Add option to enable PCRE2 JIT for regex subsignature matching

ClamAV compiles regex subsignatures with pcre2_compile() and matches them with
the interpreted pcre2_match(), and never enables the PCRE2 JIT compiler even
when the linked PCRE2 library supports it. For scans where the Aho-Corasick
prefilter promotes many PCRE subsignatures over a large buffer, the interpreted
matcher dominates scan time.

Add a 'PCREJit' clamd.conf option and a '--pcre-jit' clamscan option, exposed
through a new CL_ENGINE_PCRE_JIT engine setting, mirroring how the existing
PCRE limit options are plumbed (engine field, set/get, settings copy/apply).
The option is disabled by default to preserve existing behavior on upgrade.

When enabled, cli_pcre_compile() performs a best-effort pcre2_jit_compile()
after setting the match limits. pcre2_match() automatically dispatches to the
JIT code when a pattern has been JIT-compiled, so no change to the match call
is required for the common path. If JIT compilation fails (PCRE2 built without
JIT, or an unsupported construct), the failure is logged at debug level and
matching falls back to the interpreter.

To guarantee identical results to the interpreter when JIT is enabled,
cli_pcre_match() now retries a match with PCRE2_NO_JIT if the JIT matcher
returns PCRE2_ERROR_JIT_STACKLIMIT (the JIT uses a fixed stack and does not
grow on demand like the interpreter).

On a workload that promotes several hundred PCRE subsignatures over a ~37 MiB
buffer, enabling the option reduced the PCRE phase roughly 3-4x and overall
scan time by about 2x, with no change in detection.

Author: zkan

NEWS.md

@@ -15,6 +15,17 @@ ClamAV 1.6.0 includes the following improvements and changes:
 
 ### Other improvements
 
+- Added an option to enable the PCRE2 JIT compiler for regex subsignature
+  matching. When enabled, patterns are JIT-compiled at database load and matched
+  with native code, significantly reducing scan time for content that triggers
+  many PCRE subsignatures. The new option is `PCREJit` in `clamd.conf` and
+  `--pcre-jit` for `clamscan`, and is disabled by default. It requires the
+  linked PCRE2 library to be built with JIT support; otherwise matching
+  transparently falls back to the interpreter. Detection results are unchanged.
+  Note: PCRE2 does not enforce the depth/recursion limit (`PCRERecMatchLimit`)
+  for JIT matches, though `PCREMatchLimit` is still enforced; leave the option
+  disabled if you rely on `PCRERecMatchLimit` to bound recursive backtracking.
+
 ### Bug fixes
 
 ### Acknowledgments

clamd/clamd.c

@@ -741,6 +741,14 @@ int main(int argc, char **argv)
             }
         }
 
+        if ((opt = optget(opts, "PCREJit"))->active) {
+            if ((ret = cl_engine_set_num(engine, CL_ENGINE_PCRE_JIT, opt->enabled))) {
+                logg(LOGG_ERROR, "cli_engine_set_num(PCREJit) failed: %s\n", cl_strerror(ret));
+                cl_engine_free(engine);
+                return 1;
+            }
+        }
+
         if ((opt = optget(opts, "PCRERecMatchLimit"))->active) {
             if ((ret = cl_engine_set_num(engine, CL_ENGINE_PCRE_RECMATCH_LIMIT, opt->numarg))) {
                 logg(LOGG_ERROR, "cli_engine_set_num(PCRERecMatchLimit) failed: %s\n", cl_strerror(ret));

clamscan/clamscan.c

@@ -363,6 +363,7 @@ void help(void)
     mprintf(LOGG_INFO, "    --pcre-match-limit=#n                Maximum calls to the PCRE match function.\n");
     mprintf(LOGG_INFO, "    --pcre-recmatch-limit=#n             Maximum recursive calls to the PCRE match function.\n");
     mprintf(LOGG_INFO, "    --pcre-max-filesize=#n               Maximum size file to perform PCRE subsig matching.\n");
+    mprintf(LOGG_INFO, "    --pcre-jit[=yes/no(*)]               JIT-compile PCRE subsignatures for faster matching (requires PCRE2 JIT support; pcre-recmatch-limit is not enforced for JIT matches).\n");
     mprintf(LOGG_INFO, "    --disable-cache                      Disable caching and cache checks for hash sums of scanned files.\n");
     mprintf(LOGG_INFO, "    --hash-hint                          The file hash so that libclamav does not need to calculate it.\n");
     mprintf(LOGG_INFO, "                                         The type of hash must match the '--hash-alg'.\n");

clamscan/manager.c

@@ -1510,6 +1510,14 @@ int scanmanager(const struct optstruct *opts)
         }
     }
 
+    if ((opt = optget(opts, "pcre-jit"))->active) {
+        if ((ret = cl_engine_set_num(engine, CL_ENGINE_PCRE_JIT, opt->enabled))) {
+            logg(LOGG_ERROR, "cli_engine_set_num(CL_ENGINE_PCRE_JIT) failed: %s\n", cl_strerror(ret));
+            ret = 2;
+            goto done;
+        }
+    }
+
     if ((opt = optget(opts, "pcre-recmatch-limit"))->active) {
         if ((ret = cl_engine_set_num(engine, CL_ENGINE_PCRE_RECMATCH_LIMIT, opt->numarg))) {
             logg(LOGG_ERROR, "cli_engine_set_num(CL_ENGINE_PCRE_RECMATCH_LIMIT) failed: %s\n", cl_strerror(ret));

common/optparser.c

@@ -517,6 +517,8 @@ const struct clam_option __clam_options[] = {
 
     {"PCREMaxFileSize", "pcre-max-filesize", 0, CLOPT_TYPE_SIZE, MATCH_SIZE, CLI_DEFAULT_PCRE_MAX_FILESIZE, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "This option sets the maximum filesize for which PCRE subsigs will be executed.\nFiles exceeding this limit will not have PCRE subsigs executed unless a subsig is encompassed to a smaller buffer.\nNegative values are not allowed.\nSetting this value to zero disables the limit.\nWARNING: setting this limit too high or disabling it may severely impact performance.", "100M"},
 
+    {"PCREJit", "pcre-jit", 0, CLOPT_TYPE_BOOL, MATCH_BOOL, 0, NULL, 0, OPT_CLAMD | OPT_CLAMSCAN, "When enabled, PCRE regex subsignatures are JIT-compiled at database load and matched with native code, which can significantly reduce scan time for content that triggers many PCRE subsignatures.\nThis requires the linked PCRE2 library to be built with JIT support; otherwise matching falls back to the interpreter with no functional change.\nDetection results are unchanged when enabled.\nNote: PCRE2 does not enforce the depth/recursion limit (PCRERecMatchLimit) for JIT matches; PCREMatchLimit is still enforced. Leave this disabled if you rely on PCRERecMatchLimit to bound recursive backtracking.", "no"},
+
     /* OnAccess settings */
     {"OnAccessMountPath", NULL, 0, CLOPT_TYPE_STRING, NULL, -1, NULL, FLAG_MULTIPLE, OPT_CLAMD, "This option specifies a directory or mount point which should be scanned on access. The mount point specified, or the mount point containing the specified directory will be watched, but only notifications will occur. If any directories are specified, this option will preempt the DDD system. It can also be used multiple times.", "/\n/home/user"},
 

etc/clamd.conf.sample

@@ -748,6 +748,17 @@ Example
 # Default: 100M
 #PCREMaxFileSize 400M
 
+# When enabled, PCRE regex subsignatures are JIT-compiled at database load and
+# matched with native code. This can significantly reduce scan time for content
+# that triggers many PCRE subsignatures. Requires the linked PCRE2 library to be
+# built with JIT support; otherwise matching transparently falls back to the
+# interpreter. Detection results are unchanged when enabled.
+# Note: PCRE2 does not enforce the depth/recursion limit (PCRERecMatchLimit) for
+# JIT matches; PCREMatchLimit is still enforced. Leave this disabled if you rely
+# on PCRERecMatchLimit to bound recursive backtracking.
+# Default: no
+#PCREJit yes
+
 # When AlertExceedsMax is set, files exceeding the MaxFileSize, MaxScanSize, or
 # MaxRecursion limit will be flagged with the virus name starting with
 # "Heuristics.Limits.Exceeded".

libclamav/clamav.h

@@ -343,6 +343,7 @@ enum cl_engine_field {
     CL_ENGINE_CVDCERTSDIR,         /** (char *) */
     CL_ENGINE_TMPDIR_RECURSION,    /** uint32_t */
     CL_ENGINE_FIPS_LIMITS,         /** uint32_t */
+    CL_ENGINE_PCRE_JIT,            /** uint32_t */
 };
 
 enum bytecode_security {

libclamav/default.h

@@ -57,6 +57,7 @@
 #define CLI_DEFAULT_PCRE_MATCH_LIMIT    100000
 #define CLI_DEFAULT_PCRE_RECMATCH_LIMIT 2000
 #define CLI_DEFAULT_PCRE_MAX_FILESIZE   (1024 * 1024 * 100)   // 100 MB
+#define CLI_DEFAULT_PCRE_JIT            0                     // PCRE2 JIT disabled by default
 
 /* Maximums */
 #define CLI_MAX_MAXRECLEVEL     100

libclamav/matcher-pcre.c

@@ -366,7 +366,7 @@ cl_error_t cli_pcre_addpatt(struct cli_matcher *root, const char *virname, const
     return CL_SUCCESS;
 }
 
-cl_error_t cli_pcre_build(struct cli_matcher *root, long long unsigned match_limit, long long unsigned recmatch_limit, const struct cli_dconf *dconf)
+cl_error_t cli_pcre_build(struct cli_matcher *root, long long unsigned match_limit, long long unsigned recmatch_limit, int try_jit, const struct cli_dconf *dconf)
 {
     unsigned int i;
     cl_error_t ret;
@@ -408,11 +408,11 @@ cl_error_t cli_pcre_build(struct cli_matcher *root, long long unsigned match_lim
         if (dconf && (dconf->pcre & PCRE_CONF_OPTIONS)) {
             /* compile the regex, no options override *wink* */
             pm_dbgmsg("cli_pcre_build: Compiling regex: /%s/\n", pm->pdata.expression);
-            ret = cli_pcre_compile(&(pm->pdata), match_limit, recmatch_limit, 0, 0);
+            ret = cli_pcre_compile(&(pm->pdata), match_limit, recmatch_limit, 0, 0, try_jit);
         } else {
             /* compile the regex, options overridden and disabled */
             pm_dbgmsg("cli_pcre_build: Compiling regex: /%s/ (without options)\n", pm->pdata.expression);
-            ret = cli_pcre_compile(&(pm->pdata), match_limit, recmatch_limit, 0, 1);
+            ret = cli_pcre_compile(&(pm->pdata), match_limit, recmatch_limit, 0, 1, try_jit);
         }
         if (ret != CL_SUCCESS) {
             cli_errmsg("cli_pcre_build: failed to build pcre regex\n");

libclamav/matcher-pcre.h

@@ -69,7 +69,7 @@ cl_error_t cli_pcre_addpatt(struct cli_matcher *root, const char *virname, const
 void cli_pcre_freemeta(struct cli_matcher *root, struct cli_pcre_meta *pm);
 void cli_pcre_freetable(struct cli_matcher *root);
 
-cl_error_t cli_pcre_build(struct cli_matcher *root, long long unsigned match_limit, long long unsigned recmatch_limit, const struct cli_dconf *dconf);
+cl_error_t cli_pcre_build(struct cli_matcher *root, long long unsigned match_limit, long long unsigned recmatch_limit, int try_jit, const struct cli_dconf *dconf);
 cl_error_t cli_pcre_scanbuf(const unsigned char *buffer, uint32_t length, const char **virname, struct cli_ac_result **res, const struct cli_matcher *root, struct cli_ac_data *mdata, const struct cli_pcre_off *data, cli_ctx *ctx);
 cl_error_t cli_pcre_recaloff(struct cli_matcher *root, struct cli_pcre_off *data, struct cli_target_info *info, cli_ctx *ctx);
 void cli_pcre_freeoff(struct cli_pcre_off *data);