || defined(CLAMAUTH)

-	pthread_t fan_pid;

+	pthread_t fan_pid = 0;

 	pthread_attr_t fan_attr;

 	struct thrarg *tharg = NULL; /* shut up gcc */

 #endif

@@ -751,6 +751,9 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

 	memset(&sigact, 0, sizeof(struct sigaction));

 #endif

+	/* Initalize scan options struct */

+	memset(&options, 0, sizeof(struct cl_scan_options));

+

     /* set up limits */

     if((opt = optget(opts, "MaxScanSize"))->active) {

 	if((ret = cl_engine_set_num(engine, CL_ENGINE_MAX_SCANSIZE, opt->numarg))) {

@@ -922,11 +925,11 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

     if(optget(opts, "ScanArchive")->enabled) {

 	logg("Archive support enabled.\n");

-	options |= CL_SCAN_ARCHIVE;

+	options.parse |= CL_SCAN_PARSE_ARCHIVE;

 	if(optget(opts, "ArchiveBlockEncrypted")->enabled) {

 	    logg("Archive: Blocking encrypted archives.\n");

-	    options |= CL_SCAN_BLOCKENCRYPTED;

+	    options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED;

 	}

     } else {

@@ -935,28 +938,28 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

     if (optget(opts, "BlockMax")->enabled) {

         logg("BlockMax heuristic detection enabled.\n");

-        options |= CL_SCAN_BLOCKMAX;

+        options.heuristic |= CL_SCAN_HEURISTIC_EXCEEDS_MAX;

     } else {

         logg("BlockMax heuristic detection disabled.\n");

     }

     if(optget(opts, "AlgorithmicDetection")->enabled) {

 	logg("Algorithmic detection enabled.\n");

-	options |= CL_SCAN_ALGORITHMIC;

+	options.general |= CL_SCAN_GENERAL_HEURISTICS;

     } else {

 	logg("Algorithmic detection disabled.\n");

     }

     if(optget(opts, "ScanPE")->enabled) {

 	logg("Portable Executable support enabled.\n");

-	options |= CL_SCAN_PE;

+	options.parse |= CL_SCAN_PARSE_PE;

     } else {

 	logg("Portable Executable support disabled.\n");

     }

     if(optget(opts, "ScanELF")->enabled) {

 	logg("ELF support enabled.\n");

-	options |= CL_SCAN_ELF;

+	options.parse |= CL_SCAN_PARSE_ELF;

     } else {

 	logg("ELF support disabled.\n");

     }

@@ -964,17 +967,17 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

     if(optget(opts, "ScanPE")->enabled || optget(opts, "ScanELF")->enabled) {

 	if(optget(opts, "DetectBrokenExecutables")->enabled) {

 	    logg("Detection of broken executables enabled.\n");

-	    options |= CL_SCAN_BLOCKBROKEN;

+	    options.heuristic |= CL_SCAN_HEURISTIC_BROKEN;

 	}

     }

     if(optget(opts, "ScanMail")->enabled) {

 	logg("Mail files support enabled.\n");

-	options |= CL_SCAN_MAIL;

+	options.parse |= CL_SCAN_PARSE_MAIL;

 	if(optget(opts, "ScanPartialMessages")->enabled) {

 	    logg("Mail: RFC1341 handling enabled.\n");

-	    options |= CL_SCAN_PARTIAL_MESSAGE;

+	    options.mail |= CL_SCAN_MAIL_PARTIAL_MESSAGE;

 	}

     } else {

@@ -983,10 +986,10 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

     if(optget(opts, "ScanOLE2")->enabled) {

 	logg("OLE2 support enabled.\n");

-	options |= CL_SCAN_OLE2;

+	options.parse |= CL_SCAN_PARSE_OLE2;

 	if(optget(opts, "OLE2BlockMacros")->enabled) {

 	    logg("OLE2: Blocking all VBA macros.\n");

-	    options |= CL_SCAN_BLOCKMACROS;

+	    options.heuristic |= CL_SCAN_HEURISTIC_MACROS;

 	}

     } else {

 	logg("OLE2 support disabled.\n");

@@ -994,35 +997,35 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

     if(optget(opts, "ScanPDF")->enabled) {

 	logg("PDF support enabled.\n");

-	options |= CL_SCAN_PDF;

+	options.parse |= CL_SCAN_PARSE_PDF;

     } else {

 	logg("PDF support disabled.\n");

     }

     if(optget(opts, "ScanSWF")->enabled) {

 	logg("SWF support enabled.\n");

-	options |= CL_SCAN_SWF;

+	options.parse |= CL_SCAN_PARSE_SWF;

     } else {

 	logg("SWF support disabled.\n");

     }

     if(optget(opts, "ScanHTML")->enabled) {

 	logg("HTML support enabled.\n");

-	options |= CL_SCAN_HTML;

+	options.parse |= CL_SCAN_PARSE_HTML;

     } else {

 	logg("HTML support disabled.\n");

     }

     if(optget(opts, "ScanXMLDOCS")->enabled) {

 	logg("XMLDOCS support enabled.\n");

-	options |= CL_SCAN_XMLDOCS;

+	options.parse |= CL_SCAN_PARSE_XMLDOCS;

     } else {

 	logg("XMLDOCS support disabled.\n");

     }

     if(optget(opts, "ScanHWP3")->enabled) {

 	logg("HWP3 support enabled.\n");

-	options |= CL_SCAN_HWP3;

+	options.parse |= CL_SCAN_PARSE_HWP3;

     } else {

 	logg("HWP3 support disabled.\n");

     }

@@ -1030,28 +1033,28 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

     if(optget(opts,"PhishingScanURLs")->enabled) {

 	if(optget(opts,"PhishingAlwaysBlockCloak")->enabled) {

-	    options |= CL_SCAN_PHISHING_BLOCKCLOAK; 

+	    options.heuristic |= CL_SCAN_HEURISTIC_PHISHING_CLOAK; 

 	    logg("Phishing: Always checking for cloaked urls\n");

 	}

 	if(optget(opts,"PhishingAlwaysBlockSSLMismatch")->enabled) {

-	    options |= CL_SCAN_PHISHING_BLOCKSSL;

+	    options.heuristic |= CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH;

 	    logg("Phishing: Always checking for ssl mismatches\n");

 	}

     }

     if(optget(opts,"PartitionIntersection")->enabled) {

-        options |= CL_SCAN_PARTITION_INTXN;

+        options.heuristic |= CL_SCAN_HEURISTIC_PARTITION_INTXN;

         logg("Raw DMG: Always checking for partitions intersections\n");

     }

     if(optget(opts,"HeuristicScanPrecedence")->enabled) {

-	    options |= CL_SCAN_HEURISTIC_PRECEDENCE;

+	    options.general |= CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE;

 	    logg("Heuristic: precedence enabled\n");

     }

     if(optget(opts, "StructuredDataDetection")->enabled) {

-        options |= CL_SCAN_STRUCTURED;

+        options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED;

 	if((opt = optget(opts, "StructuredMinCreditCardCount"))->enabled) {

 	    if((ret = cl_engine_set_num(engine, CL_ENGINE_MIN_CC_COUNT, opt->numarg))) {

@@ -1074,15 +1077,15 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

         logg("Structured: Minimum Social Security Number Count set to %u\n", (unsigned int) val);

         if(optget(opts, "StructuredSSNFormatNormal")->enabled)

-            options |= CL_SCAN_STRUCTURED_SSN_NORMAL;

+            options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL;

         if(optget(opts, "StructuredSSNFormatStripped")->enabled)

-	    options |= CL_SCAN_STRUCTURED_SSN_STRIPPED;

+	    options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED;

     }

 #ifdef HAVE__INTERNAL__SHA_COLLECT

     if(optget(opts, "DevCollectHashes")->enabled)

-	options |= CL_SCAN_INTERNAL_COLLECT_SHA;

+	options.dev |= CL_SCAN_DEV_COLLECT_SHA;

 #endif

     selfchk = optget(opts, "SelfCheck")->numarg;

@@ -1209,18 +1212,34 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

 #if defined(FANOTIFY) || defined(CLAMAUTH)

     {

+		int thread_started = 1;

         do {

-	    if(pthread_attr_init(&fan_attr)) break;

-	    pthread_attr_setdetachstate(&fan_attr, PTHREAD_CREATE_JOINABLE);

-	    if(!(tharg = (struct thrarg *) malloc(sizeof(struct thrarg)))) break;

-	    tharg->opts = opts;

-	    tharg->engine = engine;

-	    tharg->options = options;

-	    if(!pthread_create(&fan_pid, &fan_attr, onas_fan_th, tharg)) break;

-	    free(tharg);

-	    tharg=NULL;

-	} while(0);

-	if (!tharg) logg("!Unable to start on-access scan\n");

+			if(pthread_attr_init(&fan_attr)) break;

+			pthread_attr_setdetachstate(&fan_attr, PTHREAD_CREATE_JOINABLE);

+

+			/* Allocate memory for arguments. Thread is responsible for freeing it. */

+			if (!(tharg = (struct thrarg *) calloc(sizeof(struct thrarg), 1))) break;

+			if (!(tharg->options = (struct cl_scan_options *) calloc(sizeof(struct cl_scan_options), 1))) break;

+

+			(void) memcpy(tharg->options, &options, sizeof(struct cl_scan_options));

+			tharg->opts = opts;

+			tharg->engine = engine;

+

+			thread_started = pthread_create(&fan_pid, &fan_attr, onas_fan_th, tharg);

+		} while(0);

+

+		if (0 != thread_started) {

+			/* Failed to create thread. Free anything we may have allocated. */

+			logg("!Unable to start on-access scan.\n");

+			if (NULL != tharg) {

+				if (NULL != tharg->options) {

+					free(tharg->options);

+					tharg->options = NULL;

+				}

+				free(tharg);

+				tharg = NULL;

+			}

+		}

     }

 #else

 	logg("!On-access scan is not available\n");

@@ -1384,7 +1403,7 @@ int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsi

 		conn.scanfd = buf->recvfd;

 		buf->recvfd = -1;

 		conn.sd = buf->fd;

-		conn.options = options;

+		conn.options = &options;

 		conn.opts = opts;

 		conn.thrpool = thr_pool;

 		conn.engine = engine;

@@ -32,19 +32,9 @@

 #include "session.h"

 struct thrarg {

     int sid;

-    int options;

+    struct cl_scan_options *options;

     const struct optstruct *opts;

     const struct cl_engine *engine;

-    const struct cl_limits *limits;

-};

-

-/* thread watcher arguments */

-struct thrwarg {

-    int socketd;

-    struct cl_engine **engine;

-    const struct optstruct *opts;

-    const struct cl_limits *limits;

-    unsigned int options;

 };

 int recvloop_th(int *socketds, unsigned nsockets, struct cl_engine *engine, unsigned int dboptions, const struct optstruct *opts);

@@ -191,7 +191,7 @@ int command(client_conn_t *conn, int *virus)

 {

     int desc = conn->sd;

     struct cl_engine *engine = conn->engine;

-    unsigned int options = conn->options;

+    struct cl_scan_options *options = conn->options;

     const struct optstruct *opts = conn->opts;

     enum scan_type type = TYPE_INIT;

     int maxdirrec;

@@ -369,7 +369,7 @@ int command(client_conn_t *conn, int *virus)

 		return 1;

 	    }

 	    thrmgr_setactivetask(NULL, "ALLMATCHSCAN");

-	    scandata.options |= CL_SCAN_ALLMATCHES;

+	    scandata.options->general |= CL_SCAN_GENERAL_ALLMATCHES;

 	    type = TYPE_SCAN;

 	    break;

 	 default:

@@ -82,7 +82,7 @@ typedef struct client_conn_tag {

     char *filename;

     int scanfd;

     int sd;

-    unsigned int options;

+    struct cl_scan_options *options;

     const struct optstruct *opts;

     struct cl_engine *engine;

     time_t engine_timestamp;

@@ -289,7 +289,7 @@ static void clamscan_virus_found_cb(int fd, const char *virname, void *context)

     return;

 }

-static void scanfile(const char *filename, struct cl_engine *engine, const struct optstruct *opts, unsigned int options)

+static void scanfile(const char *filename, struct cl_engine *engine, const struct optstruct *opts, struct cl_scan_options *options)

 {

     int ret = 0, fd, included;

     unsigned i;

@@ -427,7 +427,7 @@ static void scanfile(const char *filename, struct cl_engine *engine, const struc

         action(filename);

 }

-static void scandirs(const char *dirname, struct cl_engine *engine, const struct optstruct *opts, unsigned int options, unsigned int depth, dev_t dev)

+static void scandirs(const char *dirname, struct cl_engine *engine, const struct optstruct *opts, struct cl_scan_options *options, unsigned int depth, dev_t dev)

 {

     DIR *dd;

     struct dirent *dent;

@@ -540,7 +540,7 @@ static void scandirs(const char *dirname, struct cl_engine *engine, const struct

     }

 }

-static int scanstdin(const struct cl_engine *engine, const struct optstruct *opts, int options)

+static int scanstdin(const struct cl_engine *engine, const struct optstruct *opts, struct cl_scan_options *options)

 {

     int ret;

     unsigned int fsize = 0;

@@ -615,7 +615,8 @@ static int scanstdin(const struct cl_engine *engine, const struct optstruct *opt

 int scanmanager(const struct optstruct *opts)

 {

     int ret = 0, i;

-    unsigned int options = 0, dboptions = 0, dirlnk = 1, filelnk = 1;

+    struct cl_scan_options options;

+    unsigned int dboptions = 0, dirlnk = 1, filelnk = 1;

     struct cl_engine *engine;

     STATBUF sb;

     char *file, cwd[1024], *pua_cats = NULL;

@@ -625,6 +626,9 @@ int scanmanager(const struct optstruct *opts)

     struct rlimit rlim;

 #endif

+    /* Initalize scan options struct */

+    memset(&options, 0, sizeof(struct cl_scan_options));

+

     dirlnk = optget(opts, "follow-dir-symlinks")->numarg;

     if(dirlnk > 2) {

         logg("!--follow-dir-symlinks: Invalid argument\n");

@@ -794,7 +798,7 @@ int scanmanager(const struct optstruct *opts)

     /* JSON check to prevent engine loading if specified without libjson-c  */

 #if HAVE_JSON

     if (optget(opts, "gen-json")->enabled)

-        options |= CL_SCAN_FILE_PROPERTIES;

+        options.general |= CL_SCAN_GENERAL_COLLECT_METADATA;

 #else

     if (optget(opts, "gen-json")->enabled) {

         logg("!Can't generate json (gen-json). libjson-c dev library was missing or misconfigured when ClamAV was built.\n");

@@ -1010,95 +1014,95 @@ int scanmanager(const struct optstruct *opts)

     /* set scan options */

     if(optget(opts, "allmatch")->enabled) {

-        options |= CL_SCAN_ALLMATCHES;

+        options.general |= CL_SCAN_GENERAL_ALLMATCHES;

     }

     if(optget(opts,"phishing-ssl")->enabled)

-        options |= CL_SCAN_PHISHING_BLOCKSSL;

+        options.heuristic |= CL_SCAN_HEURISTIC_PHISHING_SSL_MISMATCH;

     if(optget(opts,"phishing-cloak")->enabled)

-        options |= CL_SCAN_PHISHING_BLOCKCLOAK;

+        options.heuristic |= CL_SCAN_HEURISTIC_PHISHING_CLOAK;

     if(optget(opts,"partition-intersection")->enabled)

-        options |= CL_SCAN_PARTITION_INTXN;

+        options.heuristic |= CL_SCAN_HEURISTIC_PARTITION_INTXN;

     if(optget(opts,"heuristic-scan-precedence")->enabled)

-        options |= CL_SCAN_HEURISTIC_PRECEDENCE;

+        options.general |= CL_SCAN_GENERAL_HEURISTIC_PRECEDENCE;

     if(optget(opts, "scan-archive")->enabled)

-        options |= CL_SCAN_ARCHIVE;

+        options.parse |= CL_SCAN_PARSE_ARCHIVE;

     if(optget(opts, "detect-broken")->enabled)

-        options |= CL_SCAN_BLOCKBROKEN;

+        options.heuristic |= CL_SCAN_HEURISTIC_BROKEN;

     if(optget(opts, "block-encrypted")->enabled)

-        options |= CL_SCAN_BLOCKENCRYPTED;

+        options.heuristic |= CL_SCAN_HEURISTIC_ENCRYPTED;

     if(optget(opts, "block-macros")->enabled)

-        options |= CL_SCAN_BLOCKMACROS;

+        options.heuristic |= CL_SCAN_HEURISTIC_MACROS;

     if(optget(opts, "scan-pe")->enabled)

-        options |= CL_SCAN_PE;

+        options.parse |= CL_SCAN_PARSE_PE;

     if(optget(opts, "scan-elf")->enabled)

-        options |= CL_SCAN_ELF;

+        options.parse |= CL_SCAN_PARSE_ELF;

     if(optget(opts, "scan-ole2")->enabled)

-        options |= CL_SCAN_OLE2;

+        options.parse |= CL_SCAN_PARSE_OLE2;

     if(optget(opts, "scan-pdf")->enabled)

-        options |= CL_SCAN_PDF;

+        options.parse |= CL_SCAN_PARSE_PDF;

     if(optget(opts, "scan-swf")->enabled)

-        options |= CL_SCAN_SWF;

+        options.parse |= CL_SCAN_PARSE_SWF;

     if(optget(opts, "scan-html")->enabled && optget(opts, "normalize")->enabled)

-        options |= CL_SCAN_HTML;

+        options.parse |= CL_SCAN_PARSE_HTML;

     if(optget(opts, "scan-mail")->enabled)

-        options |= CL_SCAN_MAIL;

+        options.parse |= CL_SCAN_PARSE_MAIL;

     if(optget(opts, "scan-xmldocs")->enabled)

-        options |= CL_SCAN_XMLDOCS;

+        options.parse |= CL_SCAN_PARSE_XMLDOCS;

     if(optget(opts, "scan-hwp3")->enabled)

-        options |= CL_SCAN_HWP3;

+        options.parse |= CL_SCAN_PARSE_HWP3;

     if(optget(opts, "algorithmic-detection")->enabled)

-        options |= CL_SCAN_ALGORITHMIC;

+        options.general |= CL_SCAN_GENERAL_HEURISTICS;

     if(optget(opts, "block-max")->enabled) {

-        options |= CL_SCAN_BLOCKMAX;

+        options.heuristic |= CL_SCAN_HEURISTIC_EXCEEDS_MAX;

     }

 #ifdef HAVE__INTERNAL__SHA_COLLECT

     if(optget(opts, "dev-collect-hashes")->enabled)

-        options |= CL_SCAN_INTERNAL_COLLECT_SHA;

+        options.dev |= CL_SCAN_DEV_COLLECT_SHA;

 #endif

     if(optget(opts, "dev-performance")->enabled)

-        options |= CL_SCAN_PERFORMANCE_INFO;

+        options.general |= CL_SCAN_DEV_COLLECT_PERFORMANCE_INFO;

     if(optget(opts, "detect-structured")->enabled) {

-        options |= CL_SCAN_STRUCTURED;

+        options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED;

         if((opt = optget(opts, "structured-ssn-format"))->enabled) {

             switch(opt->numarg) {

             case 0:

-                options |= CL_SCAN_STRUCTURED_SSN_NORMAL;

+                options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL;

                 break;

             case 1:

-                options |= CL_SCAN_STRUCTURED_SSN_STRIPPED;

+                options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED;

                 break;

             case 2:

-                options |= (CL_SCAN_STRUCTURED_SSN_NORMAL | CL_SCAN_STRUCTURED_SSN_STRIPPED);

+                options.heuristic |= (CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL | CL_SCAN_HEURISTIC_STRUCTURED_SSN_STRIPPED);

                 break;

             default:

                 logg("!Invalid argument for --structured-ssn-format\n");

                 return 2;

             }

         } else {

-            options |= CL_SCAN_STRUCTURED_SSN_NORMAL;

+            options.heuristic |= CL_SCAN_HEURISTIC_STRUCTURED_SSN_NORMAL;

         }

         if((opt = optget(opts, "structured-ssn-count"))->active) {

@@ -1118,7 +1122,7 @@ int scanmanager(const struct optstruct *opts)

             }

         }

     } else {

-        options &= ~CL_SCAN_STRUCTURED;

+        options.heuristic &= ~CL_SCAN_HEURISTIC_STRUCTURED;

     }

 #ifdef C_LINUX

@@ -1135,11 +1139,11 @@ int scanmanager(const struct optstruct *opts)