diff --git a/encfs/BlockFileIO.cpp b/encfs/BlockFileIO.cpp
index 0ce9501..ee9a835 100644
--- a/encfs/BlockFileIO.cpp
+++ b/encfs/BlockFileIO.cpp
@@ -70,11 +70,15 @@ ssize_t BlockFileIO::cacheReadOneBlock(const IORequest &req) const {
   if ((!_noCache) && (req.offset == _cache.offset) && (_cache.dataLen != 0)) {
     // satisfy request from cache
     int len = req.dataLen;
-    if (_cache.dataLen < len) len = _cache.dataLen;  // Don't read past EOF
+    if (_cache.dataLen < len) {
+      len = _cache.dataLen;  // Don't read past EOF
+    }
     memcpy(req.data, _cache.data, len);
     return len;
   }
-  if (_cache.dataLen > 0) clearCache(_cache, _blockSize);
+  if (_cache.dataLen > 0) {
+    clearCache(_cache, _blockSize);
+  }
 
   // cache results of read -- issue reads for full blocks
   IORequest tmp;
@@ -100,7 +104,9 @@ bool BlockFileIO::cacheWriteOneBlock(const IORequest &req) {
   _cache.offset = req.offset;
   _cache.dataLen = req.dataLen;
   bool ok = writeOneBlock(req);
-  if (!ok) clearCache(_cache, _blockSize);
+  if (!ok) {
+    clearCache(_cache, _blockSize);
+  }
   return ok;
 }
 
@@ -141,12 +147,16 @@ ssize_t BlockFileIO::read(const IORequest &req) const {
     if (partialOffset == 0 && size >= (size_t)_blockSize) {
       blockReq.data = out;
     } else {
-      if (mb.data == nullptr) mb = MemoryPool::allocate(_blockSize);
+      if (mb.data == nullptr) {
+        mb = MemoryPool::allocate(_blockSize);
+      }
       blockReq.data = mb.data;
     }
 
     ssize_t readSize = cacheReadOneBlock(blockReq);
-    if (readSize <= partialOffset) break;  // didn't get enough bytes
+    if (readSize <= partialOffset) {
+      break;  // didn't get enough bytes
+    }
 
     int cpySize = min((size_t)(readSize - partialOffset), size);
     CHECK(cpySize <= readSize);
@@ -162,10 +172,14 @@ ssize_t BlockFileIO::read(const IORequest &req) const {
     ++blockNum;
     partialOffset = 0;
 
-    if (readSize < _blockSize) break;
+    if (readSize < _blockSize) {
+      break;
+    }
   }
 
-  if (mb.data != nullptr) MemoryPool::release(mb);
+  if (mb.data != nullptr) {
+    MemoryPool::release(mb);
+  }
 
   return result;
 }
@@ -174,7 +188,9 @@ bool BlockFileIO::write(const IORequest &req) {
   CHECK(_blockSize != 0);
 
   off_t fileSize = getSize();
-  if (fileSize < 0) return false;
+  if (fileSize < 0) {
+    return false;
+  }
 
   // where write request begins
   off_t blockNum = req.offset / _blockSize;
@@ -185,7 +201,9 @@ bool BlockFileIO::write(const IORequest &req) {
   ssize_t lastBlockSize = fileSize % _blockSize;
 
   off_t lastNonEmptyBlock = lastFileBlock;
-  if (lastBlockSize == 0) --lastNonEmptyBlock;
+  if (lastBlockSize == 0) {
+    --lastNonEmptyBlock;
+  }
 
   if (req.offset > fileSize) {
     // extend file first to fill hole with 0's..
@@ -197,7 +215,9 @@ bool BlockFileIO::write(const IORequest &req) {
   // request as-is..
   if (partialOffset == 0 && req.dataLen <= _blockSize) {
     // if writing a full block.. pretty safe..
-    if (req.dataLen == _blockSize) return cacheWriteOneBlock(req);
+    if (req.dataLen == _blockSize) {
+      return cacheWriteOneBlock(req);
+    }
 
     // if writing a partial block, but at least as much as what is
     // already there..
@@ -230,7 +250,9 @@ bool BlockFileIO::write(const IORequest &req) {
     } else {
       // need a temporary buffer, since we have to either merge or pad
       // the data.
-      if (mb.data == nullptr) mb = MemoryPool::allocate(_blockSize);
+      if (mb.data == nullptr) {
+        mb = MemoryPool::allocate(_blockSize);
+      }
       memset(mb.data, 0, _blockSize);
       blockReq.data = mb.data;
 
@@ -264,7 +286,9 @@ bool BlockFileIO::write(const IORequest &req) {
     partialOffset = 0;
   }
 
-  if (mb.data != nullptr) MemoryPool::release(mb);
+  if (mb.data != nullptr) {
+    MemoryPool::release(mb);
+  }
 
   return ok;
 }
@@ -340,7 +364,9 @@ void BlockFileIO::padFile(off_t oldSize, off_t newSize, bool forceWrite) {
     }
   }
 
-  if (mb.data != nullptr) MemoryPool::release(mb);
+  if (mb.data != nullptr) {
+    MemoryPool::release(mb);
+  }
 }
 
 int BlockFileIO::truncateBase(off_t size, FileIO *base) {
@@ -354,7 +380,9 @@ int BlockFileIO::truncateBase(off_t size, FileIO *base) {
     // states that it will pad with 0's.
     // do the truncate so that the underlying filesystem can allocate
     // the space, and then we'll fill it in padFile..
-    if (base != nullptr) base->truncate(size);
+    if (base != nullptr) {
+      base->truncate(size);
+    }
 
     const bool forceWrite = true;
     padFile(oldSize, size, forceWrite);
@@ -375,7 +403,9 @@ int BlockFileIO::truncateBase(off_t size, FileIO *base) {
     ssize_t rdSz = cacheReadOneBlock(req);
 
     // do the truncate
-    if (base != nullptr) res = base->truncate(size);
+    if (base != nullptr) {
+      res = base->truncate(size);
+    }
 
     // write back out partial block
     req.dataLen = partialBlock;
@@ -391,7 +421,9 @@ int BlockFileIO::truncateBase(off_t size, FileIO *base) {
   } else {
     // truncating on a block bounday.  No need to re-encode the last
     // block..
-    if (base != nullptr) res = base->truncate(size);
+    if (base != nullptr) {
+      res = base->truncate(size);
+    }
   }
 
   return res;
diff --git a/encfs/BlockNameIO.cpp b/encfs/BlockNameIO.cpp
index 1f432a6..3a25016 100644
--- a/encfs/BlockNameIO.cpp
+++ b/encfs/BlockNameIO.cpp
@@ -39,7 +39,9 @@ static std::shared_ptr<NameIO> NewBlockNameIO(
     const Interface &iface, const std::shared_ptr<Cipher> &cipher,
     const CipherKey &key) {
   int blockSize = 8;
-  if (cipher) blockSize = cipher->cipherBlockSize();
+  if (cipher) {
+    blockSize = cipher->cipherBlockSize();
+  }
 
   return std::shared_ptr<NameIO>(
       new BlockNameIO(iface, cipher, key, blockSize, false));
@@ -49,7 +51,9 @@ static std::shared_ptr<NameIO> NewBlockNameIO32(
     const Interface &iface, const std::shared_ptr<Cipher> &cipher,
     const CipherKey &key) {
   int blockSize = 8;
-  if (cipher) blockSize = cipher->cipherBlockSize();
+  if (cipher) {
+    blockSize = cipher->cipherBlockSize();
+  }
 
   return std::shared_ptr<NameIO>(
       new BlockNameIO(iface, cipher, key, blockSize, true));
@@ -135,7 +139,9 @@ int BlockNameIO::encodeName(const char *plaintextName, int length, uint64_t *iv,
 
   // Pad encryption buffer to block boundary..
   int padding = _bs - length % _bs;
-  if (padding == 0) padding = _bs;  // padding a full extra block!
+  if (padding == 0) {
+    padding = _bs;  // padding a full extra block!
+  }
 
   rAssert(bufferLength >= length + 2 + padding);
   memset(encodedName + length + 2, (unsigned char)padding, padding);
@@ -145,7 +151,9 @@ int BlockNameIO::encodeName(const char *plaintextName, int length, uint64_t *iv,
 
   // store the IV before it is modified by the MAC call.
   uint64_t tmpIV = 0;
-  if ((iv != nullptr) && _interface >= 3) tmpIV = *iv;
+  if ((iv != nullptr) && _interface >= 3) {
+    tmpIV = *iv;
+  }
 
   // include padding in MAC computation
   unsigned int mac = _cipher->MAC_16((unsigned char *)encodedName + 2,
@@ -207,7 +215,9 @@ int BlockNameIO::decodeName(const char *encodedName, int length, uint64_t *iv,
                      ((unsigned int)((unsigned char)tmpBuf[1]));
 
   uint64_t tmpIV = 0;
-  if ((iv != nullptr) && _interface >= 3) tmpIV = *iv;
+  if ((iv != nullptr) && _interface >= 3) {
+    tmpIV = *iv;
+  }
 
   _cipher->blockDecode((unsigned char *)tmpBuf + 2, decodedStreamLen,
                        (uint64_t)mac ^ tmpIV, _key);
diff --git a/encfs/Cipher.cpp b/encfs/Cipher.cpp
index 1791459..bbe43cf 100644
--- a/encfs/Cipher.cpp
+++ b/encfs/Cipher.cpp
@@ -65,7 +65,9 @@ std::list<Cipher::CipherAlgorithm> Cipher::GetAlgorithmList(
 
   list<CipherAlgorithm> result;
 
-  if (gCipherMap == nullptr) return result;
+  if (gCipherMap == nullptr) {
+    return result;
+  }
 
   CipherMap_t::const_iterator it;
   CipherMap_t::const_iterator mapEnd = gCipherMap->end();
@@ -98,7 +100,9 @@ bool Cipher::Register(const char *name, const char *description,
                       const Interface &iface, const Range &keyLength,
                       const Range &blockSize, CipherConstructor fn,
                       bool hidden) {
-  if (gCipherMap == nullptr) gCipherMap = new CipherMap_t;
+  if (gCipherMap == nullptr) {
+    gCipherMap = new CipherMap_t;
+  }
 
   CipherAlg ca;
   ca.hidden = hidden;
diff --git a/encfs/CipherFileIO.cpp b/encfs/CipherFileIO.cpp
index 079eae9..e825b6e 100644
--- a/encfs/CipherFileIO.cpp
+++ b/encfs/CipherFileIO.cpp
@@ -71,7 +71,9 @@ Interface CipherFileIO::interface() const { return CipherFileIO_iface; }
 int CipherFileIO::open(int flags) {
   int res = base->open(flags);
 
-  if (res >= 0) lastFlags = flags;
+  if (res >= 0) {
+    lastFlags = flags;
+  }
 
   return res;
 }
@@ -188,7 +190,9 @@ void CipherFileIO::initHeader() {
     cipher->streamDecode(buf, sizeof(buf), externalIV, key);
 
     fileIV = 0;
-    for (int i = 0; i < 8; ++i) fileIV = (fileIV << 8) | (uint64_t)buf[i];
+    for (int i = 0; i < 8; ++i) {
+      fileIV = (fileIV << 8) | (uint64_t)buf[i];
+    }
 
     rAssert(fileIV != 0);  // 0 is never used..
   } else {
@@ -201,7 +205,9 @@ void CipherFileIO::initHeader() {
       }
 
       fileIV = 0;
-      for (int i = 0; i < 8; ++i) fileIV = (fileIV << 8) | (uint64_t)buf[i];
+      for (int i = 0; i < 8; ++i) {
+        fileIV = (fileIV << 8) | (uint64_t)buf[i];
+      }
 
       if (fileIV == 0) {
         RLOG(WARNING) << "Unexpected result: randomize returned 8 null bytes!";
@@ -360,7 +366,9 @@ bool CipherFileIO::writeOneBlock(const IORequest &req) {
   int bs = blockSize();
   off_t blockNum = req.offset / bs;
 
-  if (haveHeader && fileIV == 0) initHeader();
+  if (haveHeader && fileIV == 0) {
+    initHeader();
+  }
 
   bool ok;
   if (req.dataLen != bs) {
@@ -411,7 +419,9 @@ bool CipherFileIO::blockRead(unsigned char *buf, int size,
   if (_allowHoles) {
     // special case - leave all 0's alone
     for (int i = 0; i < size; ++i) {
-      if (buf[i] != 0) return cipher->blockDecode(buf, size, _iv64, key);
+      if (buf[i] != 0) {
+        return cipher->blockDecode(buf, size, _iv64, key);
+      }
     }
 
     return true;
@@ -448,7 +458,9 @@ int CipherFileIO::truncate(off_t size) {
     // the wrong size..
     res = BlockFileIO::truncateBase(size, nullptr);
 
-    if (res == 0) base->truncate(size + HEADER_SIZE);
+    if (res == 0) {
+      base->truncate(size + HEADER_SIZE);
+    }
   }
   return res;
 }
@@ -497,7 +509,9 @@ ssize_t CipherFileIO::read(const IORequest &origReq) const {
     memcpy(req.data, &headerBuf[headerOffset], headerBytes);
 
     // the read does not want data beyond the header
-    if (headerBytes == req.dataLen) return headerBytes;
+    if (headerBytes == req.dataLen) {
+      return headerBytes;
+    }
 
     /* The rest of the request will be read from the backing file.
      * As we have already generated n=headerBytes bytes, the request is
diff --git a/encfs/ConfigReader.cpp b/encfs/ConfigReader.cpp
index dfbf544..8e2fd1a 100644
--- a/encfs/ConfigReader.cpp
+++ b/encfs/ConfigReader.cpp
@@ -42,12 +42,16 @@ ConfigReader::~ConfigReader() = default;
 bool ConfigReader::load(const char *fileName) {
   struct stat stbuf;
   memset(&stbuf, 0, sizeof(struct stat));
-  if (lstat(fileName, &stbuf) != 0) return false;
+  if (lstat(fileName, &stbuf) != 0) {
+    return false;
+  }
 
   int size = stbuf.st_size;
 
   int fd = open(fileName, O_RDONLY);
-  if (fd < 0) return false;
+  if (fd < 0) {
+    return false;
+  }
 
   auto *buf = new char[size];
 
diff --git a/encfs/ConfigVar.cpp b/encfs/ConfigVar.cpp
index 19ed71c..b9dceef 100644
--- a/encfs/ConfigVar.cpp
+++ b/encfs/ConfigVar.cpp
@@ -56,7 +56,9 @@ void ConfigVar::resetOffset() { pd->offset = 0; }
 int ConfigVar::read(unsigned char *buffer_, int bytes) const {
   int toCopy = MIN(bytes, pd->buffer.size() - pd->offset);
 
-  if (toCopy > 0) memcpy(buffer_, pd->buffer.data() + pd->offset, toCopy);
+  if (toCopy > 0) {
+    memcpy(buffer_, pd->buffer.data() + pd->offset, toCopy);
+  }
 
   pd->offset += toCopy;
 
@@ -106,7 +108,9 @@ void ConfigVar::writeInt(int val) {
   // find the starting point - we only need to output starting at the most
   // significant non-zero digit..
   int start = 0;
-  while (digit[start] == 0x80) ++start;
+  while (digit[start] == 0x80) {
+    ++start;
+  }
 
   write(digit + start, 5 - start);
 }
diff --git a/encfs/Context.cpp b/encfs/Context.cpp
index c6bf276..16ec724 100644
--- a/encfs/Context.cpp
+++ b/encfs/Context.cpp
@@ -70,7 +70,9 @@ void EncFS_Context::setRoot(const std::shared_ptr<DirNode> &r) {
   Lock lock(contextMutex);
 
   root = r;
-  if (r) rootCipherDir = r->rootDirectory();
+  if (r) {
+    rootCipherDir = r->rootDirectory();
+  }
 }
 
 bool EncFS_Context::isMounted() { return root.get() != nullptr; }
diff --git a/encfs/DirNode.cpp b/encfs/DirNode.cpp
index 1e82d76..1c0f78c 100644
--- a/encfs/DirNode.cpp
+++ b/encfs/DirNode.cpp
@@ -79,10 +79,14 @@ static bool _nextName(struct dirent *&de, const std::shared_ptr<DIR> &dir,
       *fileType = 0;
 #endif
     }
-    if (inode != nullptr) *inode = de->d_ino;
+    if (inode != nullptr) {
+      *inode = de->d_ino;
+    }
     return true;
   }
-  if (fileType != nullptr) *fileType = 0;
+  if (fileType != nullptr) {
+    *fileType = 0;
+  }
   return false;
 }
 
@@ -356,7 +360,9 @@ DirTraverse DirNode::openDir(const char *plaintextPath) {
   // if we're using chained IV mode, then compute the IV at this
   // directory level..
   try {
-    if (naming->getChainedNameIV()) naming->encodePath(plaintextPath, &iv);
+    if (naming->getChainedNameIV()) {
+      naming->encodePath(plaintextPath, &iv);
+    }
   } catch (encfs::Error &err) {
     RLOG(ERROR) << "encode err: " << err.what();
   }
@@ -375,13 +381,17 @@ bool DirNode::genRenameList(list<RenameEl> &renameList, const char *fromP,
   string sourcePath = rootDir + fromCPart;
 
   // ok..... we wish it was so simple.. should almost never happen
-  if (fromIV == toIV) return true;
+  if (fromIV == toIV) {
+    return true;
+  }
 
   // generate the real destination path, where we expect to find the files..
   VLOG(1) << "opendir " << sourcePath;
   std::shared_ptr<DIR> dir =
       std::shared_ptr<DIR>(opendir(sourcePath.c_str()), DirDeleter());
-  if (!dir) return false;
+  if (!dir) {
+    return false;
+  }
 
   struct dirent *de = nullptr;
   while ((de = ::readdir(dir.get())) != nullptr) {
@@ -489,13 +499,21 @@ int DirNode::mkdir(const char *plaintextPath, mode_t mode, uid_t uid,
   // if uid or gid are set, then that should be the directory owner
   int olduid = -1;
   int oldgid = -1;
-  if (uid != 0) olduid = setfsuid(uid);
-  if (gid != 0) oldgid = setfsgid(gid);
+  if (uid != 0) {
+    olduid = setfsuid(uid);
+  }
+  if (gid != 0) {
+    oldgid = setfsgid(gid);
+  }
 
   int res = ::mkdir(cyName.c_str(), mode);
 
-  if (olduid >= 0) setfsuid(olduid);
-  if (oldgid >= 0) setfsgid(oldgid);
+  if (olduid >= 0) {
+    setfsuid(olduid);
+  }
+  if (oldgid >= 0) {
+    setfsgid(oldgid);
+  }
 
   if (res == -1) {
     int eno = errno;
@@ -527,7 +545,9 @@ int DirNode::rename(const char *fromPlaintext, const char *toPlaintext) {
     renameOp = newRenameOp(fromPlaintext, toPlaintext);
 
     if (!renameOp || !renameOp->apply()) {
-      if (renameOp) renameOp->undo();
+      if (renameOp) {
+        renameOp->undo();
+      }
 
       RLOG(WARNING) << "rename aborted";
       return -EACCES;
@@ -548,7 +568,9 @@ int DirNode::rename(const char *fromPlaintext, const char *toPlaintext) {
       res = -errno;
       renameNode(toPlaintext, fromPlaintext, false);
 
-      if (renameOp) renameOp->undo();
+      if (renameOp) {
+        renameOp->undo();
+      }
     } else if (preserve_mtime) {
       struct utimbuf ut;
       ut.actime = st.st_atime;
@@ -616,7 +638,9 @@ std::shared_ptr<FileNode> DirNode::renameNode(const char *from, const char *to,
             << cname;
 
     if (node->setName(to, cname.c_str(), newIV, forwardMode)) {
-      if (ctx != nullptr) ctx->renameNode(from, to);
+      if (ctx != nullptr) {
+        ctx->renameNode(from, to);
+      }
     } else {
       // rename error! - put it back
       RLOG(ERROR) << "renameNode failed";
@@ -633,7 +657,9 @@ std::shared_ptr<FileNode> DirNode::findOrCreate(const char *plainName) {
   std::shared_ptr<FileNode> node;
 
   // See if we already have a FileNode for this path.
-  if (ctx != nullptr) node = ctx->lookupNode(plainName);
+  if (ctx != nullptr) {
+    node = ctx->lookupNode(plainName);
+  }
 
   // If we don't, create a new one.
   if (!node) {
diff --git a/encfs/FileNode.cpp b/encfs/FileNode.cpp
index 0aa3d51..4ae65a7 100644
--- a/encfs/FileNode.cpp
+++ b/encfs/FileNode.cpp
@@ -109,13 +109,19 @@ static bool setIV(const std::shared_ptr<FileIO> &io, uint64_t iv) {
 bool FileNode::setName(const char *plaintextName_, const char *cipherName_,
                        uint64_t iv, bool setIVFirst) {
   // Lock _lock( mutex );
-  if (cipherName_ != nullptr) VLOG(1) << "calling setIV on " << cipherName_;
+  if (cipherName_ != nullptr) {
+    VLOG(1) << "calling setIV on " << cipherName_;
+  }
 
   if (setIVFirst) {
-    if (fsConfig->config->externalIVChaining && !setIV(io, iv)) return false;
+    if (fsConfig->config->externalIVChaining && !setIV(io, iv)) {
+      return false;
+    }
 
     // now change the name..
-    if (plaintextName_ != nullptr) this->_pname = plaintextName_;
+    if (plaintextName_ != nullptr) {
+      this->_pname = plaintextName_;
+    }
     if (cipherName_ != nullptr) {
       this->_cname = cipherName_;
       io->setFileName(cipherName_);
@@ -124,7 +130,9 @@ bool FileNode::setName(const char *plaintextName_, const char *cipherName_,
     std::string oldPName = _pname;
     std::string oldCName = _cname;
 
-    if (plaintextName_ != nullptr) this->_pname = plaintextName_;
+    if (plaintextName_ != nullptr) {
+      this->_pname = plaintextName_;
+    }
     if (cipherName_ != nullptr) {
       this->_cname = cipherName_;
       io->setFileName(cipherName_);
@@ -168,15 +176,21 @@ int FileNode::mknod(mode_t mode, dev_t rdev, uid_t uid, gid_t gid) {
    */
   if (S_ISREG(mode)) {
     res = ::open(_cname.c_str(), O_CREAT | O_EXCL | O_WRONLY, mode);
-    if (res >= 0) res = ::close(res);
+    if (res >= 0) {
+      res = ::close(res);
+    }
   } else if (S_ISFIFO(mode)) {
     res = ::mkfifo(_cname.c_str(), mode);
   } else {
     res = ::mknod(_cname.c_str(), mode, rdev);
   }
 
-  if (olduid >= 0) setfsuid(olduid);
-  if (oldgid >= 0) setfsgid(oldgid);
+  if (olduid >= 0) {
+    setfsuid(olduid);
+  }
+  if (oldgid >= 0) {
+    setfsgid(oldgid);
+  }
 
   if (res == -1) {
     int eno = errno;
@@ -257,7 +271,9 @@ int FileNode::sync(bool datasync) {
     res = fsync(fh);
 #endif
 
-    if (res == -1) res = -errno;
+    if (res == -1) {
+      res = -errno;
+    }
 
     return res;
   }
diff --git a/encfs/FileUtils.cpp b/encfs/FileUtils.cpp
index bffac1a..4e67ac9 100644
--- a/encfs/FileUtils.cpp
+++ b/encfs/FileUtils.cpp
@@ -450,7 +450,9 @@ bool saveConfig(ConfigType type, const string &rootDir,
       if (nm->environmentOverride != nullptr) {
         // use environment file if specified..
         const char *envFile = getenv(nm->environmentOverride);
-        if (envFile != nullptr) path.assign(envFile);
+        if (envFile != nullptr) {
+          path.assign(envFile);
+        }
       }
 
       try {
@@ -739,13 +741,17 @@ static int selectKeySize(const Cipher::CipherAlgorithm &alg) {
   if (numAvail < 5) {
     // show them all
     for (int i = 0; i <= numAvail; ++i) {
-      if (i != 0) cout << ", ";
+      if (i != 0) {
+        cout << ", ";
+      }
       cout << alg.keyLength.min() + i * alg.keyLength.inc();
     }
   } else {
     // partial
     for (int i = 0; i < 3; ++i) {
-      if (i != 0) cout << ", ";
+      if (i != 0) {
+        cout << ", ";
+      }
       cout << alg.keyLength.min() + i * alg.keyLength.inc();
     }
     cout << " ... " << alg.keyLength.max() - alg.keyLength.inc();
@@ -902,8 +908,12 @@ static void selectBlockMAC(int *macBytes, int *macRandBytes, bool forceMac) {
   cout << "\n";
 
   randSize = (res == nullptr ? 0 : atoi(answer));
-  if (randSize < 0) randSize = 0;
-  if (randSize > 8) randSize = 8;
+  if (randSize < 0) {
+    randSize = 0;
+  }
+  if (randSize > 8) {
+    randSize = 8;
+  }
 
   *macRandBytes = randSize;
 }
@@ -984,7 +994,9 @@ RootPtr createV6Config(EncFS_Context *ctx,
         " anything else, or an empty line will select standard mode.\n"
         "?> ");
 
-    if (annotate) cerr << "$PROMPT$ config_option" << endl;
+    if (annotate) {
+      cerr << "$PROMPT$ config_option" << endl;
+    }
 
     char *res = fgets(answer, sizeof(answer), stdin);
     (void)res;
@@ -1063,7 +1075,9 @@ RootPtr createV6Config(EncFS_Context *ctx,
       /* Reverse mounts are read-only by default (set in main.cpp).
        * If uniqueIV is off, writing can be allowed, because there
        * is no header that could be overwritten */
-      if (!uniqueIV) opts->readOnly = false;
+      if (!uniqueIV) {
+        opts->readOnly = false;
+      }
     }
   }
 
@@ -1091,7 +1105,9 @@ RootPtr createV6Config(EncFS_Context *ctx,
       /* Reverse mounts are read-only by default (set in main.cpp).
        * If uniqueIV is off, writing can be allowed, because there
        * is no header that could be overwritten */
-      if (!uniqueIV) opts->readOnly = false;
+      if (!uniqueIV) {
+        opts->readOnly = false;
+      }
     } else {
       chainedIV = selectChainedIV();
       uniqueIV = selectUniqueIV(true);
@@ -1175,7 +1191,9 @@ RootPtr createV6Config(EncFS_Context *ctx,
   CipherKey userKey;
   VLOG(1) << "useStdin: " << useStdin;
   if (useStdin) {
-    if (annotate) cerr << "$PROMPT$ new_passwd" << endl;
+    if (annotate) {
+      cerr << "$PROMPT$ new_passwd" << endl;
+    }
     userKey = config->getUserKey(useStdin);
   } else if (!passwordProgram.empty()) {
     userKey = config->getUserKey(passwordProgram, rootDir);
@@ -1573,7 +1591,9 @@ RootPtr initFS(EncFS_Context *ctx, const std::shared_ptr<EncFS_Opts> &opts) {
       /* Reverse mounts are read-only by default (set in main.cpp).
        * If uniqueIV is off, writing can be allowed, because there
        * is no header that could be overwritten */
-      if (!config->uniqueIV) opts->readOnly = false;
+      if (!config->uniqueIV) {
+        opts->readOnly = false;
+      }
     }
 
     // first, instanciate the cipher.
@@ -1600,13 +1620,17 @@ RootPtr initFS(EncFS_Context *ctx, const std::shared_ptr<EncFS_Opts> &opts) {
 
     if (opts->passwordProgram.empty()) {
       VLOG(1) << "useStdin: " << opts->useStdin;
-      if (opts->annotate) cerr << "$PROMPT$ passwd" << endl;
+      if (opts->annotate) {
+        cerr << "$PROMPT$ passwd" << endl;
+      }
       userKey = config->getUserKey(opts->useStdin);
     } else {
       userKey = config->getUserKey(opts->passwordProgram, opts->rootDir);
     }
 
-    if (!userKey) return rootInfo;
+    if (!userKey) {
+      return rootInfo;
+    }
 
     VLOG(1) << "cipher key size = " << cipher->encodedKeySize();
     // decode volume key..
diff --git a/encfs/Interface.cpp b/encfs/Interface.cpp
index 0d7a563..86111ab 100644
--- a/encfs/Interface.cpp
+++ b/encfs/Interface.cpp
@@ -108,7 +108,9 @@ bool Interface::implements(const Interface &B) const {
           << ":" << age() << ") implements " << B.name() << "(" << B.current()
           << ":" << B.revision() << ")";
 
-  if (name() != B.name()) return false;
+  if (name() != B.name()) {
+    return false;
+  }
 
   int currentDiff = current() - B.current();
   return (currentDiff >= 0 && currentDiff <= age());
diff --git a/encfs/MACFileIO.cpp b/encfs/MACFileIO.cpp
index 4e2e350..bc03605 100644
--- a/encfs/MACFileIO.cpp
+++ b/encfs/MACFileIO.cpp
@@ -137,7 +137,9 @@ off_t MACFileIO::getSize() const {
   int bs = blockSize() + headerSize;
 
   off_t size = base->getSize();
-  if (size > 0) size = locWithoutHeader(size, bs, headerSize);
+  if (size > 0) {
+    size = locWithoutHeader(size, bs, headerSize);
+  }
 
   return size;
 }
@@ -202,7 +204,9 @@ ssize_t MACFileIO::readOneBlock(const IORequest &req) const {
     memcpy(req.data, tmp.data + headerSize, readSize);
   } else {
     VLOG(1) << "readSize " << readSize << " at offset " << req.offset;
-    if (readSize > 0) readSize = 0;
+    if (readSize > 0) {
+      readSize = 0;
+    }
   }
 
   MemoryPool::release(mb);
@@ -256,7 +260,9 @@ int MACFileIO::truncate(off_t size) {
 
   int res = BlockFileIO::truncateBase(size, nullptr);
 
-  if (res == 0) base->truncate(locWithHeader(size, bs, headerSize));
+  if (res == 0) {
+    base->truncate(locWithHeader(size, bs, headerSize));
+  }
 
   return res;
 }
diff --git a/encfs/MemoryPool.cpp b/encfs/MemoryPool.cpp
index b76b212..ff28056 100644
--- a/encfs/MemoryPool.cpp
+++ b/encfs/MemoryPool.cpp
@@ -84,7 +84,9 @@ MemBlock MemoryPool::allocate(int size) {
   }
   pthread_mutex_unlock(&gMPoolMutex);
 
-  if (block == nullptr) block = allocBlock(size);
+  if (block == nullptr) {
+    block = allocBlock(size);
+  }
   block->next = nullptr;
 
   MemBlock result;
diff --git a/encfs/NameIO.cpp b/encfs/NameIO.cpp
index 98d2f2b..2d9582f 100644
--- a/encfs/NameIO.cpp
+++ b/encfs/NameIO.cpp
@@ -83,7 +83,9 @@ list<NameIO::Algorithm> NameIO::GetAlgorithmList(bool includeHidden) {
 bool NameIO::Register(const char *name, const char *description,
                       const Interface &iface, Constructor constructor,
                       bool hidden) {
-  if (gNameIOMap == nullptr) gNameIOMap = new NameIOMap_t;
+  if (gNameIOMap == nullptr) {
+    gNameIOMap = new NameIOMap_t;
+  }
 
   NameIOAlg alg;
   alg.hidden = hidden;
@@ -163,7 +165,9 @@ std::string NameIO::recodePath(
 
       // figure out buffer sizes
       int approxLen = (this->*_length)(len);
-      if (approxLen <= 0) throw Error("Filename too small to decode");
+      if (approxLen <= 0) {
+        throw Error("Filename too small to decode");
+      }
       int bufSize = 0;
 
       BUFFER_INIT_S(codeBuf, 32, (unsigned int)approxLen + 1, bufSize)
@@ -196,14 +200,18 @@ std::string NameIO::decodePath(const char *cipherPath) const {
 
 std::string NameIO::_encodePath(const char *plaintextPath, uint64_t *iv) const {
   // if chaining is not enabled, then the iv pointer is not used..
-  if (!chainedNameIV) iv = nullptr;
+  if (!chainedNameIV) {
+    iv = nullptr;
+  }
   return recodePath(plaintextPath, &NameIO::maxEncodedNameLen,
                     &NameIO::encodeName, iv);
 }
 
 std::string NameIO::_decodePath(const char *cipherPath, uint64_t *iv) const {
   // if chaining is not enabled, then the iv pointer is not used..
-  if (!chainedNameIV) iv = nullptr;
+  if (!chainedNameIV) {
+    iv = nullptr;
+  }
   return recodePath(cipherPath, &NameIO::maxDecodedNameLen, &NameIO::decodeName,
                     iv);
 }
diff --git a/encfs/RawFileIO.cpp b/encfs/RawFileIO.cpp
index 845ab8b..b8dae9a 100644
--- a/encfs/RawFileIO.cpp
+++ b/encfs/RawFileIO.cpp
@@ -69,9 +69,13 @@ RawFileIO::~RawFileIO() {
   swap(_fd, fd);
   swap(_oldfd, oldfd);
 
-  if (_oldfd != -1) close(_oldfd);
+  if (_oldfd != -1) {
+    close(_oldfd);
+  }
 
-  if (_fd != -1) close(_fd);
+  if (_fd != -1) {
+    close(_fd);
+  }
 }
 
 Interface RawFileIO::interface() const { return RawFileIO_iface; }
@@ -126,7 +130,9 @@ int RawFileIO::open(int flags) {
     int finalFlags = requestWrite ? O_RDWR : O_RDONLY;
 
 #if defined(O_LARGEFILE)
-    if ((flags & O_LARGEFILE) != 0) finalFlags |= O_LARGEFILE;
+    if ((flags & O_LARGEFILE) != 0) {
+      finalFlags |= O_LARGEFILE;
+    }
 #else
 #warning O_LARGEFILE not supported
 #endif
@@ -238,7 +244,9 @@ bool RawFileIO::write(const IORequest &req) {
   }
   if (knownSize) {
     off_t last = req.offset + req.dataLen;
-    if (last > fileSize) fileSize = last;
+    if (last > fileSize) {
+      fileSize = last;
+    }
   }
 
   return true;
diff --git a/encfs/SSL_Cipher.cpp b/encfs/SSL_Cipher.cpp
index b23da1a..f2b86a8 100644
--- a/encfs/SSL_Cipher.cpp
+++ b/encfs/SSL_Cipher.cpp
@@ -81,7 +81,9 @@ int BytesToKey(int keyLen, int ivLen, const EVP_MD *md,
 
   for (;;) {
     EVP_DigestInit_ex(cx, md, nullptr);
-    if ((addmd++) != 0) EVP_DigestUpdate(cx, mdBuf, mds);
+    if ((addmd++) != 0) {
+      EVP_DigestUpdate(cx, mdBuf, mds);
+    }
     EVP_DigestUpdate(cx, data, dataLen);
     EVP_DigestFinal_ex(cx, mdBuf, &mds);
 
@@ -106,7 +108,9 @@ int BytesToKey(int keyLen, int ivLen, const EVP_MD *md,
       niv -= toCopy;
       offset += toCopy;
     }
-    if ((nkey == 0) && (niv == 0)) break;
+    if ((nkey == 0) && (niv == 0)) {
+      break;
+    }
   }
   EVP_MD_CTX_free(cx);
   OPENSSL_cleanse(mdBuf, sizeof(mdBuf));
@@ -130,7 +134,9 @@ int TimedPBKDF2(const char *pass, int passlen, const unsigned char *salt,
     int res =
         PKCS5_PBKDF2_HMAC_SHA1(pass, passlen, const_cast<unsigned char *>(salt),
                                saltlen, iter, keylen, out);
-    if (res != 1) return -1;
+    if (res != 1) {
+      return -1;
+    }
 
     gettimeofday(&end, nullptr);
 
@@ -162,7 +168,9 @@ static Range BFKeyRange(128, 256, 32);
 static Range BFBlockRange(64, 4096, 8);
 
 static std::shared_ptr<Cipher> NewBFCipher(const Interface &iface, int keyLen) {
-  if (keyLen <= 0) keyLen = 160;
+  if (keyLen <= 0) {
+    keyLen = 160;
+  }
 
   keyLen = BFKeyRange.closest(keyLen);
 
@@ -187,7 +195,9 @@ static Range AESBlockRange(64, 4096, 16);
 
 static std::shared_ptr<Cipher> NewAESCipher(const Interface &iface,
                                             int keyLen) {
-  if (keyLen <= 0) keyLen = 192;
+  if (keyLen <= 0) {
+    keyLen = 192;
+  }
 
   keyLen = AESKeyRange.closest(keyLen);
 
@@ -485,7 +495,9 @@ static uint64_t _checksum_64(SSLKey *key, const unsigned char *data,
   }
 
   auto value = (uint64_t)h[0];
-  for (int i = 1; i < 8; ++i) value = (value << 8) | (uint64_t)h[i];
+  for (int i = 1; i < 8; ++i) {
+    value = (value << 8) | (uint64_t)h[i];
+  }
 
   return value;
 }
@@ -519,7 +531,9 @@ uint64_t SSL_Cipher::MAC_64(const unsigned char *data, int len,
   std::shared_ptr<SSLKey> mk = dynamic_pointer_cast<SSLKey>(key);
   uint64_t tmp = _checksum_64(mk.get(), data, len, chainedIV);
 
-  if (chainedIV != nullptr) *chainedIV = tmp;
+  if (chainedIV != nullptr) {
+    *chainedIV = tmp;
+  }
 
   return tmp;
 }
@@ -702,7 +716,9 @@ static void flipBytes(unsigned char *buf, int size) {
   while (bytesLeft != 0) {
     int toFlip = MIN(sizeof(revBuf), bytesLeft);
 
-    for (int i = 0; i < toFlip; ++i) revBuf[i] = buf[toFlip - (i + 1)];
+    for (int i = 0; i < toFlip; ++i) {
+      revBuf[i] = buf[toFlip - (i + 1)];
+    }
 
     memcpy(buf, revBuf, toFlip);
     bytesLeft -= toFlip;
@@ -712,11 +728,15 @@ static void flipBytes(unsigned char *buf, int size) {
 }
 
 static void shuffleBytes(unsigned char *buf, int size) {
-  for (int i = 0; i < size - 1; ++i) buf[i + 1] ^= buf[i];
+  for (int i = 0; i < size - 1; ++i) {
+    buf[i + 1] ^= buf[i];
+  }
 }
 
 static void unshuffleBytes(unsigned char *buf, int size) {
-  for (int i = size - 1; i != 0; --i) buf[i] ^= buf[i - 1];
+  for (int i = size - 1; i != 0; --i) {
+    buf[i] ^= buf[i - 1];
+  }
 }
 
 /** Partial blocks are encoded with a stream cipher.  We make multiple passes on
diff --git a/encfs/StreamNameIO.cpp b/encfs/StreamNameIO.cpp
index a2b1649..682d32b 100644
--- a/encfs/StreamNameIO.cpp
+++ b/encfs/StreamNameIO.cpp
@@ -96,7 +96,9 @@ int StreamNameIO::encodeName(const char *plaintextName, int length,
                              uint64_t *iv, char *encodedName,
                              int bufferLength) const {
   uint64_t tmpIV = 0;
-  if ((iv != nullptr) && _interface >= 2) tmpIV = *iv;
+  if ((iv != nullptr) && _interface >= 2) {
+    tmpIV = *iv;
+  }
 
   unsigned int mac =
       _cipher->MAC_16((const unsigned char *)plaintextName, length, _key, iv);
@@ -137,7 +139,9 @@ int StreamNameIO::decodeName(const char *encodedName, int length, uint64_t *iv,
   int decodedStreamLen = decLen256 - 2;
   rAssert(decodedStreamLen <= bufferLength);
 
-  if (decodedStreamLen <= 0) throw Error("Filename too small to decode");
+  if (decodedStreamLen <= 0) {
+    throw Error("Filename too small to decode");
+  }
 
   BUFFER_INIT(tmpBuf, 32, (unsigned int)length);
 
@@ -155,7 +159,9 @@ int StreamNameIO::decodeName(const char *encodedName, int length, uint64_t *iv,
           ((unsigned int)((unsigned char)tmpBuf[1]));
 
     // version 2 adds support for IV chaining..
-    if ((iv != nullptr) && _interface >= 2) tmpIV = *iv;
+    if ((iv != nullptr) && _interface >= 2) {
+      tmpIV = *iv;
+    }
 
     memcpy(plaintextName, tmpBuf + 2, decodedStreamLen);
   } else {
diff --git a/encfs/XmlReader.cpp b/encfs/XmlReader.cpp
index e914e2f..1e4cd20 100644
--- a/encfs/XmlReader.cpp
+++ b/encfs/XmlReader.cpp
@@ -46,7 +46,9 @@ XmlValuePtr XmlValue::find(const char *path) const {
 
 bool XmlValue::read(const char *path, std::string *out) const {
   XmlValuePtr value = find(path);
-  if (!value) return false;
+  if (!value) {
+    return false;
+  }
 
   *out = value->text();
   return true;
@@ -54,7 +56,9 @@ bool XmlValue::read(const char *path, std::string *out) const {
 
 bool XmlValue::read(const char *path, int *out) const {
   XmlValuePtr value = find(path);
-  if (!value) return false;
+  if (!value) {
+    return false;
+  }
 
   *out = atoi(value->text().c_str());
   return true;
@@ -62,7 +66,9 @@ bool XmlValue::read(const char *path, int *out) const {
 
 bool XmlValue::read(const char *path, long *out) const {
   XmlValuePtr value = find(path);
-  if (!value) return false;
+  if (!value) {
+    return false;
+  }
 
   *out = atol(value->text().c_str());
   return true;
@@ -70,7 +76,9 @@ bool XmlValue::read(const char *path, long *out) const {
 
 bool XmlValue::read(const char *path, double *out) const {
   XmlValuePtr value = find(path);
-  if (!value) return false;
+  if (!value) {
+    return false;
+  }
 
   *out = atof(value->text().c_str());
   return true;
@@ -78,7 +86,9 @@ bool XmlValue::read(const char *path, double *out) const {
 
 bool XmlValue::read(const char *path, bool *out) const {
   XmlValuePtr value = find(path);
-  if (!value) return false;
+  if (!value) {
+    return false;
+  }
 
   *out = (atoi(value->text().c_str()) != 0);
   return true;
@@ -87,7 +97,9 @@ bool XmlValue::read(const char *path, bool *out) const {
 bool XmlValue::readB64(const char *path, unsigned char *data,
                        int length) const {
   XmlValuePtr value = find(path);
-  if (!value) return false;
+  if (!value) {
+    return false;
+  }
 
   std::string s = value->text();
   s.erase(std::remove_if(s.begin(), s.end(), ::isspace), s.end());
@@ -110,7 +122,9 @@ bool XmlValue::readB64(const char *path, unsigned char *data,
 
 bool XmlValue::read(const char *path, Interface *out) const {
   XmlValuePtr node = find(path);
-  if (!node) return false;
+  if (!node) {
+    return false;
+  }
 
   bool ok = node->read("name", &out->name()) &&
             node->read("major", &out->current()) &&
@@ -121,12 +135,16 @@ bool XmlValue::read(const char *path, Interface *out) const {
 
 std::string safeValueForNode(const tinyxml2::XMLElement *element) {
   std::string value;
-  if (element == nullptr) return value;
+  if (element == nullptr) {
+    return value;
+  }
 
   const tinyxml2::XMLNode *child = element->FirstChild();
   if (child != nullptr) {
     const tinyxml2::XMLText *childText = child->ToText();
-    if (childText != nullptr) value = childText->Value();
+    if (childText != nullptr) {
+      value = childText->Value();
+    }
   }
 
   return value;
@@ -169,7 +187,9 @@ bool XmlReader::load(const char *fileName) {
   pd->doc.reset(new tinyxml2::XMLDocument());
 
   std::ifstream in(fileName);
-  if (!in) return false;
+  if (!in) {
+    return false;
+  }
 
   std::ostringstream fileContent;
   fileContent << in.rdbuf();
diff --git a/encfs/autosprintf.cpp b/encfs/autosprintf.cpp
index 33bbe32..26a27a8 100644
--- a/encfs/autosprintf.cpp
+++ b/encfs/autosprintf.cpp
@@ -38,7 +38,9 @@ namespace gnu {
 autosprintf::autosprintf(const char *format, ...) {
   va_list args;
   va_start(args, format);
-  if (vasprintf(&str, format, args) < 0) str = nullptr;
+  if (vasprintf(&str, format, args) < 0) {
+    str = nullptr;
+  }
   va_end(args);
 }
 
diff --git a/encfs/base64.cpp b/encfs/base64.cpp
index 38de109..37b6d6c 100644
--- a/encfs/base64.cpp
+++ b/encfs/base64.cpp
@@ -52,7 +52,9 @@ void changeBase2(unsigned char *src, int srcLen, int src2Pow,
   }
 
   // now, we could have a partial value left in the work buffer..
-  if ((workBits != 0) && ((dst - origDst) < dstLen)) *dst++ = work & mask;
+  if ((workBits != 0) && ((dst - origDst) < dstLen)) {
+    *dst++ = work & mask;
+  }
 }
 
 /*
@@ -67,7 +69,9 @@ static void changeBase2Inline(unsigned char *src, int srcLen, int src2Pow,
                               unsigned long work, int workBits,
                               unsigned char *outLoc) {
   const int mask = (1 << dst2Pow) - 1;
-  if (outLoc == nullptr) outLoc = src;
+  if (outLoc == nullptr) {
+    outLoc = src;
+  }
 
   // copy the new bits onto the high bits of the stream.
   // The bits that fall off the low end are the output bits.
diff --git a/encfs/encfs.cpp b/encfs/encfs.cpp
index 816125d..8787719 100644
--- a/encfs/encfs.cpp
+++ b/encfs/encfs.cpp
@@ -76,7 +76,9 @@ static EncFS_Context *context() {
  * if the argument is NULL.
  */
 static bool isReadOnly(EncFS_Context *ctx) {
-  if (ctx == nullptr) ctx = (EncFS_Context *)fuse_get_context()->private_data;
+  if (ctx == nullptr) {
+    ctx = (EncFS_Context *)fuse_get_context()->private_data;
+  }
 
   return ctx->opts->readOnly;
 }
@@ -89,7 +91,9 @@ static int withCipherPath(const char *opName, const char *path,
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
     string cyName = FSRoot->cipherPath(path);
@@ -140,7 +144,9 @@ static int withFileNode(const char *opName, const char *path,
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
 
@@ -230,7 +236,9 @@ int encfs_readdir(const char *path, void *buf, fuse_fill_dir_t filler,
 
   int res = ESUCCESS;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
 
@@ -252,7 +260,9 @@ int encfs_readdir(const char *path, void *buf, fuse_fill_dir_t filler,
 #if defined(fuse_fill_dir_flags)
         if (filler(buf, name.c_str(), &st, 0, 0)) break;
 #else
-        if (filler(buf, name.c_str(), &st, 0) != 0) break;
+        if (filler(buf, name.c_str(), &st, 0) != 0) {
+          break;
+        }
 #endif
 
         name = dt.nextPlaintextName(&fileType, &inode);
@@ -271,11 +281,15 @@ int encfs_readdir(const char *path, void *buf, fuse_fill_dir_t filler,
 int encfs_mknod(const char *path, mode_t mode, dev_t rdev) {
   EncFS_Context *ctx = context();
 
-  if (isReadOnly(ctx)) return -EROFS;
+  if (isReadOnly(ctx)) {
+    return -EROFS;
+  }
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
     std::shared_ptr<FileNode> fnode = FSRoot->lookupNode(path, "mknod");
@@ -314,11 +328,15 @@ int encfs_mkdir(const char *path, mode_t mode) {
   fuse_context *fctx = fuse_get_context();
   EncFS_Context *ctx = context();
 
-  if (isReadOnly(ctx)) return -EROFS;
+  if (isReadOnly(ctx)) {
+    return -EROFS;
+  }
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
     uid_t uid = 0;
@@ -349,11 +367,15 @@ int encfs_mkdir(const char *path, mode_t mode) {
 int encfs_unlink(const char *path) {
   EncFS_Context *ctx = context();
 
-  if (isReadOnly(ctx)) return -EROFS;
+  if (isReadOnly(ctx)) {
+    return -EROFS;
+  }
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
     // let DirNode handle it atomically so that it can handle race
@@ -370,7 +392,9 @@ int _do_rmdir(EncFS_Context *, const string &cipherPath) {
 }
 
 int encfs_rmdir(const char *path) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withCipherPath("rmdir", path, bind(_do_rmdir, _1, _2));
 }
 
@@ -378,11 +402,15 @@ int _do_readlink(EncFS_Context *ctx, const string &cyName, char *buf,
                  size_t size) {
   int res = ESUCCESS;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   res = ::readlink(cyName.c_str(), buf, size - 1);
 
-  if (res == -1) return -errno;
+  if (res == -1) {
+    return -errno;
+  }
 
   buf[res] = '\0';  // ensure null termination
   string decodedName;
@@ -413,11 +441,15 @@ int encfs_readlink(const char *path, char *buf, size_t size) {
 int encfs_symlink(const char *to, const char *from) {
   EncFS_Context *ctx = context();
 
-  if (isReadOnly(ctx)) return -EROFS;
+  if (isReadOnly(ctx)) {
+    return -EROFS;
+  }
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
     string fromCName = FSRoot->cipherPath(from);
@@ -436,8 +468,12 @@ int encfs_symlink(const char *to, const char *from) {
       oldgid = setfsgid(context->gid);
     }
     res = ::symlink(toCName.c_str(), fromCName.c_str());
-    if (olduid >= 0) setfsuid(olduid);
-    if (oldgid >= 0) setfsgid(oldgid);
+    if (olduid >= 0) {
+      setfsuid(olduid);
+    }
+    if (oldgid >= 0) {
+      setfsgid(oldgid);
+    }
 
     if (res == -1) {
       res = -errno;
@@ -453,11 +489,15 @@ int encfs_symlink(const char *to, const char *from) {
 int encfs_link(const char *from, const char *to) {
   EncFS_Context *ctx = context();
 
-  if (isReadOnly(ctx)) return -EROFS;
+  if (isReadOnly(ctx)) {
+    return -EROFS;
+  }
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
     res = FSRoot->link(from, to);
@@ -470,11 +510,15 @@ int encfs_link(const char *from, const char *to) {
 int encfs_rename(const char *from, const char *to) {
   EncFS_Context *ctx = context();
 
-  if (isReadOnly(ctx)) return -EROFS;
+  if (isReadOnly(ctx)) {
+    return -EROFS;
+  }
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
     res = FSRoot->rename(from, to);
@@ -489,7 +533,9 @@ int _do_chmod(EncFS_Context *, const string &cipherPath, mode_t mode) {
 }
 
 int encfs_chmod(const char *path, mode_t mode) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withCipherPath("chmod", path, bind(_do_chmod, _1, _2, mode));
 }
 
@@ -499,19 +545,25 @@ int _do_chown(EncFS_Context *, const string &cyName, uid_t u, gid_t g) {
 }
 
 int encfs_chown(const char *path, uid_t uid, gid_t gid) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withCipherPath("chown", path, bind(_do_chown, _1, _2, uid, gid));
 }
 
 int _do_truncate(FileNode *fnode, off_t size) { return fnode->truncate(size); }
 
 int encfs_truncate(const char *path, off_t size) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withFileNode("truncate", path, nullptr, bind(_do_truncate, _1, size));
 }
 
 int encfs_ftruncate(const char *path, off_t size, struct fuse_file_info *fi) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withFileNode("ftruncate", path, fi, bind(_do_truncate, _1, size));
 }
 
@@ -521,7 +573,9 @@ int _do_utime(EncFS_Context *, const string &cyName, struct utimbuf *buf) {
 }
 
 int encfs_utime(const char *path, struct utimbuf *buf) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withCipherPath("utime", path, bind(_do_utime, _1, _2, buf));
 }
 
@@ -542,7 +596,9 @@ int _do_utimens(EncFS_Context *, const string &cyName,
 }
 
 int encfs_utimens(const char *path, const struct timespec ts[2]) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withCipherPath("utimens", path, bind(_do_utimens, _1, _2, ts));
 }
 
@@ -556,7 +612,9 @@ int encfs_open(const char *path, struct fuse_file_info *file) {
 
   int res = -EIO;
   std::shared_ptr<DirNode> FSRoot = ctx->getRoot(&res);
-  if (!FSRoot) return res;
+  if (!FSRoot) {
+    return res;
+  }
 
   try {
     std::shared_ptr<FileNode> fnode =
@@ -647,7 +705,9 @@ int _do_fsync(FileNode *fnode, int dataSync) {
 }
 
 int encfs_fsync(const char *path, int dataSync, struct fuse_file_info *file) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withFileNode("fsync", path, file, bind(_do_fsync, _1, dataSync));
 }
 
@@ -660,7 +720,9 @@ int _do_write(FileNode *fnode, unsigned char *ptr, size_t size, off_t offset) {
 
 int encfs_write(const char *path, const char *buf, size_t size, off_t offset,
                 struct fuse_file_info *file) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withFileNode("write", path, file,
                       bind(_do_write, _1, (unsigned char *)buf, size, offset));
 }
@@ -681,7 +743,9 @@ int encfs_statfs(const char *path, struct statvfs *st) {
       // adjust maximum name length..
       st->f_namemax = 6 * (st->f_namemax - 2) / 8;  // approx..
     }
-    if (res == -1) res = -errno;
+    if (res == -1) {
+      res = -errno;
+    }
   } catch (encfs::Error &err) {
     RLOG(ERROR) << "error caught in statfs: " << err.what();
   }
@@ -710,7 +774,9 @@ int _do_setxattr(EncFS_Context *, const string &cyName, const char *name,
 }
 int encfs_setxattr(const char *path, const char *name, const char *value,
                    size_t size, int flags) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
   return withCipherPath("setxattr", path,
                         bind(_do_setxattr, _1, _2, name, value, size, flags));
 }
@@ -768,7 +834,9 @@ int _do_removexattr(EncFS_Context *, const string &cyName, const char *name) {
 }
 
 int encfs_removexattr(const char *path, const char *name) {
-  if (isReadOnly(nullptr)) return -EROFS;
+  if (isReadOnly(nullptr)) {
+    return -EROFS;
+  }
 
   return withCipherPath("removexattr", path,
                         bind(_do_removexattr, _1, _2, name));
diff --git a/encfs/main.cpp b/encfs/main.cpp
index e22168e..0d0e6bb 100644
--- a/encfs/main.cpp
+++ b/encfs/main.cpp
@@ -85,15 +85,33 @@ struct EncFS_Args {
     ostringstream ss;
     ss << (isDaemon ? "(daemon) " : "(fg) ");
     ss << (isThreaded ? "(threaded) " : "(UP) ");
-    if (idleTimeout > 0) ss << "(timeout " << idleTimeout << ") ";
-    if (opts->checkKey) ss << "(keyCheck) ";
-    if (opts->forceDecode) ss << "(forceDecode) ";
-    if (opts->ownerCreate) ss << "(ownerCreate) ";
-    if (opts->useStdin) ss << "(useStdin) ";
-    if (opts->annotate) ss << "(annotate) ";
-    if (opts->reverseEncryption) ss << "(reverseEncryption) ";
-    if (opts->mountOnDemand) ss << "(mountOnDemand) ";
-    if (opts->delayMount) ss << "(delayMount) ";
+    if (idleTimeout > 0) {
+      ss << "(timeout " << idleTimeout << ") ";
+    }
+    if (opts->checkKey) {
+      ss << "(keyCheck) ";
+    }
+    if (opts->forceDecode) {
+      ss << "(forceDecode) ";
+    }
+    if (opts->ownerCreate) {
+      ss << "(ownerCreate) ";
+    }
+    if (opts->useStdin) {
+      ss << "(useStdin) ";
+    }
+    if (opts->annotate) {
+      ss << "(annotate) ";
+    }
+    if (opts->reverseEncryption) {
+      ss << "(reverseEncryption) ";
+    }
+    if (opts->mountOnDemand) {
+      ss << "(mountOnDemand) ";
+    }
+    if (opts->delayMount) {
+      ss << "(delayMount) ";
+    }
     for (int i = 0; i < fuseArgc; ++i) {
       ss << fuseArgv[i] << ' ';
     }
@@ -174,7 +192,9 @@ static void FuseUsage() {
 
 static string slashTerminate(const string &src) {
   string result = src;
-  if (result[result.length() - 1] != '/') result.append("/");
+  if (result[result.length() - 1] != '/') {
+    result.append("/");
+  }
   return result;
 }
 
@@ -249,7 +269,9 @@ static bool processArgs(int argc, char *argv[],
     int res =
         getopt_long(argc, argv, "HsSfvdmi:o:t:", long_options, &option_index);
 
-    if (res == -1) break;
+    if (res == -1) {
+      break;
+    }
 
     switch (res) {
       case '1':
@@ -381,7 +403,9 @@ static bool processArgs(int argc, char *argv[],
     }
   }
 
-  if (!out->isThreaded) PUSHARG("-s");
+  if (!out->isThreaded) {
+    PUSHARG("-s");
+  }
 
   // we should have at least 2 arguments left over - the source directory and
   // the mount point.
@@ -640,7 +664,9 @@ int main(int argc, char *argv[]) {
     try {
       time_t startTime, endTime;
 
-      if (encfsArgs->opts->annotate) cerr << "$STATUS$ fuse_main_start" << endl;
+      if (encfsArgs->opts->annotate) {
+        cerr << "$STATUS$ fuse_main_start" << endl;
+      }
 
       // FIXME: workaround for fuse_main returning an error on normal
       // exit.  Only print information if fuse_main returned
@@ -654,9 +680,13 @@ int main(int argc, char *argv[]) {
 
       time(&endTime);
 
-      if (encfsArgs->opts->annotate) cerr << "$STATUS$ fuse_main_end" << endl;
+      if (encfsArgs->opts->annotate) {
+        cerr << "$STATUS$ fuse_main_end" << endl;
+      }
 
-      if (res == 0) returnCode = EXIT_SUCCESS;
+      if (res == 0) {
+        returnCode = EXIT_SUCCESS;
+      }
 
       if (res != 0 && encfsArgs->isDaemon && (oldStderr >= 0) &&
           (endTime - startTime <= 1)) {
diff --git a/encfs/openssl.cpp b/encfs/openssl.cpp
index c1761ba..3b0f1b3 100644
--- a/encfs/openssl.cpp
+++ b/encfs/openssl.cpp
@@ -97,7 +97,9 @@ void openssl_shutdown(bool threaded) {
   ENGINE_cleanup();
 #endif
 
-  if (threaded) pthreads_locking_cleanup();
+  if (threaded) {
+    pthreads_locking_cleanup();
+  }
 }
 
 }  // namespace encfs
diff --git a/encfs/readpassphrase.cpp b/encfs/readpassphrase.cpp
index ebbafe1..59a8abd 100644
--- a/encfs/readpassphrase.cpp
+++ b/encfs/readpassphrase.cpp
@@ -112,7 +112,9 @@ restart:
   /* Turn off echo if possible. */
   if (tcgetattr(input, &oterm) == 0) {
     memcpy(&term, &oterm, sizeof(term));
-    if ((flags & RPP_ECHO_ON) == 0) term.c_lflag &= ~(ECHO | ECHONL);
+    if ((flags & RPP_ECHO_ON) == 0) {
+      term.c_lflag &= ~(ECHO | ECHONL);
+    }
 #ifdef VSTATUS
     if (term.c_cc[VSTATUS] != _POSIX_VDISABLE)
       term.c_cc[VSTATUS] = _POSIX_VDISABLE;
@@ -127,17 +129,25 @@ restart:
   end = buf + bufsiz - 1;
   for (p = buf; (nr = read(input, &ch, 1)) == 1 && ch != '\n' && ch != '\r';) {
     if (p < end) {
-      if ((flags & RPP_SEVENBIT) != 0) ch &= 0x7f;
+      if ((flags & RPP_SEVENBIT) != 0) {
+        ch &= 0x7f;
+      }
       if (isalpha(ch) != 0) {
-        if ((flags & RPP_FORCELOWER) != 0) ch = tolower(ch);
-        if ((flags & RPP_FORCEUPPER) != 0) ch = toupper(ch);
+        if ((flags & RPP_FORCELOWER) != 0) {
+          ch = tolower(ch);
+        }
+        if ((flags & RPP_FORCEUPPER) != 0) {
+          ch = toupper(ch);
+        }
       }
       *p++ = ch;
     }
   }
   *p = '\0';
   save_errno = errno;
-  if ((term.c_lflag & ECHO) == 0u) (void)write(output, "\n", 1);
+  if ((term.c_lflag & ECHO) == 0u) {
+    (void)write(output, "\n", 1);
+  }
 
   /* Restore old terminal settings and signals. */
   if (memcmp(&term, &oterm, sizeof(term)) != 0) {
@@ -150,7 +160,9 @@ restart:
   (void)sigaction(SIGTSTP, &savetstp, nullptr);
   (void)sigaction(SIGTTIN, &savettin, nullptr);
   (void)sigaction(SIGTTOU, &savettou, nullptr);
-  if (input != STDIN_FILENO) (void)close(input);
+  if (input != STDIN_FILENO) {
+    (void)close(input);
+  }
 
   /*
    * If we were interrupted by a signal, resend it to ourselves