@@ -106,7 +106,7 @@

 static void sigsegv(int sig);

 static void print_trace(int use_syslog);

-/*#define	SAVE_TMP */ /* Save the file being worked on in tmp */

+/*#define    SAVE_TMP */ /* Save the file being worked on in tmp */

 #endif

 #if defined(NO_STRTOK_R) || !defined(CL_THREAD_SAFE)

@@ -164,7 +164,7 @@ typedef enum {

 /*

  * Use CL_SCAN_MAIL_PARTIAL_MESSAGE to handle messages covered by section 7.3.2 of RFC1341.

- *	This is experimental code so it is up to YOU to (1) ensure it's secure

+ *    This is experimental code so it is up to YOU to (1) ensure it's secure

  * (2) periodically trim the directory of old files

  *

  * If you use the load balancing feature of clamav-milter to run clamd on

@@ -176,7 +176,7 @@ typedef enum {

  * Slows things down a lot and only catches unencoded copies

  * of EICAR within bounces, which don't matter

  */

-//#define	SCAN_UNENCODED_BOUNCES

+//#define    SCAN_UNENCODED_BOUNCES

 typedef struct mbox_ctx {

     const char *dir;

@@ -278,14 +278,14 @@ static bool haveTooManyMIMEArguments(size_t argCnt, cli_ctx *ctx, bool *heuristi

                          * boundary="nextPart1383049.XCRrrar2yq"; \

                          * protocol="application/pgp-encrypted"   \

                          */

-#define X_BFILE RELATED /*                                           \

-                         * BeOS, expert two parts: the file and it's \

-                         * attributes. The attributes part comes as  \

-                         *	Content-Type: application/x-be_attribute  \

-                         *		name="foo"                               \

-                         * I can't find where it is defined, any     \

-                         * pointers would be appreciated. For now    \

-                         * we treat it as multipart/related          \

+#define X_BFILE RELATED /*                                             \

+                         * BeOS, expert two parts: the file and it's   \

+                         * attributes. The attributes part comes as    \

+                         *    Content-Type: application/x-be_attribute \

+                         *        name="foo"                           \

+                         * I can't find where it is defined, any       \

+                         * pointers would be appreciated. For now      \

+                         * we treat it as multipart/related            \

                          */

 #define KNOWBOT 14      /* Unknown and undocumented format? */

@@ -346,18 +346,18 @@ int cli_mbox(const char *dir, cli_ctx *ctx)

 /*

  * TODO: when signal handling is added, need to remove temp files when a

- *	signal is received

+ *    signal is received

  * TODO: add option to scan in memory not via temp files, perhaps with a

  * named pipe or memory mapped file, though this won't work on big e-mails

  * containing many levels of encapsulated messages - it'd just take too much

  * RAM

  * TODO: parse .msg format files

  * TODO: fully handle AppleDouble format, see

- *	http://www.lazerware.com/formats/Specs/AppleSingle_AppleDouble.pdf

+ *    http://www.lazerware.com/formats/Specs/AppleSingle_AppleDouble.pdf

  * TODO: ensure parseEmailHeaders is always called before parseEmailBody

  * TODO: create parseEmail which calls parseEmailHeaders then parseEmailBody

  * TODO: Handle unexpected NUL bytes in header lines which stop strcmp()s:

- *	e.g. \0Content-Type: application/binary;

+ *    e.g. \0Content-Type: application/binary;

  */

 static int

 cli_parse_mbox(const char *dir, cli_ctx *ctx)

@@ -407,34 +407,34 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

 #endif

     /*

-	 * Is it a UNIX style mbox with more than one

-	 * mail message, or just a single mail message?

-	 *

-	 * TODO: It would be better if we called cli_magic_scan_dir here rather than

-	 * in cli_scanmail. Then we could improve the way mailboxes with more

-	 * than one message is handled, e.g. giving a better indication of

-	 * which message within the mailbox is infected

-	 */

+     * Is it a UNIX style mbox with more than one

+     * mail message, or just a single mail message?

+     *

+     * TODO: It would be better if we called cli_magic_scan_dir here rather than

+     * in cli_scanmail. Then we could improve the way mailboxes with more

+     * than one message is handled, e.g. giving a better indication of

+     * which message within the mailbox is infected

+     */

     /*if((strncmp(buffer, "From ", 5) == 0) && isalnum(buffer[5])) {*/

     if (strncmp(buffer, "From ", 5) == 0) {

         /*

-		 * Have been asked to check a UNIX style mbox file, which

-		 * may contain more than one e-mail message to decode

-		 *

-		 * It would be far better for scanners.c to do this splitting

-		 * and do this

-		 *	FOR EACH mail in the mailbox

-		 *	DO

-		 *		pass this mail to cli_mbox --

-		 *		scan this file

-		 *		IF this file has a virus quit

-		 *		THEN

-		 *			return CL_VIRUS

-		 *		FI

-		 *	END

-		 * This would remove a problem with this code that it can

-		 * fill up the tmp directory before it starts scanning

-		 */

+         * Have been asked to check a UNIX style mbox file, which

+         * may contain more than one e-mail message to decode

+         *

+         * It would be far better for scanners.c to do this splitting

+         * and do this

+         *    FOR EACH mail in the mailbox

+         *    DO

+         *        pass this mail to cli_mbox --

+         *        scan this file

+         *        IF this file has a virus quit

+         *        THEN

+         *            return CL_VIRUS

+         *        FI

+         *    END

+         * This would remove a problem with this code that it can

+         * fill up the tmp directory before it starts scanning

+         */

         bool lastLineWasEmpty;

         int messagenumber;

         message *m = messageCreate(); /*Create an empty email */

@@ -452,8 +452,8 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

             if (lastLineWasEmpty && (strncmp(buffer, "From ", 5) == 0)) {

                 cli_dbgmsg("Deal with message number %d\n", messagenumber++);

                 /*

-				 * End of a message in the mail box

-				 */

+                 * End of a message in the mail box

+                 */

                 bool heuristicFound = FALSE;

                 body                = parseEmailHeaders(m, rfc821, &heuristicFound);

                 if (body == NULL) {

@@ -481,13 +481,13 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

                     }

                 }

                 /*

-				 * Starting a new message, throw away all the

-				 * information about the old one. It would

-				 * be best to be able to scan this message

-				 * now, but cli_magic_scan_file needs arguments

-				 * that haven't been passed here so it can't be

-				 * called

-				 */

+                 * Starting a new message, throw away all the

+                 * information about the old one. It would

+                 * be best to be able to scan this message

+                 * now, but cli_magic_scan_file needs arguments

+                 * that haven't been passed here so it can't be

+                 * called

+                 */

                 m = body;

                 messageReset(body);

                 messageSetCTX(body, ctx);

@@ -498,9 +498,9 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

             if (isuuencodebegin(buffer)) {

                 /*

-				 * Fast track visa to uudecode.

-				 * TODO: binhex, yenc

-				 */

+                 * Fast track visa to uudecode.

+                 * TODO: binhex, yenc

+                 */

                 if (uudecodeFile(m, buffer, dir, map, &at) < 0)

                     if (messageAddStr(m, buffer) < 0)

                         break;

@@ -522,21 +522,21 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

             messageDestroy(m);

     } else {

         /*

-		 * It's a single message, parse the headers then the body

-		 */

+         * It's a single message, parse the headers then the body

+         */

         if (strncmp(buffer, "P I ", 4) == 0)

             /*

-			 * CommuniGate Pro format: ignore headers until

-			 * blank line

-			 */

+             * CommuniGate Pro format: ignore headers until

+             * blank line

+             */

             while (fmap_gets(map, buffer, &at, sizeof(buffer) - 1) &&

                    (strchr("\r\n", buffer[0]) == NULL))

                 ;

         /* getline_from_mbox could be using unlocked_stdio(3),

-		 * so lock file here */

+         * so lock file here */

         /*

-		 * Ignore any blank lines at the top of the message

-		 */

+         * Ignore any blank lines at the top of the message

+         */

         while (strchr("\r\n", buffer[0]) &&

                (getline_from_mbox(buffer, sizeof(buffer) - 1, map, &at) != NULL))

             ;

@@ -552,8 +552,8 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

     if (body) {

         /*

-		 * Write out the last entry in the mailbox

-		 */

+         * Write out the last entry in the mailbox

+         */

         if ((retcode == CL_SUCCESS) && messageGetBody(body)) {

             messageSetCTX(body, ctx);

             switch (parseEmailBody(body, NULL, &mctx, 0)) {

@@ -562,14 +562,14 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

                     break;

                 case FAIL:

                     /*

-					 * beware: cli_magic_scan_desc(),

-					 * changes this into CL_CLEAN, so only

-					 * use it to inform the higher levels

-					 * that we couldn't decode it because

-					 * it isn't an mbox, not to signal

-					 * decoding errors on what *is* a valid

-					 * mbox

-					 */

+                     * beware: cli_magic_scan_desc(),

+                     * changes this into CL_CLEAN, so only

+                     * use it to inform the higher levels

+                     * that we couldn't decode it because

+                     * it isn't an mbox, not to signal

+                     * decoding errors on what *is* a valid

+                     * mbox

+                     */

                     retcode = CL_EFORMAT;

                     break;

                 case MAXREC:

@@ -587,8 +587,8 @@ cli_parse_mbox(const char *dir, cli_ctx *ctx)

         if (body->isTruncated && retcode == CL_SUCCESS)

             retcode = CL_EMEM;

         /*

-		 * Tidy up and quit

-		 */

+         * Tidy up and quit

+         */

         messageDestroy(body);

     }

@@ -912,9 +912,9 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

         }

         /*

-		 * Don't blank lines which are only spaces from headers,

-		 * otherwise they'll be treated as the end of header marker

-		 */

+         * Don't blank lines which are only spaces from headers,

+         * otherwise they'll be treated as the end of header marker

+         */

         if (lastWasBlank) {

             lastWasBlank = FALSE;

             if (boundaryStart(buffer, boundary)) {

@@ -926,9 +926,9 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

             cli_dbgmsg("parseEmailFile: check '%s'\n", buffer);

             /*

-			 * Ensure wide characters are handled where

-			 * sizeof(char) > 1

-			 */

+             * Ensure wide characters are handled where

+             * sizeof(char) > 1

+             */

             if (line && isspace(line[0] & 0xFF)) {

                 char copy[sizeof(buffer)];

@@ -936,18 +936,18 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

                 strstrip(copy);

                 if (copy[0] == '\0') {

                     /*

-					 * The header line contains only white

-					 * space. This is not the end of the

-					 * headers according to RFC2822, but

-					 * some MUAs will handle it as though

-					 * it were, and virus writers exploit

-					 * this bug. We can't just break from

-					 * the loop here since that would allow

-					 * other exploits such as inserting a

-					 * white space line before the

-					 * content-type line. So we just have

-					 * to make a best guess. Sigh.

-					 */

+                     * The header line contains only white

+                     * space. This is not the end of the

+                     * headers according to RFC2822, but

+                     * some MUAs will handle it as though

+                     * it were, and virus writers exploit

+                     * this bug. We can't just break from

+                     * the loop here since that would allow

+                     * other exploits such as inserting a

+                     * white space line before the

+                     * content-type line. So we just have

+                     * to make a best guess. Sigh.

+                     */

                     if (head->bufferLen) {

                         char *header     = getMallocedBufferFromList(head);

                         int needContinue = 0;

@@ -981,9 +981,9 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

             }

             if ((line == NULL) && (0 == head->bufferLen)) { /* empty line */

                 /*

-				 * A blank line signifies the end of

-				 * the header and the start of the text

-				 */

+                 * A blank line signifies the end of

+                 * the header and the start of the text

+                 */

                 if (!anyHeadersFound)

                     /* Ignore the junk at the top */

                     continue;

@@ -1000,14 +1000,14 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

                     char cmd[RFC2821LENGTH + 1], out[RFC2821LENGTH + 1];

                     /*

-					 * Continuation of line we're ignoring?

-					 */

+                     * Continuation of line we're ignoring?

+                     */

                     if (isblank(line[0]))

                         continue;

                     /*

-					 * Is this a header we're interested in?

-					 */

+                     * Is this a header we're interested in?

+                     */

                     if ((strchr(line, ':') == NULL) ||

                         (cli_strtokbuf(line, 0, ":", cmd) == NULL)) {

                         if (strncmp(line, "From ", 5) == 0)

@@ -1051,20 +1051,20 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

                 if ((lookahead = fmap_need_off_once(map, *at, 1))) {

                     /*

-					 * Section B.2 of RFC822 says TAB or

-					 * SPACE means a continuation of the

-					 * previous entry.

-					 *

-					 * Add all the arguments on the line

-					 */

+                     * Section B.2 of RFC822 says TAB or

+                     * SPACE means a continuation of the

+                     * previous entry.

+                     *

+                     * Add all the arguments on the line

+                     */

                     if (isblank(*lookahead))

                         continue;

                 }

                 /*

-				 * Handle broken headers, where the next

-				 * line isn't indented by whitespace

-				 */

+                 * Handle broken headers, where the next

+                 * line isn't indented by whitespace

+                 */

                 {

                     char *header     = getMallocedBufferFromList(head); /*This is the issue */

                     int needContinue = 0;

@@ -1098,9 +1098,9 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

             }

         } else if (line && isuuencodebegin(line)) {

             /*

-			 * Fast track visa to uudecode.

-			 * TODO: binhex, yenc

-			 */

+             * Fast track visa to uudecode.

+             * TODO: binhex, yenc

+             */

             bodyIsEmpty = FALSE;

             if (uudecodeFile(ret, line, dir, map, at) < 0)

                 if (messageAddStr(ret, line) < 0)

@@ -1108,10 +1108,10 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

         } else {

             if (line == NULL) {

                 /*

-				 * Although this would save time and RAM, some

-				 * phish signatures have been built which need

-				 * the blank lines

-				 */

+                 * Although this would save time and RAM, some

+                 * phish signatures have been built which need

+                 * the blank lines

+                 */

                 if (lastBodyLineWasBlank &&

                     (messageGetMimeType(ret) != TEXT)) {

                     cli_dbgmsg("Ignoring consecutive blank lines in the body\n");

@@ -1121,11 +1121,11 @@ parseEmailFile(fmap_t *map, size_t *at, const table_t *rfc821, const char *first

             } else {

                 if (bodyIsEmpty) {

                     /*

-					 * Broken message: new line in the

-					 * middle of the headers, so the first

-					 * line of the body is in fact

-					 * the last lines of the header

-					 */

+                     * Broken message: new line in the

+                     * middle of the headers, so the first

+                     * line of the body is in fact

+                     * the last lines of the header

+                     */

                     if (newline_in_header(line))

                         continue;

                     bodyIsEmpty = FALSE;

@@ -1151,8 +1151,8 @@ done:

     if (!anyHeadersFound) {

         /*

-		 * False positive in believing we have an e-mail when we don't

-		 */

+         * False positive in believing we have an e-mail when we don't

+         */

         messageDestroy(ret);

         cli_dbgmsg("parseEmailFile: no headers found, assuming it isn't an email\n");

         return NULL;

@@ -1222,9 +1222,9 @@ parseEmailHeaders(message *m, const table_t *rfc821, bool *heuristicFound)

                        line ? line : "");

             if (line == NULL) {

                 /*

-				 * A blank line signifies the end of

-				 * the header and the start of the text

-				 */

+                 * A blank line signifies the end of

+                 * the header and the start of the text

+                 */

                 cli_dbgmsg("End of header information\n");

                 if (!anyHeadersFound) {

                     cli_dbgmsg("Nothing interesting in the header\n");

@@ -1240,14 +1240,14 @@ parseEmailHeaders(message *m, const table_t *rfc821, bool *heuristicFound)

                     char cmd[RFC2821LENGTH + 1];

                     /*

-					 * Continuation of line we're ignoring?

-					 */

+                     * Continuation of line we're ignoring?

+                     */

                     if (isblank(line[0]))

                         continue;

                     /*

-					 * Is this a header we're interested in?

-					 */

+                     * Is this a header we're interested in?

+                     */

                     if ((strchr(line, ':') == NULL) ||

                         (cli_strtokbuf(line, 0, ":", cmd) == NULL)) {

                         if (strncmp(line, "From ", 5) == 0)

@@ -1331,17 +1331,17 @@ parseEmailHeaders(message *m, const table_t *rfc821, bool *heuristicFound)

                     /* throw away leading blank lines */

                     continue;

                 /*

-				 * Broken message: new line in the

-				 * middle of the headers, so the first

-				 * line of the body is in fact

-				 * the last lines of the header

-				 */

+                 * Broken message: new line in the

+                 * middle of the headers, so the first

+                 * line of the body is in fact

+                 * the last lines of the header

+                 */

                 if (newline_in_header(line))

                     continue;

                 bodyIsEmpty = FALSE;

             }

             /*if(t->t_line && isuuencodebegin(t->t_line))

-				puts("FIXME: add fast visa here");*/

+                puts("FIXME: add fast visa here");*/

             cli_dbgmsg("parseEmailHeaders: finished with headers, moving body\n");

             messageMoveText(ret, t, m);

             break;

@@ -1360,8 +1360,8 @@ parseEmailHeaders(message *m, const table_t *rfc821, bool *heuristicFound)

     if (!anyHeadersFound) {

         /*

-		 * False positive in believing we have an e-mail when we don't

-		 */

+         * False positive in believing we have an e-mail when we don't

+         */

         messageDestroy(ret);

         cli_dbgmsg("parseEmailHeaders: no headers found, assuming it isn't an email\n");

         return NULL;

@@ -1393,11 +1393,11 @@ parseEmailHeader(message *m, const char *line, const table_t *rfc821, cli_ctx *c

     cli_dbgmsg("parseEmailHeader '%s'\n", line);

     /*

-	 * In RFC822 the separator between the key a value is a colon,

-	 * e.g.	Content-Transfer-Encoding: base64

-	 * However some MUA's are lapse about this and virus writers exploit

-	 * this hole, so we need to check all known possibilities

-	 */

+     * In RFC822 the separator between the key a value is a colon,

+     * e.g.    Content-Transfer-Encoding: base64

+     * However some MUA's are lapse about this and virus writers exploit

+     * this hole, so we need to check all known possibilities

+     */

     for (separator = ":= "; *separator; separator++)

         if (strchr(line, *separator) != NULL)

             break;

@@ -1432,12 +1432,12 @@ parseEmailHeader(message *m, const char *line, const table_t *rfc821, cli_ctx *c

         if (arg) {

             /*

-			 * Found a header such as

-			 * Content-Type: multipart/mixed;

-			 * set arg to be

-			 * "multipart/mixed" and cmd to

-			 * be "Content-Type"

-			 */

+             * Found a header such as

+             * Content-Type: multipart/mixed;

+             * set arg to be

+             * "multipart/mixed" and cmd to

+             * be "Content-Type"

+             */

             ret = parseMimeHeader(m, cmd, rfc821, arg, ctx, heuristicFound);

         }

     }

@@ -1694,8 +1694,8 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

     /* FIXMELIMITS: this should be better integrated */

     if (engine->maxreclevel)

         /*

-		 * This is approximate

-		 */

+         * This is approximate

+         */

         if (recursion_level > engine->maxreclevel) {

             cli_dbgmsg("parseEmailBody: hit maximum recursion level (%u)\n", recursion_level);

@@ -1703,9 +1703,9 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

         }

     if (engine->maxfiles && (mctx->files >= engine->maxfiles)) {

         /*

-		 * FIXME: This is only approx - it may have already

-		 * been exceeded

-		 */

+         * FIXME: This is only approx - it may have already

+         * been exceeded

+         */

         cli_dbgmsg("parseEmailBody: number of files exceeded %u\n", engine->maxfiles);

         return MAXFILES;

     }

@@ -1743,20 +1743,20 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

         subtype = tableFind(mctx->subtypeTable, mimeSubtype);

         if ((mimeType == TEXT) && (subtype == PLAIN)) {

             /*

-			 * This is effectively no encoding, notice that we

-			 * don't check that charset is us-ascii

-			 */

+             * This is effectively no encoding, notice that we

+             * don't check that charset is us-ascii

+             */

             cli_dbgmsg("text/plain: Assume no attachments\n");

             mimeType = NOMIME;

             messageSetMimeSubtype(mainMessage, "");

         } else if ((mimeType == MESSAGE) &&

                    (strcasecmp(mimeSubtype, "rfc822-headers") == 0)) {

             /*

-			 * RFC1892/RFC3462: section 2 text/rfc822-headers

-			 * incorrectly sent as message/rfc822-headers

-			 *

-			 * Parse as text/plain, i.e. no mime

-			 */

+             * RFC1892/RFC3462: section 2 text/rfc822-headers

+             * incorrectly sent as message/rfc822-headers

+             *

+             * Parse as text/plain, i.e. no mime

+             */

             cli_dbgmsg("Changing message/rfc822-headers to text/rfc822-headers\n");

             mimeType = NOMIME;

             messageSetMimeSubtype(mainMessage, "");

@@ -1772,23 +1772,23 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                     break;

                 }

                 /*

-			 * Fall through: some phishing mails claim they are

-			 * text/plain, when they are in fact html

-			 */

+                 * Fall through: some phishing mails claim they are

+                 * text/plain, when they are in fact html

+                 */

                 /* fall through */

             case TEXT:

                 /* text/plain has been preprocessed as no encoding */

                 if (doPhishingScan) {

                     /*

-				 * It would be better to save and scan the

-				 * file and only checkURLs if it's found to be

-				 * clean

-				 */

+                     * It would be better to save and scan the

+                     * file and only checkURLs if it's found to be

+                     * clean

+                     */

                     checkURLs(mainMessage, mctx, &rc, (subtype == HTML));

                     /*

-				 * There might be html sent without subtype

-				 * html too, so scan them for phishing

-				 */

+                     * There might be html sent without subtype

+                     * html too, so scan them for phishing

+                     */

                     if (rc == VIRUS)

                         infected = TRUE;

                 }

@@ -1808,9 +1808,9 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                     /* Broken e-mail message */

                     mimeType = NOMIME;

                     /*

-				 * The break means that we will still

-				 * check if the file contains a uuencoded file

-				 */

+                     * The break means that we will still

+                     * check if the file contains a uuencoded file

+                     */

                     break;

                 }

@@ -1824,8 +1824,8 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                 }

                 /*

-			 * Get to the start of the first message

-			 */

+                 * Get to the start of the first message

+                 */

                 t_line = messageGetBody(mainMessage);

                 if (t_line == NULL) {

@@ -1840,10 +1840,10 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                         if (boundaryStart(lineGetData(t_line->t_line), boundary))

                             break;

                         /*

-					 * Found a binhex file before

-					 *	the first multipart

-					 * TODO: check yEnc

-					 */

+                         * Found a binhex file before

+                         *    the first multipart

+                         * TODO: check yEnc

+                         */

                         if (binhexBegin(mainMessage) == t_line) {

                             if (exportBinhexMessage(mctx, mainMessage)) {

                                 /* virus found */

@@ -1854,14 +1854,14 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                         } else if (t_line->t_next &&

                                    (encodingLine(mainMessage) == t_line->t_next)) {

                             /*

-						 * We look for the next line

-						 * since later on we'll skip

-						 * over the important line when

-						 * we think it's a blank line

-						 * at the top of the message -

-						 * which it would have been in

-						 * an RFC compliant world

-						 */

+                             * We look for the next line

+                             * since later on we'll skip

+                             * over the important line when

+                             * we think it's a blank line

+                             * at the top of the message -

+                             * which it would have been in

+                             * an RFC compliant world

+                             */

                             cli_dbgmsg("Found MIME attachment before the first MIME section \"%s\"\n",

                                        lineGetData(t_line->t_next->t_line));

                             if (messageGetEncoding(mainMessage) == NOENCODING)

@@ -1876,38 +1876,38 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                     free((char *)boundary);

                     mimeType = NOMIME;

                     /*

-				 * The break means that we will still

-				 * check if the file contains a yEnc/binhex file

-				 */

+                 * The break means that we will still

+                 * check if the file contains a yEnc/binhex file

+                 */

                     break;

                 }

                 /*

-			 * Build up a table of all of the parts of this

-			 * multipart message. Remember, each part may itself

-			 * be a multipart message.

-			 */

+                 * Build up a table of all of the parts of this

+                 * multipart message. Remember, each part may itself

+                 * be a multipart message.

+                 */

                 inhead     = 1;

                 inMimeHead = 0;

                 /*

-			 * Re-read this variable in case mimeSubtype has changed

-			 */

+                 * Re-read this variable in case mimeSubtype has changed

+                 */

                 subtype = tableFind(mctx->subtypeTable, mimeSubtype);

                 /*

-			 * Parse the mainMessage object and create an array

-			 * of objects called messages, one for each of the

-			 * multiparts that mainMessage contains.

-			 *

-			 * This looks like parseEmailHeaders() - maybe there's

-			 * some duplication of code to be cleaned up

-			 *

-			 * We may need to create an array rather than just

-			 * save each part as it is found because not all

-			 * elements will need scanning, and we don't yet know

-			 * which of those elements it will be, except in

-			 * the case of mixed, when all parts need to be scanned.

-			 */

+                 * Parse the mainMessage object and create an array

+                 * of objects called messages, one for each of the

+                 * multiparts that mainMessage contains.

+                 *

+                 * This looks like parseEmailHeaders() - maybe there's

+                 * some duplication of code to be cleaned up

+                 *

+                 * We may need to create an array rather than just

+                 * save each part as it is found because not all

+                 * elements will need scanning, and we don't yet know

+                 * which of those elements it will be, except in

+                 * the case of mixed, when all parts need to be scanned.

+                 */

                 for (multiparts = 0; t_line && !infected; multiparts++) {

                     int lines = 0;

                     message **m;

@@ -1922,8 +1922,8 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                     if (aMessage == NULL) {

                         multiparts--;

                         /* if allocation failed the first time,

-					 * there's no point in retrying, just

-					 * break out */

+                         * there's no point in retrying, just

+                         * break out */

                         break;

                     }

                     messageSetCTX(aMessage, mctx->ctx);

@@ -1931,9 +1931,9 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                     cli_dbgmsg("Now read in part %d\n", multiparts);

                     /*

-				 * Ignore blank lines. There shouldn't be ANY

-				 * but some viruses insert them

-				 */

+                     * Ignore blank lines. There shouldn't be ANY

+                     * but some viruses insert them

+                     */

                     while ((t_line = t_line->t_next) != NULL)

                         if (t_line->t_line &&

                             /*(cli_chomp(t_line->t_text) > 0))*/

@@ -1943,12 +1943,12 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                     if (t_line == NULL) {

                         cli_dbgmsg("Empty part\n");

                         /*

-					 * Remove this part unless there's

-					 * a binhex portion somewhere in

-					 * the complete message that we may

-					 * throw away by mistake if the MIME

-					 * encoding information is incorrect

-					 */

+                         * Remove this part unless there's

+                         * a binhex portion somewhere in

+                         * the complete message that we may

+                         * throw away by mistake if the MIME

+                         * encoding information is incorrect

+                         */

                         if (mainMessage &&

                             (binhexBegin(mainMessage) == NULL)) {

                             messageDestroy(aMessage);

@@ -1960,9 +1960,11 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                     do {

                         const char *line = lineGetData(t_line->t_line);

-                        /*cli_dbgmsg("multipart %d: inMimeHead %d inhead %d boundary '%s' line '%s' next '%s'\n",

-						multiparts, inMimeHead, inhead, boundary, line,

-						t_line->t_next && t_line->t_next->t_line ? lineGetData(t_line->t_next->t_line) : "(null)");*/

+                        /*

+                        cli_dbgmsg("multipart %d: inMimeHead %d inhead %d boundary '%s' line '%s' next '%s'\n",

+                        multiparts, inMimeHead, inhead, boundary, line,

+                        t_line->t_next && t_line->t_next->t_line ? lineGetData(t_line->t_next->t_line) : "(null)");

+                        */

                         if (inMimeHead) { /* continuation line */

                             if (line == NULL) {

@@ -1970,20 +1972,20 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                                 continue;

                             }

                             /*

-						 * Handle continuation lines

-						 * because the previous line

-						 * ended with a ; or this line

-						 * starts with a white space

-						 */

+                             * Handle continuation lines

+                             * because the previous line

+                             * ended with a ; or this line

+                             * starts with a white space

+                             */

                             cli_dbgmsg("Multipart %d: About to add mime Argument '%s'\n",

                                        multiparts, line);

                             /*

-						 * Handle the case when it

-						 * isn't really a continuation

-						 * line:

-						 * Content-Type: application/octet-stream;

-						 * Content-Transfer-Encoding: base64

-						 */

+                             * Handle the case when it

+                             * isn't really a continuation

+                             * line:

+                             * Content-Type: application/octet-stream;

+                             * Content-Transfer-Encoding: base64

+                             */

                             parseEmailHeader(aMessage, line, mctx->rfc821Table, mctx->ctx, &heuristicFound);

                             if (heuristicFound) {

                                 rc = VIRUS;

@@ -2005,22 +2007,22 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                             if (line == NULL) {

                                 /*

-							 * empty line, should the end of the headers,

-							 * but some base64 decoders, e.g. uudeview, are broken

-							 * and will handle this type of entry, decoding the

-							 * base64 content...

-							 * Content-Type: application/octet-stream; name=text.zip

-							 * Content-Transfer-Encoding: base64

-							 * Content-Disposition: attachment; filename="text.zip"

-							 *

-							 * Content-Disposition: attachment;

-							 *	filename=text.zip

-							 * Content-Type: application/octet-stream;

-							 *	name=text.zip

-							 * Content-Transfer-Encoding: base64

-							 *

-							 * UEsDBAoAAAAAAACgPjJ2RHw676gAAO+oAABEAAAAbWFpbF90ZXh0LWluZm8udHh0ICAgICAgICAg

-							 */

+                                 * empty line, should the end of the headers,

+                                 * but some base64 decoders, e.g. uudeview, are broken

+                                 * and will handle this type of entry, decoding the

+                                 * base64 content...

+                                 * Content-Type: application/octet-stream; name=text.zip

+                                 * Content-Transfer-Encoding: base64

+                                 * Content-Disposition: attachment; filename="text.zip"

+                                 *

+                                 * Content-Disposition: attachment;

+                                 *    filename=text.zip

+                                 * Content-Type: application/octet-stream;

+                                 *    name=text.zip

+                                 * Content-Transfer-Encoding: base64

+                                 *

+                                 * UEsDBAoAAAAAAACgPjJ2RHw676gAAO+oAABEAAAAbWFpbF90ZXh0LWluZm8udHh0ICAgICAgICAg

+                                 */

                                 const text *next = t_line->t_next;

                                 if (next && next->t_line) {

@@ -2030,15 +2032,15 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                                         (messageGetMimeType(aMessage) == APPLICATION) &&

                                         data && strstr(data, "base64")) {

                                         /*

-									 * Handle this nightmare (note the blank

-									 * line in the header and the incorrect

-									 * content-transfer-encoding header)

-									 *

-									 * Content-Type: application/octet-stream; name="zipped_files.EXEX-Spanska: Yes

-									 *

-									 * r-Encoding: base64

-									 * Content-Disposition: attachment; filename="zipped_files.EXE"

-									 */

+                                         * Handle this nightmare (note the blank

+                                         * line in the header and the incorrect

+                                         * content-transfer-encoding header)

+                                         *

+                                         * Content-Type: application/octet-stream; name="zipped_files.EXEX-Spanska: Yes

+                                         *

+                                         * r-Encoding: base64

+                                         * Content-Disposition: attachment; filename="zipped_files.EXE"

+                                         */

                                         messageSetEncoding(aMessage, "base64");

                                         cli_dbgmsg("Ignoring fake end of headers\n");

                                         continue;

@@ -2056,25 +2058,25 @@ parseEmailBody(message *messageIn, text *textIn, mbox_ctx *mctx, unsigned int re

                             }

                             if (isspace((int)*line)) {

                                 /*

-							 * The first line is

-							 * continuation line.

-							 * This is tricky

-							 * to handle, but

-							 * all we can do is our