Bug 1295115 - follow up to clang-format for CI, r= kaie

49 files changed, 253 insertions, 301 deletions

diff --git a/cmd/bltest/blapitest.c b/cmd/bltest/blapitest.c
index b92ec616d..b231b0f3f 100644
--- a/cmd/bltest/blapitest.c
+++ b/cmd/bltest/blapitest.c
@@ -1236,8 +1236,7 @@ rsa_PublicKeyOp(void *cx, SECItem *output, const SECItem *input)
     RSAPublicKey *pubKey = (RSAPublicKey *)params->pubKey;
     SECStatus rv = RSA_PublicKeyOp(pubKey, output->data, input->data);
     if (rv == SECSuccess) {
-        output->len = pubKey->modulus.data[0] ? pubKey->modulus.len :
-                                              pubKey->modulus.len - 1;
+        output->len = pubKey->modulus.data[0] ? pubKey->modulus.len : pubKey->modulus.len - 1;
     }
     return rv;
 }
@@ -1249,8 +1248,7 @@ rsa_PrivateKeyOp(void *cx, SECItem *output, const SECItem *input)
     RSAPrivateKey *privKey = (RSAPrivateKey *)params->privKey;
     SECStatus rv = RSA_PrivateKeyOp(privKey, output->data, input->data);
     if (rv == SECSuccess) {
-        output->len = privKey->modulus.data[0] ? privKey->modulus.len :
-                                               privKey->modulus.len - 1;
+        output->len = privKey->modulus.data[0] ? privKey->modulus.len : privKey->modulus.len - 1;
     }
     return rv;
 }
@@ -2849,8 +2847,7 @@ print_td:
                 ECPrivateKey *key = (ECPrivateKey *)info->params.asymk.privKey;
                 ECCurveName curveName = key->ecParams.name;
                 fprintf(stdout, "%12s",
-                        ecCurve_map[curveName] ? ecCurve_map[curveName]->text :
-                                               "Unsupported curve");
+                        ecCurve_map[curveName] ? ecCurve_map[curveName]->text : "Unsupported curve");
             }
             break;
 #endif
@@ -3161,7 +3158,7 @@ verify_self_test(bltestIO *result, bltestIO *cmp, bltestCipherMode mode,
 static SECStatus
 ReadFileToItem(PLArenaPool *arena, SECItem *dst, const char *filename)
 {
-    SECItem tmp = {siBuffer, NULL, 0};
+    SECItem tmp = { siBuffer, NULL, 0 };
     PRFileDesc *file;
     SECStatus rv;
 
diff --git a/cmd/certcgi/certcgi.c b/cmd/certcgi/certcgi.c
index 7f4436b08..35409e250 100644
--- a/cmd/certcgi/certcgi.c
+++ b/cmd/certcgi/certcgi.c
@@ -883,8 +883,7 @@ AddAuthKeyID(void *extHandle,
             error_out("ERROR: Unable to copy Directory Name");
         }
         authKeyID->authCertIssuer = genNames;
-        if (authKeyID->authCertIssuer == NULL && SECFailure ==
-                                                     PORT_GetError()) {
+        if (authKeyID->authCertIssuer == NULL && SECFailure == PORT_GetError()) {
             error_out("ERROR: Unable to get Issuer General Name for Authority Key ID Extension");
         }
         authKeyID->authCertSerialNumber = issuerCert->serialNumber;
@@ -2035,16 +2034,16 @@ main(int argc, char **argv)
     char *pos;
 #ifdef OFFLINE
     char *form_output = "key=MIIBPTCBpzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA7"
-        "SLqjWBL9Wl11Vlg%0AaMqZCvcQOL%2FnvSqYPPRP0XZy9SoAeyWzQnBOiCm2t8H5mK7r2"
-        "jnKdAQOmfhjaJil%0A3hNVu3SekHOXF6Ze7bkWa6%2FSGVcY%2FojkydxFSgY43nd1iyd"
-        "zPQDp8WWLL%2BpVpt%2B%2B%0ATRhFtVXbF0fQI03j9h3BoTgP2lkCAwEAARYDZm9vMA0"
-        "GCSqGSIb3DQEBBAUAA4GB%0AAJ8UfRKJ0GtG%2B%2BufCC6tAfTzKrq3CTBHnom55EyXc"
-        "sAsv6WbDqI%2F0rLAPkn2Xo1r%0AnNhtMxIuj441blMt%2Fa3AGLOy5zmC7Qawt8IytvQ"
-        "ikQ1XTpTBCXevytrmLjCmlURr%0ANJryTM48WaMQHiMiJpbXCqVJC1d%2FpEWBtqvALzZ"
-        "aOOIy&subject=CN%3D%22test%22%26serial-auto%3Dtrue%26serial_value%3D%"
-        "26ver-1%3Dtrue%26ver-3%3Dfalse%26caChoiceradio-SignWithDefaultkey%3Dt"
-        "rue%26caChoiceradio-SignWithRandomChain%3Dfalse%26autoCAs%3D%26caChoi"
-        "ceradio-SignWithSpecifiedChain%3Dfalse%26manCAs%3D%26%24";
+                        "SLqjWBL9Wl11Vlg%0AaMqZCvcQOL%2FnvSqYPPRP0XZy9SoAeyWzQnBOiCm2t8H5mK7r2"
+                        "jnKdAQOmfhjaJil%0A3hNVu3SekHOXF6Ze7bkWa6%2FSGVcY%2FojkydxFSgY43nd1iyd"
+                        "zPQDp8WWLL%2BpVpt%2B%2B%0ATRhFtVXbF0fQI03j9h3BoTgP2lkCAwEAARYDZm9vMA0"
+                        "GCSqGSIb3DQEBBAUAA4GB%0AAJ8UfRKJ0GtG%2B%2BufCC6tAfTzKrq3CTBHnom55EyXc"
+                        "sAsv6WbDqI%2F0rLAPkn2Xo1r%0AnNhtMxIuj441blMt%2Fa3AGLOy5zmC7Qawt8IytvQ"
+                        "ikQ1XTpTBCXevytrmLjCmlURr%0ANJryTM48WaMQHiMiJpbXCqVJC1d%2FpEWBtqvALzZ"
+                        "aOOIy&subject=CN%3D%22test%22%26serial-auto%3Dtrue%26serial_value%3D%"
+                        "26ver-1%3Dtrue%26ver-3%3Dfalse%26caChoiceradio-SignWithDefaultkey%3Dt"
+                        "rue%26caChoiceradio-SignWithRandomChain%3Dfalse%26autoCAs%3D%26caChoi"
+                        "ceradio-SignWithSpecifiedChain%3Dfalse%26manCAs%3D%26%24";
 #else
     char *form_output;
 #endif
diff --git a/cmd/certutil/certutil.c b/cmd/certutil/certutil.c
index f4d480985..22e15acc7 100644
--- a/cmd/certutil/certutil.c
+++ b/cmd/certutil/certutil.c
@@ -3435,8 +3435,7 @@ certutil_main(int argc, char **argv, PRBool initialize)
                      certutil.options[opt_ExtendedEmailAddrs].arg,
                      certutil.options[opt_ExtendedDNSNames].arg,
                      certutil_extns,
-                     (certutil.options[opt_GenericExtensions].activated ?
-                                                                        certutil.options[opt_GenericExtensions].arg
+                     (certutil.options[opt_GenericExtensions].activated ? certutil.options[opt_GenericExtensions].arg
                                                                         : NULL),
                      certutil.options[opt_Pss].activated,
                      &certReqDER);
@@ -3461,8 +3460,7 @@ certutil_main(int argc, char **argv, PRBool initialize)
                      NULL,
                      NULL,
                      nullextnlist,
-                     (certutil.options[opt_GenericExtensions].activated ?
-                                                                        certutil.options[opt_GenericExtensions].arg
+                     (certutil.options[opt_GenericExtensions].activated ? certutil.options[opt_GenericExtensions].arg
                                                                         : NULL),
                      certutil.options[opt_Pss].activated,
                      &certReqDER);
@@ -3484,8 +3482,7 @@ certutil_main(int argc, char **argv, PRBool initialize)
                             certutil.commands[cmd_CreateNewCert].activated,
                         certutil.options[opt_SelfSign].activated,
                         certutil_extns,
-                        (certutil.options[opt_GenericExtensions].activated ?
-                                                                           certutil.options[opt_GenericExtensions].arg
+                        (certutil.options[opt_GenericExtensions].activated ? certutil.options[opt_GenericExtensions].arg
                                                                            : NULL),
                         certVersion,
                         &certDER);
diff --git a/cmd/ecperf/ecperf.c b/cmd/ecperf/ecperf.c
index da606f848..5adfe99e8 100644
--- a/cmd/ecperf/ecperf.c
+++ b/cmd/ecperf/ecperf.c
@@ -86,7 +86,7 @@ static SECOidTag ecCurve_oid_map[] = {
     SEC_OID_UNKNOWN, /* ECCurve_WTLS_1 */
     SEC_OID_UNKNOWN, /* ECCurve_WTLS_8 */
     SEC_OID_UNKNOWN, /* ECCurve_WTLS_9 */
-    SEC_OID_UNKNOWN /* ECCurve_pastLastCurve */
+    SEC_OID_UNKNOWN  /* ECCurve_pastLastCurve */
 };
 
 typedef SECStatus (*op_func)(void *, void *, void *);
diff --git a/cmd/httpserv/httpserv.c b/cmd/httpserv/httpserv.c
index b7bde7189..7cf28c65a 100644
--- a/cmd/httpserv/httpserv.c
+++ b/cmd/httpserv/httpserv.c
@@ -745,10 +745,8 @@ handle_connection(
                             /* else good status response */
                             if (!isPost && ocspMethodsAllowed == ocspGetUnknown) {
                                 unknown = PR_TRUE;
-                                nextUpdate = PR_Now() + (PRTime)60 * 60 *
-                                                            24 * PR_USEC_PER_SEC; /*tomorrow*/
-                                revoDate = PR_Now() - (PRTime)60 * 60 *
-                                                          24 * PR_USEC_PER_SEC; /*yesterday*/
+                                nextUpdate = PR_Now() + (PRTime)60 * 60 * 24 * PR_USEC_PER_SEC; /*tomorrow*/
+                                revoDate = PR_Now() - (PRTime)60 * 60 * 24 * PR_USEC_PER_SEC;   /*yesterday*/
                             }
                         }
                     }
diff --git a/cmd/lib/basicutil.c b/cmd/lib/basicutil.c
index c9afbd0a5..cacf5be69 100644
--- a/cmd/lib/basicutil.c
+++ b/cmd/lib/basicutil.c
@@ -687,13 +687,12 @@ static unsigned char
 nibble(char c)
 {
     c = PORT_Tolower(c);
-    return (c >= '0' && c <= '9') ? c - '0' :
-                                  (c >=
-                                       'a' &&
-                                   c <=
-                                       'f')
-                                      ? c - 'a' + 10
-                                      : -1;
+    return (c >= '0' && c <= '9') ? c - '0' : (c >=
+                                                   'a' &&
+                                               c <=
+                                                   'f')
+                                                  ? c - 'a' + 10
+                                                  : -1;
 }
 
 SECStatus
diff --git a/cmd/libpkix/testutil/testutil.h b/cmd/libpkix/testutil/testutil.h
index 2cfe5b8a8..9c594fa03 100644
--- a/cmd/libpkix/testutil/testutil.h
+++ b/cmd/libpkix/testutil/testutil.h
@@ -229,9 +229,8 @@ extern "C" {
         }                            \
     } while (0)
 
-#define PKIX_TEST_ARENAS_ARG(arena)                                           \
-    (arena ? (PORT_Strcmp(arena, "arenas") ? PKIX_FALSE : (j++, PKIX_TRUE)) : \
-           PKIX_FALSE)
+#define PKIX_TEST_ARENAS_ARG(arena) \
+    (arena ? (PORT_Strcmp(arena, "arenas") ? PKIX_FALSE : (j++, PKIX_TRUE)) : PKIX_FALSE)
 
 #define PKIX_TEST_ERROR_RECEIVED (pkixTestErrorMsg || pkixTestErrorResult)
 
diff --git a/cmd/modutil/install.c b/cmd/modutil/install.c
index ce1b11814..99657de6d 100644
--- a/cmd/modutil/install.c
+++ b/cmd/modutil/install.c
@@ -406,10 +406,8 @@ Pk11Install_DoInstall(char *jarFile, const char *installDir,
      * Show the user security information, allow them to abort or continue
      */
     if (Pk11Install_UserVerifyJar(jar, PR_STDOUT,
-                                  force ?
-                                        PR_FALSE
-                                        :
-                                        PR_TRUE) &&
+                                  force ? PR_FALSE
+                                        : PR_TRUE) &&
         !force) {
         if (feedback) {
             PR_fprintf(feedback, msgStrings[USER_ABORT]);
diff --git a/cmd/modutil/installparse.c b/cmd/modutil/installparse.c
index 3598972c6..d35d048dd 100644
--- a/cmd/modutil/installparse.c
+++ b/cmd/modutil/installparse.c
@@ -46,85 +46,94 @@ char *Pk11Install_yyerrstr = NULL;
 #define STRING 259
 #define YYERRCODE 256
 /* clang-format on */
-short yylhs[] = {                                        -1,
-    0,    1,    1,    2,    2,    3,    4,
+short yylhs[] = {
+    -1,
+    0, 1, 1, 2, 2, 3, 4,
 };
-short yylen[] = {                                         2,
-    1,    2,    0,    1,    1,    4,    1,
+short yylen[] = {
+    2,
+    1, 2, 0, 1, 1, 4, 1,
 };
-short yydefred[] = {                                      0,
-    0,    0,    1,    0,    4,    0,    2,    0,    0,    6,
+short yydefred[] = {
+    0,
+    0, 0, 1, 0, 4, 0, 2, 0, 0, 6,
 };
-short yydgoto[] = {                                       2,
-    3,    4,    5,    6,
+short yydgoto[] = {
+    2,
+    3, 4, 5, 6,
 };
-short yysindex[] = {                                   -257,
-    0,    0,    0, -257,    0, -252,    0, -257, -251,    0,
+short yysindex[] = {
+    -257,
+    0, 0, 0, -257, 0, -252, 0, -257, -251, 0,
 };
-short yyrindex[] = {                                      6,
-    1,    0,    0,    3,    0,    0,    0, -250,    0,    0,
+short yyrindex[] = {
+    6,
+    1, 0, 0, 3, 0, 0, 0, -250, 0, 0,
 };
-short yygindex[] = {                                      0,
-   -4,    0,    0,    0,
+short yygindex[] = {
+    0,
+    -4, 0, 0, 0,
 };
 #define YYTABLESIZE 261
-short yytable[] = {                                       7,
-    5,    1,    3,    9,    8,    3,   10,    3,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
-    0,    0,    0,    0,    0,    0,    0,    7,    5,    5,
+short yytable[] = {
+    7,
+    5, 1, 3, 9, 8, 3, 10, 3, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 0, 0, 0, 0, 7, 5, 5,
     3,
 };
-short yycheck[] = {                                       4,
-    0,  259,    0,    8,  257,    0,  258,  258,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
-   -1,   -1,   -1,   -1,   -1,   -1,   -1,  257,  258,  259,
-  258,
+short yycheck[] = {
+    4,
+    0, 259, 0, 8, 257, 0, 258, 258, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
+    -1, -1, -1, -1, -1, -1, -1, 257, 258, 259,
+    258,
 };
 /* clang-format on */
 #define YYFINAL 2
diff --git a/cmd/multinit/multinit.c b/cmd/multinit/multinit.c
index 676c7d87e..a57c4819f 100644
--- a/cmd/multinit/multinit.c
+++ b/cmd/multinit/multinit.c
@@ -502,8 +502,7 @@ do_list_certs(const char *progName, int log)
 
         SECU_PrintCertNickname(node, stderr);
         if (log) {
-            fprintf(stderr, "*	Slot=%s*\n", cert->slot ?
-                                                        PK11_GetTokenName(cert->slot)
+            fprintf(stderr, "*	Slot=%s*\n", cert->slot ? PK11_GetTokenName(cert->slot)
                                                         : "none");
             fprintf(stderr, "*	Nickname=%s*\n", cert->nickname);
             fprintf(stderr, "*	Subject=<%s>*\n", cert->subjectName);
diff --git a/cmd/p7env/p7env.c b/cmd/p7env/p7env.c
index 1cf17540b..b35bf9a98 100644
--- a/cmd/p7env/p7env.c
+++ b/cmd/p7env/p7env.c
@@ -237,7 +237,7 @@ main(int argc, char **argv)
     }
 
     /* free certs */
-    for (rcpt = recipients; rcpt != NULL; ) {
+    for (rcpt = recipients; rcpt != NULL;) {
         struct recipient *next = rcpt->next;
         CERT_DestroyCertificate(rcpt->cert);
         PORT_Free(rcpt->nickname);
diff --git a/cmd/pk11util/pk11util.c b/cmd/pk11util/pk11util.c
index 78278d317..bd1ea2bcd 100644
--- a/cmd/pk11util/pk11util.c
+++ b/cmd/pk11util/pk11util.c
@@ -1097,10 +1097,8 @@ printArg(Value *ptr, int arg_number)
             } else {
                 constType = getConstFromAttribute(attribute->type);
                 if (constType != ConstNone) {
-                    CK_ULONG value = (constType == ConstBool) ?
-                                                              *(CK_BBOOL *)attribute->pValue
-                                                              :
-                                                              *(CK_ULONG *)attribute->pValue;
+                    CK_ULONG value = (constType == ConstBool) ? *(CK_BBOOL *)attribute->pValue
+                                                              : *(CK_ULONG *)attribute->pValue;
                     printConst(value, constType, 1);
                 } else {
                     printf("\n");
diff --git a/cmd/pk12util/pk12util.c b/cmd/pk12util/pk12util.c
index f8f8370f3..cca27cbf6 100644
--- a/cmd/pk12util/pk12util.c
+++ b/cmd/pk12util/pk12util.c
@@ -752,8 +752,7 @@ P12U_ListPKCS12File(char *in_file, PK11SlotInfo *slot,
                             PR_Close(fd);
                         }
                     } else if (SECU_PrintSignedData(stdout, dip->der,
-                                                    (dip->hasKey) ?
-                                                                  "(has private key)"
+                                                    (dip->hasKey) ? "(has private key)"
                                                                   : "",
                                                     0, (SECU_PPFunc)SECU_PrintCertificate) !=
                                0) {
@@ -982,10 +981,8 @@ main(int argc, char **argv)
 
     slotname = SECU_GetOptionArg(&pk12util, opt_TokenName);
 
-    import_file = (pk12util.options[opt_List].activated) ?
-                                                         SECU_GetOptionArg(&pk12util, opt_List)
-                                                         :
-                                                         SECU_GetOptionArg(&pk12util, opt_Import);
+    import_file = (pk12util.options[opt_List].activated) ? SECU_GetOptionArg(&pk12util, opt_List)
+                                                         : SECU_GetOptionArg(&pk12util, opt_Import);
     export_file = SECU_GetOptionArg(&pk12util, opt_Export);
 
     if (pk12util.options[opt_P12FilePWFile].activated) {
@@ -1052,8 +1049,7 @@ main(int argc, char **argv)
         }
     }
 
-    certCipher = PK11_IsFIPS() ? SEC_OID_UNKNOWN :
-                               SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC;
+    certCipher = PK11_IsFIPS() ? SEC_OID_UNKNOWN : SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC;
     if (pk12util.options[opt_CertCipher].activated) {
         char *cipherString = pk12util.options[opt_CertCipher].arg;
 
diff --git a/cmd/selfserv/selfserv.c b/cmd/selfserv/selfserv.c
index 746f70389..16abf3a20 100644
--- a/cmd/selfserv/selfserv.c
+++ b/cmd/selfserv/selfserv.c
@@ -220,7 +220,7 @@ PrintParameterUsage()
         "-A <ca> Nickname of a CA used to sign a stapled cert status\n"
         "-U override default ECDHE ephemeral key reuse, 0: refresh, 1: reuse\n"
         "-H override default DHE server support, 0: disable, 1: enable, "
-            " 2: require DH named groups\n"
+        " 2: require DH named groups\n"
         "-W override default DHE server weak parameters support, 0: disable, 1: enable\n"
         "-c Restrict ciphers\n"
         "-Y prints cipher values allowed for parameter -c and exits\n"
@@ -518,8 +518,7 @@ mySSLSNISocketConfig(PRFileDesc *fd, const SECItem *sniNameArr,
                 if (privKey == NULL) {
                     goto loser; /* Send alert */
                 }
-                if (SSL_ConfigServerCert(fd, cert, privKey, NULL, 0)
-                    != SECSuccess) {
+                if (SSL_ConfigServerCert(fd, cert, privKey, NULL, 0) != SECSuccess) {
                     goto loser; /* Send alert */
                 }
                 SECKEY_DestroyPrivateKey(privKey);
@@ -2015,8 +2014,8 @@ server_main(
     }
 
     if (enableALPN) {
-        PRUint8 alpnVal[] = {0x08,
-                             0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31};
+        PRUint8 alpnVal[] = { 0x08,
+                              0x68, 0x74, 0x74, 0x70, 0x2f, 0x31, 0x2e, 0x31 };
         rv = SSL_OptionSet(model_sock, SSL_ENABLE_ALPN, PR_TRUE);
         if (rv != SECSuccess) {
             errExit("error enabling ALPN");
@@ -2861,8 +2860,7 @@ main(int argc, char **argv)
     if (rv == SECSuccess && logStats) {
         loggerThread = PR_CreateThread(PR_SYSTEM_THREAD,
                                        logger, NULL, PR_PRIORITY_NORMAL,
-                                       useLocalThreads ?
-                                                       PR_LOCAL_THREAD
+                                       useLocalThreads ? PR_LOCAL_THREAD
                                                        : PR_GLOBAL_THREAD,
                                        PR_JOINABLE_THREAD, 0);
         if (loggerThread == NULL) {
diff --git a/cmd/signtool/javascript.c b/cmd/signtool/javascript.c
index f0d539628..175b877da 100644
--- a/cmd/signtool/javascript.c
+++ b/cmd/signtool/javascript.c
@@ -82,12 +82,9 @@ javascript_fn(char *relpath, char *basedir, char *reldir, char *filename, void *
 
     /* only process inline scripts from .htm, .html, and .shtml*/
 
-    if (!(PL_strcaserstr(filename, ".htm") == filename + strlen(filename) -
-                                                  4) &&
-        !(PL_strcaserstr(filename, ".html") == filename + strlen(filename) -
-                                                   5) &&
-        !(PL_strcaserstr(filename, ".shtml") == filename + strlen(filename) -
-                                                    6)) {
+    if (!(PL_strcaserstr(filename, ".htm") == filename + strlen(filename) - 4) &&
+        !(PL_strcaserstr(filename, ".html") == filename + strlen(filename) - 5) &&
+        !(PL_strcaserstr(filename, ".shtml") == filename + strlen(filename) - 6)) {
         return 0;
     }
 
@@ -382,8 +379,7 @@ ProcessTag(FileBuffer *fb, char **errStr)
                 }
             /* fall through */
             case GET_ATT_STATE:
-                if (isspace(curchar) || curchar == '=' || curchar ==
-                                                              '>') {
+                if (isspace(curchar) || curchar == '=' || curchar == '>') {
                     /* end of the current attribute */
                     curPos = FB_GetPointer(fb) - 2;
                     if (curPos >= startID) {
diff --git a/cmd/signtool/sign.c b/cmd/signtool/sign.c
index ca467ec5c..6e776069a 100644
--- a/cmd/signtool/sign.c
+++ b/cmd/signtool/sign.c
@@ -81,10 +81,8 @@ SignArchive(char *tree, char *keyName, char *zip_file, int javascript,
         }
 
         /* rsa/dsa to zip */
-        sprintf(tempfn, "META-INF/%s.%s", base, (keyType == dsaKey ?
-                                                                   "dsa"
-                                                                   :
-                                                                   "rsa"));
+        sprintf(tempfn, "META-INF/%s.%s", base, (keyType == dsaKey ? "dsa"
+                                                                   : "rsa"));
         sprintf(fullfn, "%s/%s", tree, tempfn);
         JzipAdd(fullfn, tempfn, zipfile, compression_level);
 
@@ -106,10 +104,8 @@ SignArchive(char *tree, char *keyName, char *zip_file, int javascript,
     /* Add the rsa/dsa file to the zip archive normally */
     if (!xpi_arc) {
         /* rsa/dsa to zip */
-        sprintf(tempfn, "META-INF/%s.%s", base, (keyType == dsaKey ?
-                                                                   "dsa"
-                                                                   :
-                                                                   "rsa"));
+        sprintf(tempfn, "META-INF/%s.%s", base, (keyType == dsaKey ? "dsa"
+                                                                   : "rsa"));
         sprintf(fullfn, "%s/%s", tree, tempfn);
         JzipAdd(fullfn, tempfn, zipfile, compression_level);
     }
@@ -171,8 +167,7 @@ sign_all_arc_fn(char *relpath, char *basedir, char *reldir, char *filename,
 
     /* Make sure there is one and only one ".arc" in the relative path,
      * and that it is at the end of the path (don't sign .arcs within .arcs) */
-    if ((PL_strcaserstr(relpath, ".arc") == relpath + strlen(relpath) -
-                                                4) &&
+    if ((PL_strcaserstr(relpath, ".arc") == relpath + strlen(relpath) - 4) &&
         (PL_strcasestr(relpath, ".arc") == relpath + strlen(relpath) - 4)) {
 
         if (!infop) {
diff --git a/cmd/signtool/verify.c b/cmd/signtool/verify.c
index cfb2d0bd8..41656a10f 100644
--- a/cmd/signtool/verify.c
+++ b/cmd/signtool/verify.c
@@ -212,8 +212,7 @@ verify_global(JAR *jar)
                         PR_fprintf(outputFD,
                                    "  md5 digest on global metainfo: %s\n",
                                    PORT_Memcmp(md5_digest, globaldig->md5, MD5_LENGTH)
-                                       ?
-                                       "no match"
+                                       ? "no match"
                                        : "match");
                     }
 
@@ -221,8 +220,7 @@ verify_global(JAR *jar)
                         PR_fprintf(outputFD,
                                    "  sha digest on global metainfo: %s\n",
                                    PORT_Memcmp(sha1_digest, globaldig->sha1, SHA1_LENGTH)
-                                       ?
-                                       "no match"
+                                       ? "no match"
                                        : "match");
                     }
 
diff --git a/cmd/signtool/zip.c b/cmd/signtool/zip.c
index 3ec5b092b..35d5f5733 100644
--- a/cmd/signtool/zip.c
+++ b/cmd/signtool/zip.c
@@ -159,8 +159,7 @@ JzipAdd(char *fullname, char *filename, ZIPfile *zipfile, int compression_level)
         } else {
             nsprErr = NULL;
         }
-        PR_fprintf(errorFD, "%s: %s\n", fullname, nsprErr ? nsprErr :
-                                                          "");
+        PR_fprintf(errorFD, "%s: %s\n", fullname, nsprErr ? nsprErr : "");
         errorCount++;
         if (nsprErr)
             PR_Free(nsprErr);
@@ -280,8 +279,7 @@ JzipAdd(char *fullname, char *filename, ZIPfile *zipfile, int compression_level)
         } else {
             nsprErr = NULL;
         }
-        PR_fprintf(errorFD, "Writing zip data: %s\n", nsprErr ? nsprErr :
-                                                              "");
+        PR_fprintf(errorFD, "Writing zip data: %s\n", nsprErr ? nsprErr : "");
         if (nsprErr)
             PR_Free(nsprErr);
         errorCount++;
@@ -297,8 +295,7 @@ JzipAdd(char *fullname, char *filename, ZIPfile *zipfile, int compression_level)
         } else {
             nsprErr = NULL;
         }
-        PR_fprintf(errorFD, "Writing zip data: %s\n", nsprErr ? nsprErr :
-                                                              "");
+        PR_fprintf(errorFD, "Writing zip data: %s\n", nsprErr ? nsprErr : "");
         if (nsprErr)
             PR_Free(nsprErr);
         errorCount++;
diff --git a/cmd/tstclnt/tstclnt.c b/cmd/tstclnt/tstclnt.c
index 9d644b70b..19cefe3a4 100644
--- a/cmd/tstclnt/tstclnt.c
+++ b/cmd/tstclnt/tstclnt.c
@@ -256,7 +256,8 @@ PrintParameterUsage(void)
     fprintf(stderr, "%-20s (Options -4 and -6 cannot be combined.)\n", "");
     fprintf(stderr, "%-20s Enable the extended master secret extension [RFC7627]\n", "-G");
     fprintf(stderr, "%-20s Require the use of FFDHE supported groups "
-                    "[I-D.ietf-tls-negotiated-ff-dhe]\n", "-H");
+                    "[I-D.ietf-tls-negotiated-ff-dhe]\n",
+            "-H");
 }
 
 static void
diff --git a/lib/base/base.h b/lib/base/base.h
index 6d8a1ba6c..2033c4455 100644
--- a/lib/base/base.h
+++ b/lib/base/base.h
@@ -367,7 +367,7 @@ extern const NSSError NSS_ERROR_ARENA_MARKED_BY_ANOTHER_THREAD;
  *  A pointer to the new segment of zeroed memory
  */
 
-#define nss_ZNEWARRAY(arenaOpt, type, quantity)                                \
+#define nss_ZNEWARRAY(arenaOpt, type, quantity) \
     ((type *)nss_ZAlloc((arenaOpt), sizeof(type) * (quantity)))
 
 /*
@@ -387,7 +387,7 @@ extern const NSSError NSS_ERROR_ARENA_MARKED_BY_ANOTHER_THREAD;
  *  NULL upon error
  *  A pointer to the replacement segment of memory
  */
-#define nss_ZREALLOCARRAY(p, type, quantity)                                   \
+#define nss_ZREALLOCARRAY(p, type, quantity) \
     ((type *)nss_ZRealloc((p), sizeof(type) * (quantity)))
 
 /*
@@ -430,7 +430,7 @@ extern const NSSError NSS_ERROR_INVALID_ARENA;
 #define nssArena_VERIFYPOINTER(p) nssArena_verifyPointer(p)
 #else /* DEBUG */
 
-#define nssArena_VERIFYPOINTER(p)                                              \
+#define nssArena_VERIFYPOINTER(p) \
     (((NSSArena *)NULL == (p)) ? PR_FAILURE : PR_SUCCESS)
 #endif /* DEBUG */
 
diff --git a/lib/base/list.c b/lib/base/list.c
index d992e9bda..a36cdb1b3 100644
--- a/lib/base/list.c
+++ b/lib/base/list.c
@@ -35,12 +35,12 @@ struct nssListIteratorStr {
     nssListElement *current;
 };
 
-#define NSSLIST_LOCK_IF(list)                                                  \
-    if ((list)->lock)                                                          \
+#define NSSLIST_LOCK_IF(list) \
+    if ((list)->lock)         \
     PZ_Lock((list)->lock)
 
-#define NSSLIST_UNLOCK_IF(list)                                                \
-    if ((list)->lock)                                                          \
+#define NSSLIST_UNLOCK_IF(list) \
+    if ((list)->lock)           \
     PZ_Unlock((list)->lock)
 
 static PRBool
diff --git a/lib/base/nssbase.h b/lib/base/nssbase.h
index 09c73acf9..02e285fba 100644
--- a/lib/base/nssbase.h
+++ b/lib/base/nssbase.h
@@ -158,7 +158,7 @@ NSS_EXTERN NSSError *NSS_GetErrorStack(void);
  *  A pointer to the new segment of zeroed memory
  */
 
-#define NSS_ZNEWARRAY(arenaOpt, type, quantity)                                \
+#define NSS_ZNEWARRAY(arenaOpt, type, quantity) \
     ((type *)NSS_ZAlloc((arenaOpt), sizeof(type) * (quantity)))
 
 /*
diff --git a/lib/base/utf8.c b/lib/base/utf8.c
index 9ef197c89..6d7b6a015 100644
--- a/lib/base/utf8.c
+++ b/lib/base/utf8.c
@@ -614,7 +614,7 @@ nssUTF8_CopyIntoFixedBuffer(NSSUTF8 *string, char *buffer, PRUint32 bufferSize,
         PRUint32 bs = bufferSize;
         (void)nsslibc_memcpy(buffer, string, bufferSize);
 
-        if ((            ((buffer[bs - 1] & 0x80) == 0x00)) ||
+        if ((((buffer[bs - 1] & 0x80) == 0x00)) ||
             ((bs > 1) && ((buffer[bs - 2] & 0xE0) == 0xC0)) ||
             ((bs > 2) && ((buffer[bs - 3] & 0xF0) == 0xE0)) ||
             ((bs > 3) && ((buffer[bs - 4] & 0xF8) == 0xF0)) ||
diff --git a/lib/certdb/certdb.c b/lib/certdb/certdb.c
index 493bcfec8..ea66418fc 100644
--- a/lib/certdb/certdb.c
+++ b/lib/certdb/certdb.c
@@ -2068,7 +2068,7 @@ CERT_IsCACert(CERTCertificate *cert, unsigned int *rettype)
      */
     CERTBasicConstraints constraints;
     if ((CERT_FindBasicConstraintExten(cert, &constraints) == SECSuccess &&
-        constraints.isCA) ||
+         constraints.isCA) ||
         (cert->isRoot && cert_Version(cert) < SEC_CERTIFICATE_VERSION_3))
         cType |= (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA);
 
@@ -2077,7 +2077,9 @@ CERT_IsCACert(CERTCertificate *cert, unsigned int *rettype)
      */
     cType = cert_ComputeTrustOverrides(cert, cType);
     ret = (cType & (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA |
-                    NS_CERT_TYPE_OBJECT_SIGNING_CA)) ? PR_TRUE : PR_FALSE;
+                    NS_CERT_TYPE_OBJECT_SIGNING_CA))
+              ? PR_TRUE
+              : PR_FALSE;
 
     if (rettype) {
         *rettype = cType;
diff --git a/lib/certdb/certdb.h b/lib/certdb/certdb.h
index cb39b9800..53d8a3919 100644
--- a/lib/certdb/certdb.h
+++ b/lib/certdb/certdb.h
@@ -14,8 +14,8 @@
 #define CERTDB_NS_TRUSTED_CA (1u << 5)
 #define CERTDB_USER (1u << 6)
 #define CERTDB_TRUSTED_CLIENT_CA (1u << 7) /* trusted for issuing client certs */
-#define CERTDB_INVISIBLE_CA (1u << 8) /* don't show in UI */
-#define CERTDB_GOVT_APPROVED_CA (1u << 9) /* can do strong crypto in export ver */
+#define CERTDB_INVISIBLE_CA (1u << 8)      /* don't show in UI */
+#define CERTDB_GOVT_APPROVED_CA (1u << 9)  /* can do strong crypto in export ver */
 
 /* old usage, to keep old programs compiling */
 /* On Windows, Mac, and Linux (and other gcc platforms), we can give compile
diff --git a/lib/certdb/certi.h b/lib/certdb/certi.h
index df0d7c532..1cdf4b8fa 100644
--- a/lib/certdb/certi.h
+++ b/lib/certdb/certi.h
@@ -55,14 +55,14 @@ struct CRLEntryCacheStr {
     CRLEntryCache *prev, *next;
 };
 
-#define CRL_CACHE_INVALID_CRLS 0x0001 /* this state will be set
-            if we have CRL objects with an invalid DER or signature. Can be
-            cleared if the invalid objects are deleted from the token */
-#define CRL_CACHE_LAST_FETCH_FAILED 0x0002 /* this state will be set
-            if the last CRL fetch encountered an error. Can be cleared if a
+#define CRL_CACHE_INVALID_CRLS 0x0001      /* this state will be set             \
+                 if we have CRL objects with an invalid DER or signature. Can be \
+                 cleared if the invalid objects are deleted from the token */
+#define CRL_CACHE_LAST_FETCH_FAILED 0x0002 /* this state will be set        \
+            if the last CRL fetch encountered an error. Can be cleared if a \
             new fetch succeeds */
 
-#define CRL_CACHE_OUT_OF_MEMORY 0x0004 /* this state will be set
+#define CRL_CACHE_OUT_OF_MEMORY 0x0004 /* this state will be set \
             if we don't have enough memory to build the hash table of entries */
 
 typedef enum {
diff --git a/lib/certdb/certt.h b/lib/certdb/certt.h
index 4c31c29e0..b9538ffc6 100644
--- a/lib/certdb/certt.h
+++ b/lib/certdb/certt.h
@@ -150,12 +150,12 @@ typedef enum SECTrustTypeEnum {
     trustTypeNone = 3
 } SECTrustType;
 
-#define SEC_GET_TRUST_FLAGS(trust, type)                                       \
-    (((type) == trustSSL)                                                      \
-         ? ((trust)->sslFlags)                                                 \
-         : (((type) == trustEmail) ? ((trust)->emailFlags)                     \
-                                   : (((type) == trustObjectSigning)           \
-                                          ? ((trust)->objectSigningFlags)      \
+#define SEC_GET_TRUST_FLAGS(trust, type)                                  \
+    (((type) == trustSSL)                                                 \
+         ? ((trust)->sslFlags)                                            \
+         : (((type) == trustEmail) ? ((trust)->emailFlags)                \
+                                   : (((type) == trustObjectSigning)      \
+                                          ? ((trust)->objectSigningFlags) \
                                           : 0)))
 
 /*
@@ -428,12 +428,12 @@ struct CERTDistNamesStr {
 #define EXT_KEY_USAGE_TIME_STAMP (0x8000)
 #define EXT_KEY_USAGE_STATUS_RESPONDER (0x4000)
 
-#define NS_CERT_TYPE_APP                                                       \
-    (NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_SSL_SERVER | NS_CERT_TYPE_EMAIL |  \
+#define NS_CERT_TYPE_APP                                                      \
+    (NS_CERT_TYPE_SSL_CLIENT | NS_CERT_TYPE_SSL_SERVER | NS_CERT_TYPE_EMAIL | \
      NS_CERT_TYPE_OBJECT_SIGNING)
 
-#define NS_CERT_TYPE_CA                                                        \
-    (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA |                             \
+#define NS_CERT_TYPE_CA                            \
+    (NS_CERT_TYPE_SSL_CA | NS_CERT_TYPE_EMAIL_CA | \
      NS_CERT_TYPE_OBJECT_SIGNING_CA | EXT_KEY_USAGE_STATUS_RESPONDER)
 typedef enum SECCertUsageEnum {
     certUsageSSLClient = 0,
@@ -536,9 +536,9 @@ struct CERTIssuerAndSNStr {
 #define KU_KEY_CERT_SIGN (0x04)     /* bit 5 */
 #define KU_CRL_SIGN (0x02)          /* bit 6 */
 #define KU_ENCIPHER_ONLY (0x01)     /* bit 7 */
-#define KU_ALL                                                                 \
-    (KU_DIGITAL_SIGNATURE | KU_NON_REPUDIATION | KU_KEY_ENCIPHERMENT |         \
-     KU_DATA_ENCIPHERMENT | KU_KEY_AGREEMENT | KU_KEY_CERT_SIGN |              \
+#define KU_ALL                                                         \
+    (KU_DIGITAL_SIGNATURE | KU_NON_REPUDIATION | KU_KEY_ENCIPHERMENT | \
+     KU_DATA_ENCIPHERMENT | KU_KEY_AGREEMENT | KU_KEY_CERT_SIGN |      \
      KU_CRL_SIGN | KU_ENCIPHER_ONLY)
 
 /* This value will not occur in certs.  It is used internally for the case
@@ -873,36 +873,36 @@ typedef struct {
  */
 
 typedef enum {
-    cert_pi_end = 0,         /* SPECIAL: signifies end of array of
+    cert_pi_end = 0,              /* SPECIAL: signifies end of array of
                               * CERTValParam* */
-    cert_pi_nbioContext = 1, /* specify a non-blocking IO context used to
+    cert_pi_nbioContext = 1,      /* specify a non-blocking IO context used to
                               * resume a session. If this argument is
                               * specified, no other arguments should be.
                               * Specified in value.pointer.p. If the
                               * operation completes the context will be
                               * freed. */
-    cert_pi_nbioAbort = 2,   /* specify a non-blocking IO context for an
+    cert_pi_nbioAbort = 2,        /* specify a non-blocking IO context for an
                               * existing operation which the caller wants
                               * to abort. If this argument is
                               * specified, no other arguments should be.
                               * Specified in value.pointer.p. If the
                               * operation succeeds the context will be
                               * freed. */
-    cert_pi_certList = 3,    /* specify the chain to validate against. If
+    cert_pi_certList = 3,         /* specify the chain to validate against. If
                               * this value is given, then the path
                               * construction step in the validation is
                               * skipped. Specified in value.pointer.chain */
-    cert_pi_policyOID = 4,   /* validate certificate for policy OID.
+    cert_pi_policyOID = 4,        /* validate certificate for policy OID.
                               * Specified in value.array.oids. Cert must
                               * be good for at least one OID in order
                               * to validate. Default is that the user is not
                               * concerned about certificate policy. */
-    cert_pi_policyFlags = 5, /* flags for each policy specified in policyOID.
+    cert_pi_policyFlags = 5,      /* flags for each policy specified in policyOID.
                               * Specified in value.scalar.ul. Policy flags
                               * apply to all specified oids.
                               * Use CERT_POLICY_FLAG_* macros below. If not
                               * specified policy flags default to 0 */
-    cert_pi_keyusage = 6,    /* specify what the keyusages the certificate
+    cert_pi_keyusage = 6,         /* specify what the keyusages the certificate
                               * will be evaluated against, specified in
                               * value.scalar.ui. The cert must validate for
                               * at least one of the specified key usages.
@@ -946,7 +946,7 @@ typedef enum {
      * validation on the currently calculated chain.
      * Value is in value.pointer.chainVerifyCallback */
     cert_pi_useOnlyTrustAnchors = 14,
-        /* If true, disables trusting any
+    /* If true, disables trusting any
         * certificates other than the ones passed in via cert_pi_trustAnchors.
         * If false, then the certificates specified via cert_pi_trustAnchors
         * will be combined with the pre-existing trusted roots, but only
diff --git a/lib/certdb/crl.c b/lib/certdb/crl.c
index a7baf53bb..5d19222a5 100644
--- a/lib/certdb/crl.c
+++ b/lib/certdb/crl.c
@@ -1618,20 +1618,20 @@ DPCache_Lookup(CRLDPCache* cache, const SECItem* sn, CERTCrlEntry** returned)
 
 #if defined(DPC_RWLOCK)
 
-#define DPCache_LockWrite()                                                    \
-    {                                                                          \
-        if (readlocked) {                                                      \
-            NSSRWLock_UnlockRead(cache->lock);                                 \
-        }                                                                      \
-        NSSRWLock_LockWrite(cache->lock);                                      \
+#define DPCache_LockWrite()                    \
+    {                                          \
+        if (readlocked) {                      \
+            NSSRWLock_UnlockRead(cache->lock); \
+        }                                      \
+        NSSRWLock_LockWrite(cache->lock);      \
     }
 
-#define DPCache_UnlockWrite()                                                  \
-    {                                                                          \
-        if (readlocked) {                                                      \
-            NSSRWLock_LockRead(cache->lock);                                   \
-        }                                                                      \
-        NSSRWLock_UnlockWrite(cache->lock);                                    \
+#define DPCache_UnlockWrite()                \
+    {                                        \
+        if (readlocked) {                    \
+            NSSRWLock_LockRead(cache->lock); \
+        }                                    \
+        NSSRWLock_UnlockWrite(cache->lock);  \
     }
 
 #else
@@ -1639,12 +1639,12 @@ DPCache_Lookup(CRLDPCache* cache, const SECItem* sn, CERTCrlEntry** returned)
 /* with a global lock, we are always locked for read before we need write
    access, so do nothing */
 
-#define DPCache_LockWrite()                                                    \
-    {                                                                          \
+#define DPCache_LockWrite() \
+    {                       \
     }
 
-#define DPCache_UnlockWrite()                                                  \
-    {                                                                          \
+#define DPCache_UnlockWrite() \
+    {                         \
     }
 
 #endif
diff --git a/lib/certdb/genname.c b/lib/certdb/genname.c
index fe48df839..91053092e 100644
--- a/lib/certdb/genname.c
+++ b/lib/certdb/genname.c
@@ -1573,15 +1573,16 @@ done:
  *
  */
 
-#define STRING_TO_SECITEM(str)                                                 \
-    {                                                                          \
-        siBuffer, (unsigned char *)str, sizeof(str) - 1                        \
+#define STRING_TO_SECITEM(str)                          \
+    {                                                   \
+        siBuffer, (unsigned char *)str, sizeof(str) - 1 \
     }
 
-#define NAME_CONSTRAINTS_ENTRY(CA)                                             \
-    {                                                                          \
-        STRING_TO_SECITEM(CA##_SUBJECT_DN),                                    \
-        STRING_TO_SECITEM(CA##_NAME_CONSTRAINTS)                               \
+#define NAME_CONSTRAINTS_ENTRY(CA)                   \
+    {                                                \
+        STRING_TO_SECITEM(CA##_SUBJECT_DN)           \
+        ,                                            \
+            STRING_TO_SECITEM(CA##_NAME_CONSTRAINTS) \
     }
 
 /* Agence Nationale de la Securite des Systemes d'Information (ANSSI) */
diff --git a/lib/certdb/secname.c b/lib/certdb/secname.c
index e198f9ee5..f1bc94f90 100644
--- a/lib/certdb/secname.c
+++ b/lib/certdb/secname.c
@@ -606,7 +606,10 @@ CERT_DecodeAVAValue(const SECItem *derAVAValue)
 {
     SECItem *retItem;
     const SEC_ASN1Template *theTemplate = NULL;
-    enum { conv_none, conv_ucs4, conv_ucs2, conv_iso88591 } convert = conv_none;
+    enum { conv_none,
+           conv_ucs4,
+           conv_ucs2,
+           conv_iso88591 } convert = conv_none;
     SECItem avaValue = { siBuffer, 0 };
     PORTCheapArenaPool tmpArena;
 
diff --git a/lib/certdb/stanpcertdb.c b/lib/certdb/stanpcertdb.c
index a65ad5cb8..5bb3891d6 100644
--- a/lib/certdb/stanpcertdb.c
+++ b/lib/certdb/stanpcertdb.c
@@ -142,7 +142,7 @@ extern const NSSError NSS_ERROR_ALREADY_INITIALIZED;
 extern const NSSError NSS_ERROR_PKCS11;
 
 /* Look at the stan error stack and map it to NSS 3 errors */
-#define STAN_MAP_ERROR(x, y)                                                   \
+#define STAN_MAP_ERROR(x, y) \
     else if (error == (x)) { secError = y; }
 
 /*
diff --git a/lib/certdb/xbsconst.c b/lib/certdb/xbsconst.c
index 8da1a9a77..4f01f51f4 100644
--- a/lib/certdb/xbsconst.c
+++ b/lib/certdb/xbsconst.c
@@ -37,8 +37,8 @@ static const SEC_ASN1Template CERTBasicConstraintsTemplate[] = {
 static unsigned char hexTrue = 0xff;
 static unsigned char hexFalse = 0x00;
 
-#define GEN_BREAK(status)                                                      \
-    rv = status;                                                               \
+#define GEN_BREAK(status) \
+    rv = status;          \
     break;
 
 SECStatus
diff --git a/lib/certhigh/certhigh.c b/lib/certhigh/certhigh.c
index 35064b587..00f46e45d 100644
--- a/lib/certhigh/certhigh.c
+++ b/lib/certhigh/certhigh.c
@@ -256,8 +256,7 @@ CERT_FindUserCertByUsage(CERTCertDBHandle *handle,
             goto loser;
         }
         /* If we already found the right cert, just return it */
-        if ((!validOnly || CERT_CheckCertValidTimes(cert, time, PR_FALSE) ==
-                               secCertTimeValid) &&
+        if ((!validOnly || CERT_CheckCertValidTimes(cert, time, PR_FALSE) == secCertTimeValid) &&
             (CERT_CheckKeyUsage(cert, requiredKeyUsage) == SECSuccess) &&
             (cert->nsCertType & requiredCertType) &&
             CERT_IsUserCert(cert)) {
diff --git a/lib/certhigh/certvfy.c b/lib/certhigh/certvfy.c
index 0ec7b4131..a4693e835 100644
--- a/lib/certhigh/certvfy.c
+++ b/lib/certhigh/certvfy.c
@@ -1117,7 +1117,7 @@ cert_CheckLeafTrust(CERTCertificate *cert, SECCertUsage certUsage,
                     *trusted = PR_TRUE;
                     return SECSuccess;
                 }
-                /* fall through to test distrust */
+            /* fall through to test distrust */
             case certUsageAnyCA:
             case certUsageUserCertImport:
                 /* do we distrust these certs explicitly */
@@ -1137,7 +1137,7 @@ cert_CheckLeafTrust(CERTCertificate *cert, SECCertUsage certUsage,
                         return SECFailure;
                     }
                 }
-                /* fall through */
+            /* fall through */
             case certUsageProtectedObjectSigner:
                 flags = trust.objectSigningFlags;
                 if (flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
diff --git a/lib/certhigh/ocsp.c b/lib/certhigh/ocsp.c
index 7e7bb51a7..3f89fb673 100644
--- a/lib/certhigh/ocsp.c
+++ b/lib/certhigh/ocsp.c
@@ -3818,12 +3818,12 @@ done:
     return (retval);
 }
 
-#ifdef LATER /*
-              * XXX This function is not currently used, but will
-              * be needed later when we do revocation checking of
-              * the responder certificate.  Of course, it may need
-              * revising then, if the cert extension interface has
-              * changed.  (Hopefully it will!)
+#ifdef LATER /*                                                    \
+              * XXX This function is not currently used, but will  \
+              * be needed later when we do revocation checking of  \
+              * the responder certificate.  Of course, it may need \
+              * revising then, if the cert extension interface has \
+              * changed.  (Hopefully it will!)                     \
               */
 
 /* Checks a certificate to see if it has the OCSP no check extension. */
@@ -5999,13 +5999,7 @@ CERT_EnableOCSPDefaultResponder(CERTCertDBHandle *handle)
     rv = CERT_VerifyCertificateNow(handle, cert, PR_TRUE,
                                    certificateUsageCheckAllUsages,
                                    NULL, &usage);
-    if (rv != SECSuccess || (usage & (certificateUsageSSLClient |
-                                      certificateUsageSSLServer |
-                                      certificateUsageSSLServerWithStepUp |
-                                      certificateUsageEmailSigner |
-                                      certificateUsageObjectSigner |
-                                      certificateUsageStatusResponder |
-                                      certificateUsageSSLCA)) == 0) {
+    if (rv != SECSuccess || (usage & (certificateUsageSSLClient | certificateUsageSSLServer | certificateUsageSSLServerWithStepUp | certificateUsageEmailSigner | certificateUsageObjectSigner | certificateUsageStatusResponder | certificateUsageSSLCA)) == 0) {
         PORT_SetError(SEC_ERROR_OCSP_RESPONDER_CERT_INVALID);
         return SECFailure;
     }
diff --git a/lib/ckfw/instance.c b/lib/ckfw/instance.c
index b4e795b19..cee56c97c 100644
--- a/lib/ckfw/instance.c
+++ b/lib/ckfw/instance.c
@@ -316,7 +316,7 @@ nssCKFWInstance_Create(
 
 nomem:
     *pError = CKR_HOST_MEMORY;
-    /*FALLTHROUGH*/
+/*FALLTHROUGH*/
 loser:
 
     if (CK_TRUE == called_Initialize) {
diff --git a/lib/crmf/cmmfchal.c b/lib/crmf/cmmfchal.c
index 13be227c3..5ca3951d3 100644
--- a/lib/crmf/cmmfchal.c
+++ b/lib/crmf/cmmfchal.c
@@ -97,7 +97,7 @@ cmmf_create_witness_and_challenge(PLArenaPool *poolp,
     }
     rv = SECITEM_CopyItem(poolp, &challenge->senderDER, senderDER);
     crmf_get_public_value(inPubKey, &challenge->key);
-    /* Fall through */
+/* Fall through */
 loser:
     if (spki != NULL) {
         SECKEY_DestroySubjectPublicKeyInfo(spki);
diff --git a/lib/crmf/cmmfresp.c b/lib/crmf/cmmfresp.c
index c8ff4bd75..c4b59b8e9 100644
--- a/lib/crmf/cmmfresp.c
+++ b/lib/crmf/cmmfresp.c
@@ -92,9 +92,7 @@ cmmf_ExtractCertsFromList(CERTCertList *inCertList,
         numNodes++;
     }
 
-    arrayLocalCopy = *certArray = (poolp == NULL) ?
-                                    PORT_NewArray(CERTCertificate *, (numNodes + 1)) :
-                                    PORT_ArenaNewArray(poolp, CERTCertificate *, (numNodes + 1));
+    arrayLocalCopy = *certArray = (poolp == NULL) ? PORT_NewArray(CERTCertificate *, (numNodes + 1)) : PORT_ArenaNewArray(poolp, CERTCertificate *, (numNodes + 1));
     if (arrayLocalCopy == NULL) {
         return SECFailure;
     }
diff --git a/lib/crmf/crmfcont.c b/lib/crmf/crmfcont.c
index 9cafdb1d7..5df2bd828 100644
--- a/lib/crmf/crmfcont.c
+++ b/lib/crmf/crmfcont.c
@@ -158,8 +158,7 @@ crmf_copy_encryptedvalue_secalg(PLArenaPool *poolp,
     SECAlgorithmID *newAlgId;
     SECStatus rv;
 
-    newAlgId = (poolp != NULL) ? PORT_ArenaZNew(poolp, SECAlgorithmID) :
-                               PORT_ZNew(SECAlgorithmID);
+    newAlgId = (poolp != NULL) ? PORT_ArenaZNew(poolp, SECAlgorithmID) : PORT_ZNew(SECAlgorithmID);
     if (newAlgId == NULL) {
         return SECFailure;
     }
@@ -260,8 +259,7 @@ crmf_copy_encryptedkey(PLArenaPool *poolp,
         case crmfEnvelopedDataChoice:
             destEncrKey->value.envelopedData =
                 SEC_PKCS7CopyContentInfo(srcEncrKey->value.envelopedData);
-            rv = (destEncrKey->value.envelopedData != NULL) ? SECSuccess :
-                                                            SECFailure;
+            rv = (destEncrKey->value.envelopedData != NULL) ? SECSuccess : SECFailure;
             break;
         default:
             rv = SECFailure;
diff --git a/lib/crmf/crmfget.c b/lib/crmf/crmfget.c
index a61082c67..5c1d2aa19 100644
--- a/lib/crmf/crmfget.c
+++ b/lib/crmf/crmfget.c
@@ -204,8 +204,7 @@ crmf_copy_control(PLArenaPool *poolp, CRMFControl *srcControl)
     CRMFControl *newControl;
     SECStatus rv;
 
-    newControl = (poolp == NULL) ? PORT_ZNew(CRMFControl) :
-                                 PORT_ArenaZNew(poolp, CRMFControl);
+    newControl = (poolp == NULL) ? PORT_ZNew(CRMFControl) : PORT_ArenaZNew(poolp, CRMFControl);
     if (newControl == NULL) {
         goto loser;
     }
@@ -290,8 +289,7 @@ crmf_copy_cert_request(PLArenaPool *poolp, CRMFCertRequest *srcReq)
     if (srcReq == NULL) {
         return NULL;
     }
-    newReq = (poolp == NULL) ? PORT_ZNew(CRMFCertRequest) :
-                             PORT_ArenaZNew(poolp, CRMFCertRequest);
+    newReq = (poolp == NULL) ? PORT_ZNew(CRMFCertRequest) : PORT_ArenaZNew(poolp, CRMFCertRequest);
     if (newReq == NULL) {
         goto loser;
     }
diff --git a/lib/crmf/crmfreq.c b/lib/crmf/crmfreq.c
index 483251636..e89f18228 100644
--- a/lib/crmf/crmfreq.c
+++ b/lib/crmf/crmfreq.c
@@ -275,8 +275,7 @@ crmf_template_add_public_key(PLArenaPool *poolp,
     CERTSubjectPublicKeyInfo *spki;
     SECStatus rv;
 
-    *dest = spki = (poolp == NULL) ? PORT_ZNew(CERTSubjectPublicKeyInfo) :
-                                   PORT_ArenaZNew(poolp, CERTSubjectPublicKeyInfo);
+    *dest = spki = (poolp == NULL) ? PORT_ZNew(CERTSubjectPublicKeyInfo) : PORT_ArenaZNew(poolp, CERTSubjectPublicKeyInfo);
     if (spki == NULL) {
         goto loser;
     }
@@ -527,8 +526,7 @@ crmf_create_cert_extension(PLArenaPool *poolp,
     SECOidData *oidData;
     SECStatus rv;
 
-    newExt = (poolp == NULL) ? PORT_ZNew(CRMFCertExtension) :
-                             PORT_ArenaZNew(poolp, CRMFCertExtension);
+    newExt = (poolp == NULL) ? PORT_ZNew(CRMFCertExtension) : PORT_ArenaZNew(poolp, CRMFCertExtension);
     if (newExt == NULL) {
         goto loser;
     }
diff --git a/lib/crmf/respcmn.c b/lib/crmf/respcmn.c
index ecd006e97..f9e4155a3 100644
--- a/lib/crmf/respcmn.c
+++ b/lib/crmf/respcmn.c
@@ -263,8 +263,7 @@ cmmf_CopyCertResponse(PLArenaPool *poolp,
     if (src->certifiedKeyPair != NULL) {
         CMMFCertifiedKeyPair *destKeyPair;
 
-        destKeyPair = (poolp == NULL) ? PORT_ZNew(CMMFCertifiedKeyPair) :
-                                      PORT_ArenaZNew(poolp, CMMFCertifiedKeyPair);
+        destKeyPair = (poolp == NULL) ? PORT_ZNew(CMMFCertifiedKeyPair) : PORT_ArenaZNew(poolp, CMMFCertifiedKeyPair);
         if (!destKeyPair) {
             return SECFailure;
         }
@@ -295,8 +294,7 @@ cmmf_CopyCertOrEncCert(PLArenaPool *poolp, CMMFCertOrEncCert *dest,
             dest->cert.certificate = CERT_DupCertificate(src->cert.certificate);
             break;
         case cmmfEncryptedCert:
-            encVal = (poolp == NULL) ? PORT_ZNew(CRMFEncryptedValue) :
-                                     PORT_ArenaZNew(poolp, CRMFEncryptedValue);
+            encVal = (poolp == NULL) ? PORT_ZNew(CRMFEncryptedValue) : PORT_ArenaZNew(poolp, CRMFEncryptedValue);
             if (encVal == NULL) {
                 return SECFailure;
             }
@@ -330,8 +328,7 @@ cmmf_CopyCertifiedKeyPair(PLArenaPool *poolp, CMMFCertifiedKeyPair *dest,
     if (src->privateKey != NULL) {
         CRMFEncryptedValue *encVal;
 
-        encVal = (poolp == NULL) ? PORT_ZNew(CRMFEncryptedValue) :
-                                 PORT_ArenaZNew(poolp, CRMFEncryptedValue);
+        encVal = (poolp == NULL) ? PORT_ZNew(CRMFEncryptedValue) : PORT_ArenaZNew(poolp, CRMFEncryptedValue);
         if (encVal == NULL) {
             return SECFailure;
         }
diff --git a/lib/cryptohi/keythi.h b/lib/cryptohi/keythi.h
index e0a9215a0..bd26838eb 100644
--- a/lib/cryptohi/keythi.h
+++ b/lib/cryptohi/keythi.h
@@ -206,18 +206,14 @@ typedef struct SECKEYPublicKeyStr SECKEYPublicKey;
 #define SECKEY_ATTRIBUTES_CACHED(key) \
     (0 != (key->staticflags & SECKEY_Attributes_Cached))
 
-#define SECKEY_ATTRIBUTE_VALUE(key,attribute) \
+#define SECKEY_ATTRIBUTE_VALUE(key, attribute) \
     (0 != (key->staticflags & SECKEY_##attribute))
 
-#define SECKEY_HAS_ATTRIBUTE_SET(key,attribute) \
-    (0 != (key->staticflags & SECKEY_Attributes_Cached)) ? \
-    (0 != (key->staticflags & SECKEY_##attribute)) : \
-    PK11_HasAttributeSet(key->pkcs11Slot,key->pkcs11ID,attribute, PR_FALSE)
+#define SECKEY_HAS_ATTRIBUTE_SET(key, attribute) \
+    (0 != (key->staticflags & SECKEY_Attributes_Cached)) ? (0 != (key->staticflags & SECKEY_##attribute)) : PK11_HasAttributeSet(key->pkcs11Slot, key->pkcs11ID, attribute, PR_FALSE)
 
-#define SECKEY_HAS_ATTRIBUTE_SET_LOCK(key,attribute, haslock) \
-    (0 != (key->staticflags & SECKEY_Attributes_Cached)) ? \
-    (0 != (key->staticflags & SECKEY_##attribute)) : \
-    PK11_HasAttributeSet(key->pkcs11Slot,key->pkcs11ID,attribute, haslock)
+#define SECKEY_HAS_ATTRIBUTE_SET_LOCK(key, attribute, haslock) \
+    (0 != (key->staticflags & SECKEY_Attributes_Cached)) ? (0 != (key->staticflags & SECKEY_##attribute)) : PK11_HasAttributeSet(key->pkcs11Slot, key->pkcs11ID, attribute, haslock)
 
 /*
 ** A generic key structure
diff --git a/lib/cryptohi/secsign.c b/lib/cryptohi/secsign.c
index 0243c2648..1bbdd5384 100644
--- a/lib/cryptohi/secsign.c
+++ b/lib/cryptohi/secsign.c
@@ -354,7 +354,7 @@ SEC_DerSignData(PLArenaPool *arena, SECItem *result,
 
     /* DER encode the signed data object */
     rv = DER_Encode(arena, result, CERTSignedDataTemplate, &sd);
-    /* FALL THROUGH */
+/* FALL THROUGH */
 
 loser:
     PORT_Free(it.data);
diff --git a/lib/dbm/include/hash.h b/lib/dbm/include/hash.h
index 9faa0b724..7da51dc64 100644
--- a/lib/dbm/include/hash.h
+++ b/lib/dbm/include/hash.h
@@ -97,7 +97,7 @@ typedef struct hashhdr {     /* Disk resident portion */
     int32 nkeys;             /* Number of keys in hash table */
     int32 hdrpages;          /* Size of table header */
     uint32 h_charkey;        /* value of hash(CHARKEY) */
-#define NCACHED 32           /* number of bit maps and spare
+#define NCACHED 32           /* number of bit maps and spare \
                               * points */
     int32 spares[NCACHED];   /* spare pages for overflow */
     uint16 bitmaps[NCACHED]; /* address of overflow page
diff --git a/lib/dbm/include/ncompat.h b/lib/dbm/include/ncompat.h
index 6f72e6463..9fd434799 100644
--- a/lib/dbm/include/ncompat.h
+++ b/lib/dbm/include/ncompat.h
@@ -92,16 +92,10 @@ typedef unsigned int  sigset_t;
 static int __sigtemp; /* For the use of sigprocmask */
 
 /* Repeated test of oset != NULL is to avoid "*0". */
-#define sigprocmask(how, set, oset) \
-  ((__sigtemp =                     \
-  (((how) == SIG_BLOCK) ?           \
-    sigblock(0) | *(set) :          \
-  (((how) == SIG_UNBLOCK) ?         \
-    sigblock(0) & ~(*(set)) :       \
-  ((how) == SIG_SETMASK ?           \
-    *(set) : sigblock(0))))),       \
-  ((oset) ? (*(oset ? oset : set) = sigsetmask(__sigtemp)) :  \
-    sigsetmask(__sigtemp)), 0)
+#define sigprocmask(how, set, oset)                                                                                                                            \
+    ((__sigtemp =                                                                                                                                              \
+          (((how) == SIG_BLOCK) ? sigblock(0) | *(set) : (((how) == SIG_UNBLOCK) ? sigblock(0) & ~(*(set)) : ((how) == SIG_SETMASK ? *(set) : sigblock(0))))), \
+     ((oset) ? (*(oset ? oset : set) = sigsetmask(__sigtemp)) : sigsetmask(__sigtemp)), 0)
 #endif
 
 /*
diff --git a/lib/dbm/src/h_func.c b/lib/dbm/src/h_func.c
index 5ccbf1bb3..0d8734e8b 100644
--- a/lib/dbm/src/h_func.c
+++ b/lib/dbm/src/h_func.c
@@ -179,25 +179,25 @@ hash4(const void *keyarg, register size_t len)
             case 0:
                 do {
                     HASH4;
-                        /* FALLTHROUGH */
+                    /* FALLTHROUGH */
                     case 7:
                         HASH4;
-                        /* FALLTHROUGH */
+                    /* FALLTHROUGH */
                     case 6:
                         HASH4;
-                        /* FALLTHROUGH */
+                    /* FALLTHROUGH */
                     case 5:
                         HASH4;
-                        /* FALLTHROUGH */
+                    /* FALLTHROUGH */
                     case 4:
                         HASH4;
-                        /* FALLTHROUGH */
+                    /* FALLTHROUGH */
                     case 3:
                         HASH4;
-                        /* FALLTHROUGH */
+                    /* FALLTHROUGH */
                     case 2:
                         HASH4;
-                        /* FALLTHROUGH */
+                    /* FALLTHROUGH */
                     case 1:
                         HASH4;
                 } while (--loop);
diff --git a/lib/dbm/src/hash_buf.c b/lib/dbm/src/hash_buf.c
index 581ba169a..a7cd2d076 100644
--- a/lib/dbm/src/hash_buf.c
+++ b/lib/dbm/src/hash_buf.c
@@ -317,7 +317,7 @@ newbuf(HTAB *hashp, uint32 addr, BUFHEAD *prev_bp)
 #endif
     bp->ovfl = NULL;
     if (prev_bp) {
-        /*
+/*
          * If prev_bp is set, this is an overflow page, hook it in to
          * the buffer overflow links.
          */
diff --git a/lib/dbm/src/memmove.c b/lib/dbm/src/memmove.c
index 93e8873a4..135185b35 100644
--- a/lib/dbm/src/memmove.c
+++ b/lib/dbm/src/memmove.c
@@ -76,7 +76,7 @@ register size_t length;
     if (length == 0 || dst == src) /* nothing to do */
         goto done;
 
-    /*
+/*
      * Macros: loop-t-times; and loop-t-times, t>0
      */
 #define TLOOP(s) \