Build with -Wextra-semi in Clang

This would have caught
https://boringssl-review.googlesource.com/c/boringssl/+/73029

The other instances didn't break because Chromium builds our fuzzers
(and thus our headers) with stricter warnings than our source files.
Probably worth being consistent there, but meanwhile go ahead and turn
on this warning.

Change-Id: I0cff2648f25a0d7f87de6a27f4af6ea891fff663
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/73267
Commit-Queue: Bob Beck <bbe@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Bob Beck <bbe@google.com>
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4f3b196..f1814f8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -123,7 +123,7 @@
   endif()
 
   if(CLANG)
-    set(C_CXX_FLAGS "${C_CXX_FLAGS} -Wnewline-eof -fcolor-diagnostics")
+    set(C_CXX_FLAGS "${C_CXX_FLAGS} -Wnewline-eof -Wextra-semi -fcolor-diagnostics")
   else()
     # GCC (at least 4.8.4) has a bug where it'll find unreachable free() calls
     # and declare that the code is trying to free a stack pointer.
diff --git a/crypto/fipsmodule/digestsign/digestsign.c.inc b/crypto/fipsmodule/digestsign/digestsign.c.inc
index e5b6bc7..d7bf94d 100644
--- a/crypto/fipsmodule/digestsign/digestsign.c.inc
+++ b/crypto/fipsmodule/digestsign/digestsign.c.inc
@@ -71,7 +71,7 @@
 DEFINE_LOCAL_DATA(struct evp_md_pctx_ops, md_pctx_ops) {
   out->free = EVP_PKEY_CTX_free;
   out->dup = EVP_PKEY_CTX_dup;
-};
+}
 
 static int uses_prehash(EVP_MD_CTX *ctx, enum evp_sign_verify_t op) {
   return (op == evp_sign) ? (ctx->pctx->pmeth->sign != NULL)
diff --git a/crypto/fipsmodule/rand/rand.c.inc b/crypto/fipsmodule/rand/rand.c.inc
index 5e093ec..8ba8514 100644
--- a/crypto/fipsmodule/rand/rand.c.inc
+++ b/crypto/fipsmodule/rand/rand.c.inc
@@ -85,8 +85,8 @@
 // objects in the process, one per thread. This is needed because FIPS requires
 // that they be zeroed on process exit, but thread-local destructors aren't
 // called when the whole process is exiting.
-DEFINE_BSS_GET(struct rand_thread_state *, thread_states_list);
-DEFINE_STATIC_MUTEX(thread_states_list_lock);
+DEFINE_BSS_GET(struct rand_thread_state *, thread_states_list)
+DEFINE_STATIC_MUTEX(thread_states_list_lock)
 
 static void rand_thread_state_clear_all(void) __attribute__((destructor));
 static void rand_thread_state_clear_all(void) {
@@ -195,8 +195,8 @@
   int want_additional_input;
 };
 
-DEFINE_BSS_GET(struct entropy_buffer, entropy_buffer);
-DEFINE_STATIC_MUTEX(entropy_buffer_lock);
+DEFINE_BSS_GET(struct entropy_buffer, entropy_buffer)
+DEFINE_STATIC_MUTEX(entropy_buffer_lock)
 
 bcm_infallible BCM_rand_load_entropy(const uint8_t *entropy, size_t entropy_len,
                                      int want_additional_input) {
diff --git a/crypto/fipsmodule/self_check/self_check.c.inc b/crypto/fipsmodule/self_check/self_check.c.inc
index 08a36be..9c90e0a 100644
--- a/crypto/fipsmodule/self_check/self_check.c.inc
+++ b/crypto/fipsmodule/self_check/self_check.c.inc
@@ -600,7 +600,7 @@
   FIPS_service_indicator_unlock_state();
 }
 
-DEFINE_STATIC_ONCE(g_self_test_once_rsa);
+DEFINE_STATIC_ONCE(g_self_test_once_rsa)
 
 void boringssl_ensure_rsa_self_test(void) {
   CRYPTO_once(g_self_test_once_rsa_bss_get(), run_self_test_rsa);
@@ -614,7 +614,7 @@
   FIPS_service_indicator_unlock_state();
 }
 
-DEFINE_STATIC_ONCE(g_self_test_once_ecc);
+DEFINE_STATIC_ONCE(g_self_test_once_ecc)
 
 void boringssl_ensure_ecc_self_test(void) {
   CRYPTO_once(g_self_test_once_ecc_bss_get(), run_self_test_ecc);
@@ -628,7 +628,7 @@
   FIPS_service_indicator_unlock_state();
 }
 
-DEFINE_STATIC_ONCE(g_self_test_once_ffdh);
+DEFINE_STATIC_ONCE(g_self_test_once_ffdh)
 
 void boringssl_ensure_ffdh_self_test(void) {
   CRYPTO_once(g_self_test_once_ffdh_bss_get(), run_self_test_ffdh);
diff --git a/crypto/mem.c b/crypto/mem.c
index 2113a25..3c29125 100644
--- a/crypto/mem.c
+++ b/crypto/mem.c
@@ -100,10 +100,10 @@
 // weak symbols.
 #if !defined(__EDK2_BORINGSSL__) && defined(__ELF__) && defined(__GNUC__)
 #define WEAK_SYMBOL_FUNC(rettype, name, args) \
-  rettype name args __attribute__((weak));
+  rettype name args __attribute__((weak))
 #else
 #define WEAK_SYMBOL_FUNC(rettype, name, args) \
-  static rettype(*const name) args = NULL;
+  static rettype(*const name) args = NULL
 #endif
 
 #if defined(BORINGSSL_DETECT_SDALLOCX)
diff --git a/crypto/x509/x_all.c b/crypto/x509/x_all.c
index 6808ab7..5eda100 100644
--- a/crypto/x509/x_all.c
+++ b/crypto/x509/x_all.c
@@ -185,8 +185,8 @@
     return ret;                                \
   }
 
-IMPLEMENT_D2I_FP(X509, d2i_X509_fp, d2i_X509_bio);
-IMPLEMENT_I2D_FP(X509, i2d_X509_fp, i2d_X509_bio);
+IMPLEMENT_D2I_FP(X509, d2i_X509_fp, d2i_X509_bio)
+IMPLEMENT_I2D_FP(X509, i2d_X509_fp, i2d_X509_bio)
 
 IMPLEMENT_D2I_FP(RSA, d2i_RSAPrivateKey_fp, d2i_RSAPrivateKey_bio)
 IMPLEMENT_I2D_FP(RSA, i2d_RSAPrivateKey_fp, i2d_RSAPrivateKey_bio)
diff --git a/pki/verify_signed_data.cc b/pki/verify_signed_data.cc
index 9c546fd..d9aab82 100644
--- a/pki/verify_signed_data.cc
+++ b/pki/verify_signed_data.cc
@@ -67,7 +67,7 @@
 // leaving things in the error queue.
 class OpenSSLErrStackTracer {
  public:
-  ~OpenSSLErrStackTracer() { ERR_clear_error(); };
+  ~OpenSSLErrStackTracer() { ERR_clear_error(); }
 };
 
 }  // namespace
diff --git a/util/fipstools/acvp/modulewrapper/main.cc b/util/fipstools/acvp/modulewrapper/main.cc
index 0997055..7fc60fe 100644
--- a/util/fipstools/acvp/modulewrapper/main.cc
+++ b/util/fipstools/acvp/modulewrapper/main.cc
@@ -116,4 +116,4 @@
       return 3;
     }
   }
-};
+}