unit_tests: cover md5/sha1 hashing and EVP_MD cache thread-safety

Add coverage for the shared EVP_MD cache introduced by the per-hash
provider-fetch fix:

- test_hash_md5_sha1 verifies cl_hash_init/cl_update_hash/cl_finish_hash
  returns correct MD5 and SHA1 digests, skipping an algorithm that is
  unavailable under a strict FIPS policy rather than failing.
- test_hash_cache_threadsafe hammers cl_hash_init() from multiple threads to
  exercise the cache and its mutex under contention.

Author: Sewci0

unit_tests/check_clamav.c

@@ -35,6 +35,10 @@
 
 #include "checks.h"
 
+#ifdef CL_THREAD_SAFE
+#include <pthread.h>
+#endif
+
 static int fpu_words = FPU_ENDIAN_INITME;
 #define NO_FPU_ENDIAN (fpu_words == FPU_ENDIAN_UNKNOWN)
 #define EA06_SCAN strstr(file, "clam.ea06.exe")
@@ -1693,6 +1697,93 @@ START_TEST(test_sha2_256)
 }
 END_TEST
 
+START_TEST(test_hash_md5_sha1)
+{
+    /* The incremental cl_hash_* API is routed through the shared EVP_MD cache
+     * by this change; verify it still returns correct MD5/SHA1 digests for the
+     * "abc" vectors. An algorithm unavailable under a strict FIPS policy (e.g.
+     * MD5) yields a NULL context and is skipped rather than failing the test. */
+    static const uint8_t abc[]                    = {'a', 'b', 'c'};
+    static const uint8_t md5_abc[MD5_HASH_SIZE]   = {
+        0x90, 0x01, 0x50, 0x98, 0x3c, 0xd2, 0x4f, 0xb0,
+        0xd6, 0x96, 0x3f, 0x7d, 0x28, 0xe1, 0x7f, 0x72};
+    static const uint8_t sha1_abc[SHA1_HASH_SIZE] = {
+        0xa9, 0x99, 0x3e, 0x36, 0x47, 0x06, 0x81, 0x6a, 0xba, 0x3e,
+        0x25, 0x71, 0x78, 0x50, 0xc2, 0x6c, 0x9c, 0xd0, 0xd8, 0x9d};
+    uint8_t out[SHA256_HASH_SIZE];
+    void *ctx;
+
+    ctx = cl_hash_init("md5");
+    if (NULL != ctx) {
+        cl_update_hash(ctx, abc, sizeof(abc));
+        cl_finish_hash(ctx, out);
+        ck_assert_msg(!memcmp(out, md5_abc, MD5_HASH_SIZE), "md5(\"abc\") mismatch");
+    }
+
+    ctx = cl_hash_init("sha1");
+    if (NULL != ctx) {
+        cl_update_hash(ctx, abc, sizeof(abc));
+        cl_finish_hash(ctx, out);
+        ck_assert_msg(!memcmp(out, sha1_abc, SHA1_HASH_SIZE), "sha1(\"abc\") mismatch");
+    }
+}
+END_TEST
+
+#ifdef CL_THREAD_SAFE
+#define HASH_TS_THREADS 8
+#define HASH_TS_ITERS 2000
+struct hash_ts_arg {
+    const uint8_t *expect; /* sha2-256("abc") == res256[0] */
+    int failed;
+};
+static void *hash_ts_worker(void *arg)
+{
+    struct hash_ts_arg *a      = (struct hash_ts_arg *)arg;
+    static const uint8_t abc[] = {'a', 'b', 'c'};
+    uint8_t out[SHA256_HASH_SIZE];
+    unsigned i;
+
+    for (i = 0; i < HASH_TS_ITERS; i++) {
+        void *ctx = cl_hash_init("sha2-256");
+        if (NULL == ctx) {
+            a->failed = 1;
+            return NULL;
+        }
+        cl_update_hash(ctx, abc, sizeof(abc));
+        cl_finish_hash(ctx, out);
+        if (0 != memcmp(out, a->expect, SHA256_HASH_SIZE)) {
+            a->failed = 1;
+            return NULL;
+        }
+    }
+    return NULL;
+}
+
+START_TEST(test_hash_cache_threadsafe)
+{
+    /* Concurrently hammer cl_hash_init() to exercise the process-global EVP_MD
+     * cache added by the per-hash provider-fetch fix, catching races on the
+     * cache and its mutex (run under Valgrind/TSan in CI). */
+    pthread_t th[HASH_TS_THREADS];
+    struct hash_ts_arg args[HASH_TS_THREADS];
+    int i, failed = 0;
+
+    for (i = 0; i < HASH_TS_THREADS; i++) {
+        args[i].expect = res256[0];
+        args[i].failed = 0;
+        ck_assert_msg(0 == pthread_create(&th[i], NULL, hash_ts_worker, &args[i]),
+                      "pthread_create failed");
+    }
+    for (i = 0; i < HASH_TS_THREADS; i++) {
+        pthread_join(th[i], NULL);
+        if (args[i].failed)
+            failed = 1;
+    }
+    ck_assert_msg(0 == failed, "concurrent cl_hash_init(sha2-256) returned a wrong digest or NULL context");
+}
+END_TEST
+#endif
+
 START_TEST(test_sanitize_path)
 {
     const char *unsanitized   = NULL;
@@ -2041,6 +2132,10 @@ static Suite *test_cli_suite(void)
     suite_add_tcase(s, tc_cli_dsig);
     tcase_add_loop_test(tc_cli_dsig, test_cli_dsig, 0, dsig_tests_cnt);
     tcase_add_test(tc_cli_dsig, test_sha2_256);
+    tcase_add_test(tc_cli_dsig, test_hash_md5_sha1);
+#ifdef CL_THREAD_SAFE
+    tcase_add_test(tc_cli_dsig, test_hash_cache_threadsafe);
+#endif
 
     suite_add_tcase(s, tc_cli_assorted);
     tcase_add_test(tc_cli_assorted, test_sanitize_path);