Cisco-Talos · val-ms · May 1, 2025 · May 2, 2025
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -138,6 +138,47 @@ if(MAINTAINER_MODE)
 endif()
 find_package(Rust REQUIRED)
 
+if(DEFINED CLANG_TIDY)
+    # Clang-tidy may be used to check for code style issues.
+    # It is not required to build ClamAV. See: https://clang.llvm.org/docs/ClangTidy.html
+
+    # To enable clang-tidy, set the CMake variable CLANG_TIDY to your clang-tidy executable.
+    # E.g. `-D CLANG_TIDY=clang-tidy-16`
+
+    # After a build, you may also wish to try to auto-fix some of the issues.
+    # To do this, run the following from the source directory:
+    # ```bash
+    # clang-apply-replacements --format --style-config=(pwd) ./build/
+    # ```
+
+    if(NOT DEFINED CLANG_TIDY_OPTIONS)
+        set(CLANG_TIDY_OPTIONS
+            "readability-braces-around-statements"
+            # "readability-else-after-return"
+            # "readability-function-size"
+            # "readability-magic-numbers"
+            # "readability-redundant-string-cstr"
+            # "readability-redundant-string-init"
+            # "modernize-*"
+            # "performance-*"
+            # "bugprone-*"
+        )
+    endif()
+
+    string(REPLACE ";" "," CLANG_TIDY_OPTIONS "${CLANG_TIDY_OPTIONS}")
+    set(CLANG_TIDY_PROPERTY "${CLANG_TIDY};-checks=${CLANG_TIDY_OPTIONS}")
+
+    set(CMAKE_C_CLANG_TIDY_EXPORT_FIXES_DIR "${CMAKE_BINARY_DIR}/clang-tidy-fixes")
+
+    # Example of how to set clang-tidy for a target:
+    #
+    # if(CLANG_TIDY)
+    #     set_target_properties( clamav PROPERTIES
+    #         C_CLANG_TIDY "${CLANG_TIDY_PROPERTY}"
+    #         C_CLANG_TIDY_EXPORT_FIXES_DIR "${CMAKE_BINARY_DIR}/clang-tidy-fixes" )
+    # endif()
+endif()
+
 if(ENABLE_FUZZ)
     # We'd like the fuzz targets to be statically linked
     set(ENABLE_STATIC_LIB       ON)
@@ -1133,6 +1174,11 @@ ${b}        Rust toolchain:     ${e}${cargo_EXECUTABLE} (${cargo_VERSION})
 ${b}        CFLAGS:             ${e}${CMAKE_C_FLAGS_${_build_type}} ${CMAKE_C_FLAGS}
 ${b}        CXXFLAGS:           ${e}${CMAKE_CXX_FLAGS_${_build_type}} ${CMAKE_CXX_FLAGS}
 ${b}        WARNCFLAGS:         ${e}${WARNCFLAGS}")
+if(DEFINED CLANG_TIDY)
+message("\
+${b}        clang-tidy:         ${e}${CLANG_TIDY}
+${b}        clang-tidy options: ${e}${CLANG_TIDY_OPTIONS}")
+endif()
 if(VCPKG_TOOLCHAIN)
 message("\
 ${c}    Using vcpkg:            ${e}

diff --git a/clam-format b/clam-format
@@ -76,6 +76,9 @@ git checkout libclamav/inflate64.h
 git checkout libclamav/inflate64.c
 git checkout libclamav/inflate64_priv.h
 git checkout libclamav/queue.h
+git checkout libclamav/nsis/bzlib.c
+git checkout libclamav/nsis/infblock.c
+git checkout libclamav/strlcat.c
 git checkout clamonacc/c-thread-pool/thpool.c
 git checkout clamonacc/c-thread-pool/thpool.h
 git checkout clamonacc/misc/fts.c

diff --git a/clamav-milter/CMakeLists.txt b/clamav-milter/CMakeLists.txt
@@ -18,6 +18,12 @@ target_include_directories( clamav-milter
 )
 set_target_properties( clamav-milter PROPERTIES COMPILE_FLAGS "${WARNCFLAGS}" )
 
+if(CLANG_TIDY)
+    set_target_properties( clamav-milter PROPERTIES
+        C_CLANG_TIDY "${CLANG_TIDY_PROPERTY}"
+        C_CLANG_TIDY_EXPORT_FIXES_DIR "${CMAKE_BINARY_DIR}/clang-tidy-fixes" )
+endif()
+
 if (APPLE AND CLAMAV_SIGN_FILE)
     set_target_properties( clamav-milter PROPERTIES
         XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY ${CODE_SIGN_IDENTITY}

diff --git a/clamav-milter/allow_list.c b/clamav-milter/allow_list.c
@@ -79,21 +79,27 @@ int allow_list_init(const char *fname)
         char *ptr            = buf;
         int len;
 
-        if (*buf == '#' || *buf == ':' || *buf == '!')
+        if (*buf == '#' || *buf == ':' || *buf == '!') {
             continue;
+        }
 
         if (!strncasecmp("From:", buf, 5)) {
             ptr += 5;
             addto = &wfrom;
-        } else if (!strncasecmp("To:", buf, 3))
+        } else if (!strncasecmp("To:", buf, 3)) {
             ptr += 3;
+        }
 
         len = strlen(ptr) - 1;
         for (; len >= 0; len--) {
-            if (ptr[len] != '\n' && ptr[len] != '\r') break;
+            if (ptr[len] != '\n' && ptr[len] != '\r') {
+                break;
+            }
             ptr[len] = '\0';
         }
-        if (!len) continue;
+        if (!len) {
+            continue;
+        }
         if (!(w = (struct WHLST *)malloc(sizeof(*w)))) {
             logg(LOGG_ERROR, "Out of memory loading allow list file\n");
             allow_list_free();
@@ -117,14 +123,16 @@ int allowed(const char *addr, int from)
 {
     struct WHLST *w;
 
-    if (from)
+    if (from) {
         w = wfrom;
-    else
+    } else {
         w = wto;
+    }
 
     while (w) {
-        if (!cli_regexec(&w->preg, addr, 0, NULL, 0))
+        if (!cli_regexec(&w->preg, addr, 0, NULL, 0)) {
             return 1;
+        }
         w = w->next;
     }
     return 0;
@@ -147,14 +155,19 @@ int smtpauth_init(const char *r)
             int len;
             char *ptr;
 
-            if (*buf == '#' || *buf == ':' || *buf == '!')
+            if (*buf == '#' || *buf == ':' || *buf == '!') {
                 continue;
+            }
             len = strlen(buf) - 1;
             for (; len >= 0; len--) {
-                if (buf[len] != '\n' && buf[len] != '\r') break;
+                if (buf[len] != '\n' && buf[len] != '\r') {
+                    break;
+                }
                 buf[len] = '\0';
             }
-            if (len <= 0) continue;
+            if (len <= 0) {
+                continue;
+            }
             if (len * 3 + 1 > rxavail) {
                 ptr        = regex;
                 char *temp = realloc(regex, rxsize + 2048);
@@ -206,18 +219,23 @@ int smtpauth_init(const char *r)
 
     if (cli_regcomp(&authreg, r, REG_ICASE | REG_NOSUB | REG_EXTENDED)) {
         logg(LOGG_ERROR, "Failed to compile regex '%s' for SkipAuthenticated\n", r);
-        if (regex) free(regex);
+        if (regex) {
+            free(regex);
+        }
         return 1;
     }
-    if (regex) free(regex);
+    if (regex) {
+        free(regex);
+    }
     skipauth = 1;
     return 0;
 }
 
 int smtpauthed(const char *login)
 {
-    if (skipauth && !cli_regexec(&authreg, login, 0, NULL, 0))
+    if (skipauth && !cli_regexec(&authreg, login, 0, NULL, 0)) {
         return 1;
+    }
     return 0;
 }
 

diff --git a/clamav-milter/clamav-milter.c b/clamav-milter/clamav-milter.c
@@ -66,10 +66,11 @@ static void milter_exit(int sig)
 
 #ifndef _WIN32
     if ((opt = optget(opts, "MilterSocket"))) {
-        if (unlink(opt->strarg) == -1)
+        if (unlink(opt->strarg) == -1) {
             logg(LOGG_ERROR, "Can't unlink the socket file %s\n", opt->strarg);
-        else
+        } else {
             logg(LOGG_INFO, "Socket file removed.\n");
+        }
     }
 #endif
 
@@ -137,8 +138,9 @@ int main(int argc, char **argv)
 
     if (opts->filename) {
         int x;
-        for (x = 0; opts->filename[x]; x++)
+        for (x = 0; opts->filename[x]; x++) {
             mprintf(LOGG_WARNING, "Ignoring option %s\n", opts->filename[x]);
+        }
     }
 
     if (optget(opts, "version")->enabled) {
@@ -233,12 +235,15 @@ int main(int argc, char **argv)
         /* set group ownership and perms on the local socket */
         char *sock_name = my_socket;
         mode_t sock_mode;
-        if (!strncmp(my_socket, "unix:", 5))
+        if (!strncmp(my_socket, "unix:", 5)) {
             sock_name += 5;
-        if (!strncmp(my_socket, "local:", 6))
+        }
+        if (!strncmp(my_socket, "local:", 6)) {
             sock_name += 6;
-        if (*my_socket == ':')
+        }
+        if (*my_socket == ':') {
             sock_name++;
+        }
 
         if (optget(opts, "MilterSocketGroup")->enabled) {
             char *gname    = optget(opts, "MilterSocketGroup")->strarg, *end;
@@ -288,8 +293,9 @@ int main(int argc, char **argv)
                 optfree(opts);
                 return 1;
             }
-        } else
+        } else {
             sock_mode = 0777 & ~umsk;
+        }
 
         if (chmod(sock_name, sock_mode & 0666)) {
             logg(LOGG_ERROR, "Cannot set milter socket permission to %s\n", optget(opts, "MilterSocketMode")->strarg);
@@ -303,8 +309,9 @@ int main(int argc, char **argv)
     logg_time    = optget(opts, "LogTime")->enabled;
     logg_size    = optget(opts, "LogFileMaxSize")->numarg;
     logg_verbose = mprintf_verbose = optget(opts, "LogVerbose")->enabled;
-    if (logg_size)
+    if (logg_size) {
         logg_rotate = optget(opts, "LogRotate")->enabled;
+    }
 
     if ((opt = optget(opts, "LogFile"))->enabled) {
         logg_file = opt->strarg;
@@ -314,8 +321,9 @@ int main(int argc, char **argv)
             optfree(opts);
             return 1;
         }
-    } else
+    } else {
         logg_file = NULL;
+    }
 
 #if defined(USE_SYSLOG) && !defined(C_AIX)
     if (optget(opts, "LogSyslog")->enabled) {
@@ -341,8 +349,9 @@ int main(int argc, char **argv)
         optfree(opts);
         return 1;
     }
-    if ((opt = optget(opts, "TemporaryDirectory"))->enabled)
+    if ((opt = optget(opts, "TemporaryDirectory"))->enabled) {
         tempdir = opt->strarg;
+    }
 
     if (localnets_init(opts) || init_actions(opts)) {
         logg_close();