4 "HTML Tidy for Solaris (vers 1st March 2003), see www.w3.org"
6 <link rel="stylesheet" type="text/css" href=
7 "../manual.css" title="style1">
8 <title>Splint Manual</title>
9 <style type="text/css">
11 /* Font Definitions */
13 {font-family:Helvetica;
14 panose-1:2 11 5 4 2 2 2 2 2 4;}
17 panose-1:2 7 4 9 2 2 5 2 4 4;}
19 {font-family:"Tms Rmn";
20 panose-1:2 2 6 3 4 5 5 2 3 4;}
23 panose-1:2 11 6 4 2 2 2 3 2 4;}
25 {font-family:"New York";
26 panose-1:2 4 5 3 6 5 6 2 3 4;}
29 panose-1:0 0 0 0 0 0 0 0 0 0;}
31 {font-family:Wingdings;
32 panose-1:5 0 0 0 0 0 0 0 0 0;}
34 {font-family:"MS Mincho";
35 panose-1:2 2 6 9 4 2 5 8 3 4;}
38 panose-1:2 3 6 0 0 1 1 1 1 1;}
41 panose-1:2 1 6 0 3 1 1 1 1 1;}
43 {font-family:PMingLiU;
44 panose-1:2 1 6 1 0 1 1 1 1 1;}
46 {font-family:"MS Gothic";
47 panose-1:2 11 6 9 7 2 5 8 2 4;}
50 panose-1:2 11 6 0 0 1 1 1 1 1;}
53 panose-1:2 1 6 0 3 1 1 1 1 1;}
56 panose-1:2 1 6 9 0 1 1 1 1 1;}
59 panose-1:2 2 6 9 4 3 5 8 3 5;}
62 panose-1:2 11 6 0 0 1 1 1 1 1;}
65 panose-1:2 4 6 3 5 7 5 2 3 3;}
67 {font-family:"Angsana New";
68 panose-1:2 2 6 3 5 4 5 2 3 4;}
70 {font-family:"Cordia New";
71 panose-1:2 11 3 4 2 2 2 2 2 4;}
74 panose-1:0 0 4 0 0 0 0 0 0 0;}
77 panose-1:0 0 4 0 0 0 0 0 0 0;}
80 panose-1:1 10 5 2 5 3 6 3 3 3;}
83 panose-1:0 0 4 0 0 0 0 0 0 0;}
86 panose-1:0 0 4 0 0 0 0 0 0 0;}
89 panose-1:0 0 4 0 0 0 0 0 0 0;}
92 panose-1:0 0 4 0 0 0 0 0 0 0;}
95 panose-1:0 0 4 0 0 0 0 0 0 0;}
98 panose-1:0 0 4 0 0 0 0 0 0 0;}
100 {font-family:"Estrangella Edessa";
101 panose-1:0 0 0 0 0 0 0 0 0 0;}
103 {font-family:"Arial Unicode MS";
104 panose-1:0 0 0 0 0 0 0 0 0 0;}
107 panose-1:2 11 6 4 3 5 4 4 2 4;}
109 {font-family:"Book Antiqua";
110 panose-1:2 4 6 2 5 3 5 3 3 4;}
112 {font-family:"Arial Narrow";
113 panose-1:2 11 5 6 2 2 2 3 2 4;}
116 panose-1:0 0 0 0 0 0 0 0 0 0;}
118 {font-family:Marlett;
119 panose-1:0 0 0 0 0 0 0 0 0 0;}
121 {font-family:"News Gothic MT";
122 panose-1:2 11 5 4 2 2 3 2 2 4;}
124 {font-family:"Lucida Sans Unicode";
125 panose-1:2 11 6 2 3 5 4 2 2 4;}
127 {font-family:"Century Gothic";
128 panose-1:2 11 5 2 2 2 2 2 2 4;}
130 {font-family:"Abadi MT Condensed Light";
131 panose-1:2 11 3 6 3 1 1 1 1 3;}
133 {font-family:"Matisse ITC";
134 panose-1:4 4 4 3 3 13 2 2 7 4;}
136 {font-family:Westminster;
137 panose-1:4 4 5 6 3 15 2 2 7 2;}
139 {font-family:"Lucida Console";
140 panose-1:2 11 6 9 4 5 4 2 2 4;}
142 {font-family:"Arial Black";
143 panose-1:2 11 10 4 2 1 2 2 2 4;}
145 {font-family:"Comic Sans MS";
146 panose-1:3 15 7 2 3 3 2 2 2 4;}
148 {font-family:Verdana;
149 panose-1:2 11 6 4 3 5 4 4 2 4;}
151 {font-family:Webdings;
152 panose-1:5 3 1 2 1 5 9 6 7 3;}
154 {font-family:"Verdana Ref";
155 panose-1:2 11 6 4 3 5 4 4 2 4;}
157 {font-family:"Georgia Ref";
158 panose-1:2 4 5 2 5 4 5 2 3 3;}
160 {font-family:RefSpecialty;
161 panose-1:2 0 5 0 0 0 0 0 0 0;}
163 {font-family:"MS Reference 1";
164 panose-1:5 0 0 0 0 0 0 0 0 0;}
166 {font-family:"MS Reference 2";
167 panose-1:0 0 0 0 0 0 0 0 0 0;}
170 panose-1:0 0 4 0 0 0 0 0 0 0;}
172 {font-family:"Mediascape OSD Icon";
173 panose-1:2 11 6 3 5 3 2 2 2 4;}
176 panose-1:2 11 7 3 3 0 0 0 0 7;}
178 {font-family:"Agency FB";
179 panose-1:0 1 6 6 4 0 0 4 0 3;}
181 {font-family:Algerian;
182 panose-1:4 2 7 5 4 10 2 6 7 2;}
184 {font-family:"Arial Rounded MT Bold";
185 panose-1:2 15 7 4 3 5 4 3 2 4;}
187 {font-family:"Baskerville Old Face";
188 panose-1:2 2 6 2 8 5 5 2 3 3;}
190 {font-family:"Bauhaus 93";
191 panose-1:4 3 9 5 2 11 2 2 12 2;}
193 {font-family:"Bell MT";
194 panose-1:2 2 5 3 6 3 5 2 3 3;}
196 {font-family:"Berlin Sans FB";
197 panose-1:2 14 6 2 2 5 2 2 3 6;}
199 {font-family:"Bernard MT Condensed";
200 panose-1:2 5 8 6 6 9 5 2 4 4;}
202 {font-family:"Blackadder ITC";
203 panose-1:4 2 5 5 5 16 7 2 13 2;}
205 {font-family:"Bookman Old Style";
206 panose-1:2 5 6 4 5 5 5 2 2 4;}
208 {font-family:"Bradley Hand ITC";
209 panose-1:3 7 4 2 5 3 2 3 2 3;}
211 {font-family:"Britannic Bold";
212 panose-1:2 11 9 3 6 7 3 2 2 4;}
214 {font-family:Broadway;
215 panose-1:4 4 9 5 8 11 2 2 5 2;}
217 {font-family:"Brush Script MT";
218 panose-1:3 6 8 2 4 4 6 7 3 4;}
220 {font-family:"Californian FB";
221 panose-1:2 7 4 3 6 8 11 3 2 4;}
223 {font-family:"Calisto MT";
224 panose-1:2 4 6 3 5 5 5 3 3 4;}
226 {font-family:Castellar;
227 panose-1:2 10 4 2 6 4 6 1 3 1;}
229 {font-family:Centaur;
230 panose-1:2 3 5 4 5 2 5 2 3 4;}
232 {font-family:"Century Schoolbook";
233 panose-1:2 4 6 4 5 5 5 2 3 4;}
235 {font-family:Chiller;
236 panose-1:4 2 4 4 3 16 7 2 6 2;}
238 {font-family:"Colonna MT";
239 panose-1:4 2 8 5 6 2 2 3 2 3;}
241 {font-family:"Cooper Black";
242 panose-1:2 8 9 4 4 3 11 2 4 4;}
244 {font-family:"Copperplate Gothic Bold";
245 panose-1:2 14 7 5 2 2 6 2 4 4;}
247 {font-family:"Copperplate Gothic Light";
248 panose-1:2 14 5 7 2 2 6 2 4 4;}
250 {font-family:"Curlz MT";
251 panose-1:4 4 4 4 5 7 2 2 2 2;}
253 {font-family:"Edwardian Script ITC";
254 panose-1:3 3 3 2 4 7 7 13 8 4;}
256 {font-family:Elephant;
257 panose-1:2 2 9 4 9 5 5 2 3 3;}
259 {font-family:"Engravers MT";
260 panose-1:2 9 7 7 8 5 5 2 3 4;}
262 {font-family:"Eras Bold ITC";
263 panose-1:2 11 9 7 3 5 4 2 2 4;}
265 {font-family:"Eras Demi ITC";
266 panose-1:2 11 8 5 3 5 4 2 8 4;}
268 {font-family:"Eras Light ITC";
269 panose-1:2 11 4 2 3 5 4 2 8 4;}
271 {font-family:"Eras Medium ITC";
272 panose-1:2 11 6 2 3 5 4 2 8 4;}
274 {font-family:"Felix Titling";
275 panose-1:4 6 5 5 6 2 2 2 10 4;}
277 {font-family:"Footlight MT Light";
278 panose-1:2 4 6 2 6 3 10 2 3 4;}
281 panose-1:3 6 9 2 4 5 2 7 2 3;}
283 {font-family:"Franklin Gothic Book";
284 panose-1:2 11 5 3 2 1 2 2 2 4;}
286 {font-family:"Franklin Gothic Demi";
287 panose-1:2 11 7 3 2 1 2 2 2 4;}
289 {font-family:"Franklin Gothic Demi Cond";
290 panose-1:2 11 7 6 3 4 2 2 2 4;}
292 {font-family:"Franklin Gothic Heavy";
293 panose-1:2 11 9 3 2 1 2 2 2 4;}
295 {font-family:"Franklin Gothic Medium";
296 panose-1:2 11 6 3 2 1 2 2 2 4;}
298 {font-family:"Franklin Gothic Medium Cond";
299 panose-1:2 11 6 6 3 4 2 2 2 4;}
301 {font-family:"Freestyle Script";
302 panose-1:3 8 4 2 3 2 5 11 4 4;}
304 {font-family:"French Script MT";
305 panose-1:3 2 4 2 4 6 7 4 6 5;}
307 {font-family:Garamond;
308 panose-1:2 2 4 4 3 3 1 1 8 3;}
311 panose-1:4 4 5 4 6 16 7 2 13 2;}
313 {font-family:"Gill Sans MT";
314 panose-1:2 11 5 2 2 1 4 2 2 3;}
316 {font-family:"Gill Sans MT Condensed";
317 panose-1:2 11 5 6 2 1 4 2 2 3;}
319 {font-family:"Gill Sans Ultra Bold";
320 panose-1:2 11 10 2 2 1 4 2 2 3;}
322 {font-family:"Gill Sans Ultra Bold Condensed";
323 panose-1:2 11 10 6 2 1 4 2 2 3;}
325 {font-family:"Gill Sans MT Ext Condensed Bold";
326 panose-1:2 11 9 2 2 1 4 2 2 3;}
328 {font-family:"Gloucester MT Extra Condensed";
329 panose-1:2 3 8 8 2 6 1 1 1 1;}
331 {font-family:"Goudy Old Style";
332 panose-1:2 2 5 2 5 3 5 2 3 3;}
334 {font-family:"Goudy Stout";
335 panose-1:2 2 9 4 7 3 11 2 4 1;}
337 {font-family:Haettenschweiler;
338 panose-1:2 11 7 6 4 9 2 6 2 4;}
340 {font-family:"Harlow Solid Italic";
341 panose-1:4 3 6 4 2 15 2 2 13 2;}
343 {font-family:Harrington;
344 panose-1:4 4 5 5 5 10 2 2 7 2;}
346 {font-family:"High Tower Text";
347 panose-1:2 4 5 2 5 5 6 3 3 3;}
349 {font-family:"Imprint MT Shadow";
350 panose-1:4 2 6 5 6 3 3 3 2 2;}
352 {font-family:Jokerman;
353 panose-1:4 9 6 5 6 13 6 2 7 2;}
355 {font-family:"Juice ITC";
356 panose-1:4 4 4 3 4 10 2 2 2 2;}
358 {font-family:"Kristen ITC";
359 panose-1:3 5 5 2 4 2 2 3 2 2;}
361 {font-family:"Kunstler Script";
362 panose-1:3 3 4 2 2 6 7 13 13 6;}
364 {font-family:"Lucida Bright";
365 panose-1:2 4 6 2 5 5 5 2 3 4;}
367 {font-family:"Lucida Calligraphy";
368 panose-1:3 1 1 1 1 1 1 1 1 1;}
370 {font-family:"Lucida Fax";
371 panose-1:2 6 6 2 5 5 5 2 2 4;}
373 {font-family:"Lucida Handwriting";
374 panose-1:3 1 1 1 1 1 1 1 1 1;}
376 {font-family:"Lucida Sans";
377 panose-1:2 11 6 2 3 5 4 2 2 4;}
379 {font-family:"Lucida Sans Typewriter";
380 panose-1:2 11 5 9 3 5 4 3 2 4;}
382 {font-family:Magneto;
383 panose-1:4 3 8 5 5 8 2 2 13 2;}
385 {font-family:"Maiandra GD";
386 panose-1:2 14 5 2 3 3 8 2 2 4;}
388 {font-family:"Matura MT Script Capitals";
389 panose-1:3 2 8 2 6 6 2 7 2 2;}
391 {font-family:Mistral;
392 panose-1:3 9 7 2 3 4 7 2 4 3;}
394 {font-family:"Modern No\. 20";
395 panose-1:2 7 7 4 7 5 5 2 3 3;}
397 {font-family:"Niagara Engraved";
398 panose-1:4 2 5 2 7 7 3 3 2 2;}
400 {font-family:"Niagara Solid";
401 panose-1:4 2 5 2 7 7 2 2 2 2;}
403 {font-family:"OCR A Extended";
404 panose-1:2 1 5 9 2 1 2 1 3 3;}
406 {font-family:"Old English Text MT";
407 panose-1:3 4 9 2 4 5 8 3 8 6;}
410 panose-1:4 5 6 2 8 7 2 2 2 3;}
412 {font-family:"Palace Script MT";
413 panose-1:3 3 3 2 2 6 7 12 11 5;}
415 {font-family:Papyrus;
416 panose-1:3 7 5 2 6 5 2 3 2 5;}
418 {font-family:Parchment;
419 panose-1:3 4 6 2 4 7 8 4 8 4;}
421 {font-family:Perpetua;
422 panose-1:2 2 5 2 6 4 1 2 3 3;}
424 {font-family:"Perpetua Titling MT";
425 panose-1:2 2 5 2 6 5 5 2 8 4;}
427 {font-family:Playbill;
428 panose-1:4 5 6 3 10 6 2 2 2 2;}
430 {font-family:"Poor Richard";
431 panose-1:2 8 5 2 5 5 5 2 7 2;}
433 {font-family:Pristina;
434 panose-1:3 6 4 2 4 4 6 8 2 4;}
436 {font-family:"Rage Italic";
437 panose-1:3 7 5 2 4 5 7 7 3 4;}
440 panose-1:4 4 8 5 5 8 9 2 6 2;}
442 {font-family:Rockwell;
443 panose-1:2 6 6 3 2 2 5 2 4 3;}
445 {font-family:"Rockwell Condensed";
446 panose-1:2 6 6 3 5 4 5 2 1 4;}
448 {font-family:"Rockwell Extra Bold";
449 panose-1:2 6 9 3 4 5 5 2 4 3;}
451 {font-family:"Informal Roman";
452 panose-1:3 6 4 2 3 4 6 11 2 4;}
454 {font-family:"Script MT Bold";
455 panose-1:3 4 6 2 4 6 7 8 9 4;}
457 {font-family:"Showcard Gothic";
458 panose-1:4 2 9 4 2 1 2 2 6 4;}
460 {font-family:"Snap ITC";
461 panose-1:4 4 10 7 6 10 2 2 2 2;}
463 {font-family:Stencil;
464 panose-1:4 4 9 5 13 8 2 2 4 4;}
466 {font-family:"Tempus Sans ITC";
467 panose-1:4 2 4 4 3 13 7 2 2 2;}
469 {font-family:"Trebuchet MS";
470 panose-1:2 11 6 3 2 2 2 2 2 4;}
472 {font-family:"Tw Cen MT";
473 panose-1:2 11 6 2 2 1 4 2 6 3;}
475 {font-family:"Tw Cen MT Condensed";
476 panose-1:2 11 6 6 2 1 4 2 2 3;}
478 {font-family:"Viner Hand ITC";
479 panose-1:3 7 5 2 3 5 2 2 2 3;}
481 {font-family:Vivaldi;
482 panose-1:3 2 6 2 5 5 6 9 8 4;}
484 {font-family:"Vladimir Script";
485 panose-1:3 5 4 2 4 4 7 7 3 5;}
487 {font-family:"Wide Latin";
488 panose-1:2 10 10 7 5 5 5 2 4 4;}
490 {font-family:"Wingdings 2";
491 panose-1:5 2 1 2 1 5 7 7 7 7;}
493 {font-family:"Wingdings 3";
494 panose-1:5 4 1 2 1 8 7 7 7 7;}
496 {font-family:"Berlin Sans FB Demi";
497 panose-1:2 14 8 2 2 5 2 2 3 6;}
499 {font-family:"Tw Cen MT Condensed Extra Bold";
500 panose-1:2 11 8 3 2 0 0 0 0 4;}
502 {font-family:"Almanac MT";
503 panose-1:5 1 1 1 1 1 1 1 1 1;}
505 {font-family:"Beesknees ITC";
506 panose-1:4 4 10 5 5 13 2 2 5 2;}
508 {font-family:"Holidays MT";
509 panose-1:5 1 1 1 1 1 1 1 1 1;}
511 {font-family:"Monotype Sorts";
512 panose-1:1 1 6 1 1 1 1 1 1 1;}
514 {font-family:"Monotype Sorts 2";
515 panose-1:5 2 1 2 1 2 8 2 8 8;}
517 {font-family:"Pepita MT";
518 panose-1:3 6 4 2 4 5 2 7 8 4;}
520 {font-family:"Vacation MT";
521 panose-1:5 1 1 1 1 1 1 1 1 1;}
523 {font-family:"Map Symbols";
524 panose-1:0 5 1 2 1 7 6 2 5 7;}
526 {font-family:"Bookshelf Symbol 3";
527 panose-1:5 5 1 2 1 7 6 2 5 7;}
529 {font-family:Georgia;
530 panose-1:2 4 5 2 5 4 5 2 3 3;}
532 {font-family:"MS Outlook";
533 panose-1:5 0 0 0 0 0 0 0 0 0;}
535 {font-family:"Berling Antiqua";
536 panose-1:2 2 6 2 6 4 5 3 4 2;}
538 {font-family:Bookdings;
539 panose-1:5 0 0 0 0 0 0 0 0 0;}
541 {font-family:"Frutiger Linotype";
542 panose-1:2 11 6 4 3 5 4 4 2 4;}
544 {font-family:"Andale Mono";
545 panose-1:2 11 5 9 0 0 0 0 0 4;}
548 panose-1:2 11 8 6 3 9 2 5 2 4;}
550 {font-family:"Monotype Corsiva";
551 panose-1:3 1 1 1 1 2 1 1 1 1;}
553 {font-family:"MT Extra";
554 panose-1:5 5 1 2 1 2 5 2 2 2;}
556 {font-family:ProgramTwo;
557 panose-1:0 0 0 0 0 0 0 0 0 0;}
558 /* Style Definitions */
559 p.MsoNormal, li.MsoNormal, div.MsoNormal
561 margin-bottom:.0001pt;
564 font-family:"Times New Roman";}
572 page-break-before:always;
573 page-break-after:avoid;
575 font-family:"Times New Roman";}
583 page-break-after:avoid;
585 font-family:"Times New Roman";}
593 page-break-after:avoid;
595 font-family:"Times New Roman";}
603 page-break-after:avoid;
605 font-family:"Times New Roman";}
614 font-family:"Times New Roman";
624 font-family:"Times New Roman";
627 p.MsoHeading7, li.MsoHeading7, div.MsoHeading7
634 page-break-before:always;
635 page-break-after:avoid;
637 font-family:"Times New Roman";
639 p.MsoHeading8, li.MsoHeading8, div.MsoHeading8
646 page-break-after:avoid;
648 font-family:"Times New Roman";
650 p.MsoHeading9, li.MsoHeading9, div.MsoHeading9
657 page-break-after:avoid;
659 font-family:"Times New Roman";
661 p.MsoIndex1, li.MsoIndex1, div.MsoIndex1
666 margin-bottom:.0001pt;
670 font-family:"Times New Roman";}
671 p.MsoIndex2, li.MsoIndex2, div.MsoIndex2
676 margin-bottom:.0001pt;
680 font-family:"Times New Roman";}
681 p.MsoIndex3, li.MsoIndex3, div.MsoIndex3
686 margin-bottom:.0001pt;
690 font-family:"Times New Roman";}
691 p.MsoIndex4, li.MsoIndex4, div.MsoIndex4
696 margin-bottom:.0001pt;
700 font-family:"Times New Roman";}
701 p.MsoIndex5, li.MsoIndex5, div.MsoIndex5
706 margin-bottom:.0001pt;
710 font-family:"Times New Roman";}
711 p.MsoIndex6, li.MsoIndex6, div.MsoIndex6
716 margin-bottom:.0001pt;
720 font-family:"Times New Roman";}
721 p.MsoIndex7, li.MsoIndex7, div.MsoIndex7
726 margin-bottom:.0001pt;
730 font-family:"Times New Roman";}
731 p.MsoIndex8, li.MsoIndex8, div.MsoIndex8
736 margin-bottom:.0001pt;
740 font-family:"Times New Roman";}
741 p.MsoIndex9, li.MsoIndex9, div.MsoIndex9
746 margin-bottom:.0001pt;
750 font-family:"Times New Roman";}
751 p.MsoToc1, li.MsoToc1, div.MsoToc1
758 font-family:"Times New Roman";
760 p.MsoToc2, li.MsoToc2, div.MsoToc2
765 margin-bottom:.0001pt;
768 font-family:"Times New Roman";}
769 p.MsoToc3, li.MsoToc3, div.MsoToc3
774 margin-bottom:.0001pt;
777 font-family:"Times New Roman";}
778 p.MsoToc4, li.MsoToc4, div.MsoToc4
783 margin-bottom:.0001pt;
786 font-family:"Times New Roman";}
787 p.MsoToc5, li.MsoToc5, div.MsoToc5
792 margin-bottom:.0001pt;
795 font-family:"Times New Roman";}
796 p.MsoToc6, li.MsoToc6, div.MsoToc6
801 margin-bottom:.0001pt;
804 font-family:"Times New Roman";}
805 p.MsoToc7, li.MsoToc7, div.MsoToc7
810 margin-bottom:.0001pt;
813 font-family:"Times New Roman";}
814 p.MsoToc8, li.MsoToc8, div.MsoToc8
819 margin-bottom:.0001pt;
822 font-family:"Times New Roman";}
823 p.MsoToc9, li.MsoToc9, div.MsoToc9
828 margin-bottom:.0001pt;
831 font-family:"Times New Roman";}
832 p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText
834 margin-bottom:.0001pt;
837 font-family:"Times New Roman";}
838 p.MsoCommentText, li.MsoCommentText, div.MsoCommentText
840 margin-bottom:.0001pt;
843 font-family:"Times New Roman";}
844 p.MsoHeader, li.MsoHeader, div.MsoHeader
846 margin-bottom:.0001pt;
849 font-family:"Times New Roman";
852 p.MsoFooter, li.MsoFooter, div.MsoFooter
854 margin-bottom:.0001pt;
857 font-family:"Times New Roman";}
858 p.MsoIndexHeading, li.MsoIndexHeading, div.MsoIndexHeading
860 margin-bottom:.0001pt;
863 font-family:"Times New Roman";}
864 p.MsoCaption, li.MsoCaption, div.MsoCaption
871 font-family:"Times New Roman";
873 p.MsoTof, li.MsoTof, div.MsoTof
878 margin-bottom:.0001pt;
882 font-family:"Times New Roman";}
883 span.MsoFootnoteReference
884 {vertical-align:super;}
886 {vertical-align:baseline;}
887 p.MsoListBullet, li.MsoListBullet, div.MsoListBullet
892 margin-bottom:.0001pt;
894 text-indent:-12.95pt;
896 font-family:"Times New Roman";}
897 p.MsoTitle, li.MsoTitle, div.MsoTitle
906 p.MsoSubtitle, li.MsoSubtitle, div.MsoSubtitle
914 p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
916 margin-bottom:.0001pt;
919 font-family:"Times New Roman";}
922 margin-bottom:.0001pt;
924 font-family:"Courier New";}
925 p.TextFontCX, li.TextFontCX, div.TextFontCX
927 margin-bottom:.0001pt;
930 font-family:"Times New Roman";}
931 p.Appendix, li.Appendix, div.Appendix
937 page-break-after:avoid;
939 font-family:"Times New Roman";
941 p.Heading10, li.Heading10, div.Heading10
947 page-break-after:avoid;
949 font-family:"Times New Roman";
950 letter-spacing:-.4pt;
952 p.Heading11, li.Heading11, div.Heading11
958 page-break-after:avoid;
960 font-family:"Times New Roman";
961 letter-spacing:-.4pt;
971 {font-family:"Courier New";}
973 {font-family:"Courier New";
979 {font-family:"Courier New";
983 {font-family:"Times New Roman";
985 p.Author, li.Author, div.Author
994 p.Verbatim, li.Verbatim, div.Verbatim
996 margin-bottom:.0001pt;
998 font-family:"Courier New";
1000 p.lclintrun, li.lclintrun, div.lclintrun
1002 margin-bottom:.0001pt;
1004 font-family:"Arial Narrow";}
1005 p.IndentText, li.IndentText, div.IndentText
1010 margin-bottom:.0001pt;
1013 font-family:"Times New Roman";}
1014 p.beforelist, li.beforelist, div.beforelist
1017 margin-bottom:6.0pt;
1021 font-family:"Times New Roman";}
1022 p.example, li.example, div.example
1025 margin-bottom:6.0pt;
1028 font-family:"Courier New";
1030 p.skiplist, li.skiplist, div.skiplist
1035 margin-bottom:.0001pt;
1038 font-family:"Times New Roman";}
1039 p.afterlist, li.afterlist, div.afterlist
1044 margin-bottom:.0001pt;
1047 font-family:"Times New Roman";}
1048 p.betweenlists, li.betweenlists, div.betweenlists
1051 margin-bottom:6.0pt;
1055 font-family:"Times New Roman";}
1056 p.indentbefore, li.indentbefore, div.indentbefore
1059 margin-bottom:6.0pt;
1063 font-family:"Times New Roman";}
1064 p.indentbefore0, li.indentbefore0, div.indentbefore0
1067 margin-bottom:6.0pt;
1071 font-family:"Times New Roman";}
1075 p.Sidebar, li.Sidebar, div.Sidebar
1077 margin-bottom:.0001pt;
1079 font-family:"Times New Roman";}
1080 p.URL, li.URL, div.URL
1082 margin-bottom:.0001pt;
1086 span.StyleKeywordBold
1087 {font-family:"Courier New";
1090 p.ProgramName, li.ProgramName, div.ProgramName
1092 margin-bottom:.0001pt;
1097 {font-family:"Courier New";}
1098 span.ProgramNameChar
1099 {font-family:Arial;}
1101 {font-family:ProgramTwo;
1103 p.fileName, li.fileName, div.fileName
1108 margin-bottom:.0001pt;
1111 p.FileName0, li.FileName0, div.FileName0
1116 margin-bottom:.0001pt;
1120 {font-family:Arial;}
1122 {text-decoration:none;}
1124 {text-decoration:underline;}
1126 {text-decoration:line-through;
1128 /* Page Definitions */
1131 margin:1.0in 1.25in .75in 1.25in;}
1136 margin:1.0in 1.25in 1.0in 99.35pt;}
1141 margin:1.0in 1.25in 1.0in 99.35pt;}
1146 margin:1.0in 1.25in 1.0in 99.0pt;}
1151 margin:1.0in 1.25in 1.0in 1.25in;}
1156 margin:1.0in 1.25in 1.0in 1.25in;}
1161 margin:1.0in 1.25in 1.0in 1.25in;}
1166 margin:1.0in 1.25in 1.0in 1.25in;}
1169 /* List Definitions */
1171 {margin-bottom:0in;}
1173 {margin-bottom:0in;}
1178 <!--#include virtual="header.html"-->
1179 <div class="Section1">
1180 <p class="MsoTitle"><img width="189" height="219" src=
1181 "manual-301_files/image001.jpg" hspace="12"><a name=
1182 "_Ref533872469"></a></p>
1183 <p class="MsoTitle"><a name="_Ref483663680"></a><span class=
1184 "MsoCommentReference"><span style=
1185 'font-size:20.0pt'> </span></span></p>
1186 <p class="MsoTitle"><span class=
1187 "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
1188 </span></span></p>
1189 <p class="MsoTitle"><span class=
1190 "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
1191 </span></span></p>
1192 <p class="MsoTitle"><span class=
1193 "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
1194 </span></span></p>
1195 <p class="MsoTitle"><span class=
1196 "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
1197 Splint Manual</span></span></p>
1198 <p class="MsoTitle"><span class=
1199 "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
1200 </span></span></p>
1201 <p class="MsoSubtitle"><span class=
1202 "MsoCommentReference"><span style=
1203 'font-size: 18.0pt;font-family:"Book Antiqua"'>Version
1204 3.1.1</span></span></p>
1205 <p class="MsoSubtitle"><span class=
1206 "MsoCommentReference"><span style=
1207 'font-size: 18.0pt;font-family:"Book Antiqua"'>27 April 2003
1209 <p class="MsoSubtitle"><span class=
1210 "MsoCommentReference"><span style=
1211 'font-size: 15.5pt'> </span></span></p>
1212 <p class="MsoSubtitle"><span class=
1213 "MsoCommentReference"><span style=
1214 'font-size: 15.5pt'> </span></span></p>
1215 <p class="MsoSubtitle"><span class=
1216 "MsoCommentReference"><span style=
1217 'font-size: 15.5pt'> </span></span></p>
1218 <p class="MsoNormal"><span class=
1219 "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
1220 </span></span></p>
1221 <p class="MsoNormal"><span class=
1222 "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
1223 </span></span></p>
1224 <p class="MsoNormal"><span class=
1225 "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
1226 </span></span></p>
1227 <p class="MsoNormal"><span class=
1228 "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
1229 </span></span></p>
1230 <p class="TextFontCX"><span class=
1231 "MsoCommentReference"><span style='font-size:15.5pt'> </span></span></p>
1232 <p class="TextFontCX" align="right" style=
1233 'margin-right: -58.5pt;text-align:right'><img width="364"
1234 height="181" src="manual-301_files/image002.gif" align="left"
1235 hspace="12" alt="Text Box:
1236 Secure Programming Group
1237 University of Virginia
1238 Department of Computer Science
1241 <p class="TextFontCX" style=
1242 'margin-left:28.35pt; text-indent:-14.15pt'><span class=
1243 "MsoCommentReference"><span style=
1244 'font-size: 15.5pt'> </span></span></p>
1245 <p class="TextFontCX" align="right" style=
1246 'margin-right: 9.0pt;text-align:right'><span class=
1247 "MsoCommentReference"><i><span style=
1248 'font-size:14.0pt'> </span></i></span></p></div>
1249 <span class="MsoCommentReference"><b><i><span style=
1250 'font-size:14.0pt;font-family: Arial'><br clear="all" style=
1251 'page-break-before:auto'></span></i></b></span>
1252 <div class="Section2"><span class=
1253 "MsoCommentReference"><span style='font-size: 15.5pt;font-family:"Times New Roman"'>
1254 <br clear="all" style='page-break-before: always'></span></span>
1255 <p class="TextFontCX"><span class=
1256 "MsoCommentReference"><b><span style=
1257 'font-size:14.0pt;font-family:Arial'> </span></b></span></p>
1258 <h4 style='margin-left:0in;text-indent:0in'><span class=
1259 "MsoCommentReference"><span style=
1260 'font-size:14.0pt'>Authors</span></span></h4>
1261 <p class="TextFontCX">This manual was written by David Evans,
1262 except for Section 9 and Appendix B which were written by David
1263 Larochelle and David Evans.</p>
1264 <h4 style='margin-left:0in;text-indent:0in'><span class=
1265 "MsoCommentReference"><span style=
1266 'font-size:14.0pt'>Credits</span></span></h4>
1267 <p class="TextFontCX">Splint is developed and maintained by the
1268 Secure Programming Group at the University of Virginia Department
1269 of Computer Science. David Evans is the project leader and
1270 the primary developer of Splint. David Larochelle developed
1271 the memory bounds checking. University of Virginia students
1272 Chris Barker, David Friedman, Mike Lanouette and Hien Phan all
1273 contributed significantly to the development of Splint.</p>
1274 <p class="TextFontCX"> </p>
1275 <p class="TextFontCX">Splint is the successor to LCLint, a tool
1276 originally developed as a joint research project between the
1277 Massachusetts Institute of Technology and Digital Equipment
1278 Corporation’s System Research Center. David Evans was
1279 the primary designed and developer of LCLint. John Guttag and
1280 Jim Horning had the original idea for a static checking tool for
1281 detecting inconsistencies between LCL specifications and their C
1282 implementations. They provided valuable advice on its
1283 functionality and design and were instrumental in its
1284 development. </p>
1285 <p class="TextFontCX"> </p>
1286 <p class="TextFontCX">Splint incorporates the original LCL checker
1287 developed by Yang Meng Tan. This was built on the DECspec
1288 Project (Joe Wild, Gary Feldman, Steve Garland, and Bill
1289 McKeeman). The LSL checker used by LCLint was developed by
1290 Steve Garland. The original C grammar for LCLint was provided
1291 by Nate Osgood. This work has also benefited greatly from
1292 discussions with Mike Burrows, David Friedman, Stephen Garland,
1293 Colin Godfrey, Steve Harrison, Yanlin Huang, Daniel Jackson, John
1294 Knight, David Larochelle, Angelika Leeb, Ulana Legedza, Gary
1295 McGraw, Anya Pogosyants, Avneesh Saxena, Seejo Sebastine, Navneet
1296 Singh, Raymie Stata, Yang Meng Tan, and Mark Vandevoorde. I
1297 especially thank Angelika Leeb for many constructive comments on
1298 improving an early version of this document, Raymie Stata and Mark
1299 Vandevoorde for technical assistance, and Dorothy Curtis, Paco
1300 Hope, Scott Ruffner, Christina Jackson, David Ladd, and Jessica
1301 Greer for systems assistance.</p>
1302 <p class="TextFontCX"> </p>
1303 <p class="TextFontCX">Much of Splint’s development has been
1304 driven by feedback from users in academia and industry. Many
1305 more people than I can mention here have made contributions by
1306 suggesting improvements, reporting bugs, porting early versions of
1307 Splint to other platforms. Particularly heroic contributions
1308 have been made by Nelson Beebe, Eric Bloodworth, Jutta Degener,
1309 Rick Farnbach, Chris Flatters, Huver Hu, Alexander Mai, John Gerard
1310 Malecki, Thomas G. McWilliams, Michael Meskes, Richard
1311 O’Keefe, Jens Schweikhardt, Albert L. Ting and Jim Zelenka.
1312 Martin “Herbert” Dietze and Mike Smith performed
1313 valiantly in producing the original Win32 and OS2 ports. Tim
1314 Van Holder produced the <span class="Keyword"><span style=
1315 'font-size:10.0pt;font-family:Arial;color:windowtext'>automake</span></span>
1316 and <span class="Keyword"><span style=
1317 'font-size:10.0pt;font-family:Arial; color:windowtext'>autoconf</span></span>
1318 distribution. </p>
1319 <p class="TextFontCX"> </p>
1320 <p class="TextFontCX">
1321 Splint research at the University of Virginia is currently funded in part by an NSF CAREER Award and an NSF CCLI Award for using analysis to teach software engineering. Splint has been previously supported by a grant from NASA and David Larochelle was funded by a USENIX student research grant.
1322 <span style='font-size:20.0pt'> </span></p></div>
1323 <span class="MsoCommentReference"><span style=
1324 'font-size:15.5pt;font-family:"Times New Roman"'><br clear="all"
1325 style='page-break-before:right'></span></span>
1326 <div class="Section3">
1327 <p class="MsoToc1" align="center" style='text-align:center'>
1328 <span class="MsoCommentReference"><span style=
1329 'font-size:15.5pt'>Contents</span></span></p>
1330 <p class="MsoToc1">1<span style=
1331 'font-size:12.0pt;font-weight:normal'> </span>
1332 <a href=#operation>Operation</a>................................................................................................................
1334 <p class="MsoToc2">1.1<span style=
1335 'font-size:12.0pt'> </span>
1336 Warnings.............................................................................................................
1338 <p class="MsoToc2">1.2<span style=
1339 'font-size:12.0pt'> </span>
1340 Flags....................................................................................................................
1342 <p class="MsoToc2">1.3<span style=
1343 'font-size:12.0pt'> </span> Stylized
1344 Comments...............................................................................................
1346 <p class="MsoToc3">1.3.1<span style=
1347 'font-size:12.0pt'> </span>
1348 Annotations...................................................................................................
1350 <p class="MsoToc3">1.3.2<span style=
1351 'font-size:12.0pt'> </span> Setting
1352 Flags..................................................................................................
1354 <p class="MsoToc1">2<span style=
1355 'font-size:12.0pt;font-weight:normal'> </span>
1357 Dereferences</a>...................................................................................................
1359 <p class="MsoToc3">2.1.1<span style=
1360 'font-size:12.0pt'> </span> Predicate
1361 Functions........................................................................................
1363 <p class="MsoToc3">2.1.2<span style=
1364 'font-size:12.0pt'> </span> Notnull
1365 Annotations........................................................................................
1367 <p class="MsoToc3">2.1.3<span style=
1368 'font-size:12.0pt'> </span> Relaxing Null
1369 Checking..................................................................................
1371 <p class="MsoToc1">3<span style=
1372 'font-size:12.0pt;font-weight:normal'> </span>
1375 Values</a>....................................................................................................
1377 <p class="MsoToc3">3.1.1<span style=
1378 'font-size:12.0pt'> </span> Undefined
1379 Parameters...................................................................................
1381 <p class="MsoToc3">3.1.2<span style=
1382 'font-size:12.0pt'> </span> Relaxing
1383 Checking.........................................................................................
1385 <p class="MsoToc3">3.1.3<span style=
1386 'font-size:12.0pt'> </span> Partially
1388 Structures............................................................................
1390 <p class="MsoToc1">4<span style=
1391 'font-size:12.0pt;font-weight:normal'> </span>
1393 Types</a>.......................................................................................................................
1395 <p class="MsoToc2">4.1<span style=
1396 'font-size:12.0pt'> </span> Built in C
1397 Types....................................................................................................
1399 <p class="MsoToc3">4.1.1<span style=
1400 'font-size:12.0pt'> </span>
1401 Characters....................................................................................................
1403 <p class="MsoToc3">4.1.2<span style=
1404 'font-size:12.0pt'> </span>
1405 Enumerators..................................................................................................
1407 <p class="MsoToc3">4.1.3<span style=
1408 'font-size:12.0pt'> </span> Numeric
1409 Types..............................................................................................
1411 <p class="MsoToc3">4.1.4<span style=
1412 'font-size:12.0pt'> </span> Arbitrary
1414 Types.................................................................................
1416 <p class="MsoToc2">4.2<span style=
1417 'font-size:12.0pt'> </span> Boolean
1418 Types.....................................................................................................
1420 <p class="MsoToc2">4.3<span style=
1421 'font-size:12.0pt'> </span> Abstract
1422 Types.....................................................................................................
1424 <p class="MsoToc3">4.3.1<span style=
1425 'font-size:12.0pt'> </span> Controlling
1426 Access.........................................................................................
1428 <p class="MsoToc3">4.3.2<span style=
1429 'font-size:12.0pt'> </span>
1430 Mutability......................................................................................................
1432 <p class="MsoToc2">4.4<span style=
1433 'font-size:12.0pt'> </span>
1434 Polymorphism.......................................................................................................
1436 <p class="MsoToc1">5<span style=
1437 'font-size:12.0pt;font-weight:normal'> </span>
1440 Management</a>............................................................................................
1442 <p class="MsoToc2">5.1<span style=
1443 'font-size:12.0pt'> </span> Storage
1444 Model......................................................................................................
1446 <p class="MsoToc2">5.2<span style=
1447 'font-size:12.0pt'> </span> Deallocation
1448 Errors...............................................................................................
1450 <p class="MsoToc3">5.2.1<span style=
1451 'font-size:12.0pt'> </span> Unshared
1452 References....................................................................................
1454 <p class="MsoToc3">5.2.2<span style=
1455 'font-size:12.0pt'> </span> Temporary
1456 Parameters..................................................................................
1458 <p class="MsoToc3">5.2.3<span style=
1459 'font-size:12.0pt'> </span> Owned and
1461 References.................................................................
1463 <p class="MsoToc3">5.2.4<span style=
1464 'font-size:12.0pt'> </span> Keep
1465 Parameters...........................................................................................
1467 <p class="MsoToc3">5.2.5<span style=
1468 'font-size:12.0pt'> </span> Shared
1469 References........................................................................................
1471 <p class="MsoToc3">5.2.6<span style=
1472 'font-size:12.0pt'> </span> Stack
1473 References..........................................................................................
1475 <p class="MsoToc3">5.2.7<span style=
1476 'font-size:12.0pt'> </span> Inner
1477 Storage.................................................................................................
1479 <p class="MsoToc2">5.3<span style=
1480 'font-size:12.0pt'> </span> Implicit Memory
1481 Annotations.................................................................................
1483 <p class="MsoToc2">5.4<span style=
1484 'font-size:12.0pt'> </span> Reference
1485 Counting..............................................................................................
1487 <p class="MsoToc1">6<span style=
1488 'font-size:12.0pt;font-weight:normal'> </span>
1490 Sharing</a>....................................................................................................................
1492 <p class="MsoToc2">6.1<span style=
1493 'font-size:12.0pt'> </span>
1494 Aliasing................................................................................................................
1496 <p class="MsoToc3">6.1.1<span style=
1497 'font-size:12.0pt'> </span> Unique
1498 Parameters........................................................................................
1500 <p class="MsoToc3">6.1.2<span style=
1501 'font-size:12.0pt'> </span> Returned
1502 Parameters.....................................................................................
1504 <p class="MsoToc2">6.2<span style=
1505 'font-size:12.0pt'> </span>
1506 Exposure..............................................................................................................
1508 <p class="MsoToc3">6.2.1<span style=
1509 'font-size:12.0pt'> </span> Read-Only
1510 Storage........................................................................................
1512 <p class="MsoToc3">6.2.2<span style=
1513 'font-size:12.0pt'> </span> Exposed
1514 Storage............................................................................................
1516 <p class="MsoToc1">7<span style=
1517 'font-size:12.0pt;font-weight:normal'> </span>
1520 Interfaces</a>.................................................................................................
1522 <p class="MsoToc2">7.1<span style=
1523 'font-size:12.0pt'> </span>
1524 Modifications........................................................................................................
1526 <p class="MsoToc3">7.1.1<span style=
1527 'font-size:12.0pt'> </span> State
1528 Modifications........................................................................................
1530 <p class="MsoToc3">7.1.2<span style=
1531 'font-size:12.0pt'> </span> Missing Modifies
1532 Clauses...............................................................................
1534 <p class="MsoToc2">7.2<span style=
1535 'font-size:12.0pt'> </span> Global
1536 Variables...................................................................................................
1538 <p class="MsoToc3">7.2.1<span style=
1539 'font-size:12.0pt'> </span> Controlling
1541 Checking..........................................................................
1543 <p class="MsoToc3">7.2.2<span style=
1544 'font-size:12.0pt'> </span> Definition
1545 State..............................................................................................
1547 <p class="MsoToc2">7.3<span style=
1548 'font-size:12.0pt'> </span> Declaration
1549 Consistency........................................................................................
1551 <p class="MsoToc2">7.4<span style=
1552 'font-size:12.0pt'> </span> State
1553 Clauses.......................................................................................................
1555 <p class="MsoToc2">7.5<span style=
1556 'font-size:12.0pt'> </span> Requires and
1558 Clauses...............................................................................
1560 <p class="MsoToc1">8<span style=
1561 'font-size:12.0pt;font-weight:normal'> </span>
1564 Flow</a>...........................................................................................................
1566 <p class="MsoToc2">8.1<span style=
1567 'font-size:12.0pt'> </span>
1568 Execution.............................................................................................................
1570 <p class="MsoToc2">8.2<span style=
1571 'font-size:12.0pt'> </span> Undefined
1572 Behavior..............................................................................................
1574 <p class="MsoToc2">8.3<span style=
1575 'font-size:12.0pt'> </span> Problematic
1577 Structures..............................................................................
1579 <p class="MsoToc3">8.3.1<span style=
1580 'font-size:12.0pt'> </span> Likely Infinite
1581 Loops......................................................................................
1583 <p class="MsoToc3">8.3.2<span style=
1584 'font-size:12.0pt'> </span>
1585 Switches.......................................................................................................
1587 <p class="MsoToc3">8.3.3<span style=
1588 'font-size:12.0pt'> </span> Deep
1589 Breaks.................................................................................................
1591 <p class="MsoToc3">8.3.4<span style=
1592 'font-size:12.0pt'> </span> Loop and If
1593 Bodies........................................................................................
1595 <p class="MsoToc3">8.3.5<span style=
1596 'font-size:12.0pt'> </span> Complete
1597 Logic.............................................................................................
1599 <p class="MsoToc2">8.4<span style=
1600 'font-size:12.0pt'> </span> Suspicious
1601 Statements...........................................................................................
1603 <p class="MsoToc3">8.4.1<span style=
1604 'font-size:12.0pt'> </span> Statements with
1606 Effects............................................................................
1608 <p class="MsoToc3">8.4.2<span style=
1609 'font-size:12.0pt'> </span> Ignored Return
1610 Values...................................................................................
1612 <p class="MsoToc1">9<span style=
1613 'font-size:12.0pt;font-weight:normal'> </span>
1616 Sizes</a>.............................................................................................................
1618 <p class="MsoToc2">9.1<span style=
1619 'font-size:12.0pt'> </span> Checking
1620 Accesses..............................................................................................
1622 <p class="MsoToc2">9.2<span style=
1623 'font-size:12.0pt'> </span> Annotating
1625 Sizes........................................................................................
1627 <p class="MsoToc2">9.3<span style=
1628 'font-size:12.0pt'> </span>
1629 Warnings.............................................................................................................
1631 <p class="MsoToc1">10<span style=
1632 'font-size:12.0pt;font-weight:normal'> </span>
1633 <a href=#extensible>
1635 Checking</a>............................................................................................
1637 <p class="MsoToc2">10.1<span style=
1638 'font-size:12.0pt'> </span>
1640 Attributes............................................................................................
1642 <p class="MsoToc2">10.2<span style=
1643 'font-size:12.0pt'> </span>
1644 Annotations......................................................................................................
1646 <p class="MsoToc2">10.3<span style=
1647 'font-size:12.0pt'> </span>
1648 Example...........................................................................................................
1650 <p class="MsoToc1">11<span style=
1651 'font-size:12.0pt;font-weight:normal'> </span>
1653 Macros</a>..................................................................................................................
1655 <p class="MsoToc2">11.1<span style=
1656 'font-size:12.0pt'> </span>
1658 Macros...............................................................................................
1660 <p class="MsoToc2">11.2<span style=
1661 'font-size:12.0pt'> </span>
1663 Macros.........................................................................................
1665 <p class="MsoToc3">11.2.1<span style=
1666 'font-size:12.0pt'> </span> Side
1668 Parameters.......................................................................
1670 <p class="MsoToc2">11.3<span style=
1671 'font-size:12.0pt'> </span>
1673 Checking...............................................................................
1675 <p class="MsoToc2">11.4<span style=
1676 'font-size:12.0pt'> </span>
1677 Iterators...........................................................................................................
1679 <p class="MsoToc3">11.4.1<span style=
1680 'font-size:12.0pt'> </span>
1682 Iterators.......................................................................................
1684 <p class="MsoToc3">11.4.2<span style=
1685 'font-size:12.0pt'> </span>
1687 Iterators...........................................................................................
1689 <p class="MsoToc1">12<span style=
1690 'font-size:12.0pt;font-weight:normal'> </span>
1693 Conventions</a>............................................................................................
1695 <p class="MsoToc2">12.1<span style=
1696 'font-size:12.0pt'> </span>
1698 Conventions......................................................................
1700 <p class="MsoToc3">12.1.1<span style=
1701 'font-size:12.0pt'> </span>
1703 Names.............................................................................................
1705 <p class="MsoToc3">12.1.2<span style=
1706 'font-size:12.0pt'> </span>
1708 Names............................................................................................
1710 <p class="MsoToc3">12.1.3<span style=
1711 'font-size:12.0pt'> </span>
1713 Names..................................................................................
1715 <p class="MsoToc2">12.2<span style=
1716 'font-size:12.0pt'> </span>
1718 Prefixes.........................................................................................
1720 <p class="MsoToc2">12.3<span style=
1721 'font-size:12.0pt'> </span>
1723 Restrictions..........................................................................................
1725 <p class="MsoToc3">12.3.1<span style=
1726 'font-size:12.0pt'> </span>
1728 Names........................................................................................
1730 <p class="MsoToc3">12.3.2<span style=
1731 'font-size:12.0pt'> </span>
1733 Names...........................................................................................
1735 <p class="MsoToc1">13<span style=
1736 'font-size:12.0pt;font-weight:normal'> </span>
1737 <a href=#completeness>
1738 Completeness</a>.......................................................................................................
1740 <p class="MsoToc2">13.1<span style=
1741 'font-size:12.0pt'> </span>
1743 Declarations.........................................................................................
1745 <p class="MsoToc2">13.2<span style=
1746 'font-size:12.0pt'> </span>
1748 Programs...........................................................................................
1750 <p class="MsoToc3">13.2.1<span style=
1751 'font-size:12.0pt'> </span>
1752 Unnecessarily External
1753 Names....................................................................
1755 <p class="MsoToc3">13.2.2<span style=
1756 'font-size:12.0pt'> </span>
1757 Declarations Missing from
1758 Headers.............................................................
1760 <p class="MsoToc1">14<span style=
1761 'font-size:12.0pt;font-weight:normal'> </span>
1763 Libraries and Header File
1764 Inclusion</a>....................................................................
1766 <p class="MsoToc2">14.1<span style=
1767 'font-size:12.0pt'> </span>
1769 Libraries.............................................................................................
1771 <p class="MsoToc3">14.1.1<span style=
1772 'font-size:12.0pt'> </span> ISO
1774 Library..................................................................................
1776 <p class="MsoToc3">14.1.2<span style=
1777 'font-size:12.0pt'> </span>
1779 Library...........................................................................................
1781 <p class="MsoToc3">14.1.3<span style=
1782 'font-size:12.0pt'> </span> UNIX
1783 Library............................................................................................
1785 <p class="MsoToc3">14.1.4<span style=
1786 'font-size:12.0pt'> </span>
1788 Libraries............................................................................................
1790 <p class="MsoToc2">14.2<span style=
1791 'font-size:12.0pt'> </span>
1793 Libraries..........................................................................................
1795 <p class="MsoToc3">14.2.1<span style=
1796 'font-size:12.0pt'> </span>
1797 Generating the Standard
1798 Libraries................................................................
1800 <p class="MsoToc2">14.3<span style=
1801 'font-size:12.0pt'> </span>
1803 Inclusion.........................................................................................
1805 <p class="MsoToc3">14.3.1<span style=
1806 'font-size:12.0pt'> </span>
1808 Constants.............................................................................
1810 <p class="MsoToc1">Appendix A<span style=
1811 'font-size:12.0pt;font-weight:normal'> </span>
1812 <a href=#availability>
1813 Availability</a>...............................................................................................
1815 <p class="MsoToc1">Appendix B<span style=
1816 'font-size:12.0pt;font-weight:normal'> </span>
1818 Flags</a>........................................................................................................
1820 <p class="MsoToc2">Global
1821 Flags...................................................................................................................
1824 Help..........................................................................................................................
1827 Initialization................................................................................................................
1830 Pre-processor............................................................................................................
1833 Libraries....................................................................................................................
1836 Output.......................................................................................................................
1838 <p class="MsoToc3">Expected
1839 Errors.........................................................................................................
1841 <p class="MsoToc2">Message
1842 Format............................................................................................................
1844 <p class="MsoToc2">Mode Selector
1845 Flags.......................................................................................................
1847 <p class="MsoToc2">Checking
1848 Flags...............................................................................................................
1851 Key...........................................................................................................................
1854 Types........................................................................................................................
1856 <p class="MsoToc3">Function
1857 Interfaces.....................................................................................................
1859 <p class="MsoToc3">Memory
1860 Management................................................................................................
1863 Sharing......................................................................................................................
1865 <p class="MsoToc3">Use Before Definition <i>(Section
1866 3)</i>...............................................................................
1868 <p class="MsoToc3">Null Dereferences <i>(Section
1869 2)</i>....................................................................................
1871 <p class="MsoToc3">Macros <i>(Section
1872 7)</i>....................................................................................................
1875 Iterators.....................................................................................................................
1877 <p class="MsoToc3">Naming
1878 Conventions...................................................................................................
1880 <p class="MsoToc3">Other
1881 Checks.............................................................................................................
1883 <p class="MsoToc2">Flag Name
1884 Abbreviations................................................................................................
1886 <p class="MsoToc1">Appendix C<span style=
1887 'font-size:12.0pt;font-weight:normal'> </span>
1888 <a href=#annotations>
1889 Annotations</a>.............................................................................................
1891 <p class="MsoToc3">Suppressing
1892 Warnings.................................................................................................
1894 <p class="MsoToc2">Syntactic
1895 Annotations.....................................................................................................
1898 Functions...................................................................................................................
1900 <p class="MsoToc3">Iterators (Section
1901 11.4)...............................................................................................
1903 <p class="MsoToc3">Constants (Section
1904 11.1).............................................................................................
1906 <p class="MsoToc3">Alternate Types (Section
1907 4.4)......................................................................................
1909 <p class="MsoToc3">Declarator
1910 Annotations...............................................................................................
1912 <p class="MsoToc3">Type
1913 Access..............................................................................................................
1915 <p class="MsoToc3">Macro
1916 Expansion......................................................................................................
1918 <p class="MsoToc3">Arbitrary Integral
1919 Types............................................................................................
1921 <p class="MsoToc3">Traditional Lint
1922 Comments........................................................................................
1924 <p class="MsoToc2">Metastate
1925 Definitions....................................................................................................
1927 <p class="MsoToc1">Appendix D<span style=
1928 'font-size:12.0pt;font-weight:normal'> </span>
1929 <a href=#specifications>
1930 Specifications<a/>.........................................................................................
1932 <p class="MsoToc3">Specification
1933 Flags....................................................................................................
1936 Appendix E<span style=
1937 'font-size:12.0pt;font-weight:normal'> </span>
1940 Bibliography</a>........................................................................
1943 <p class="TextFontCX"> </p></div>
1944 <span class="MsoCommentReference"><b><i><span style=
1945 'font-size:15.5pt;font-family: "Times New Roman";text-transform:uppercase'>
1946 <br clear="all" style=
1947 'page-break-before: right'></span></i></b></span>
1948 <div class="Section4">
1949 <p class="TextFontCX"><span style=
1950 'font-size:16.0pt'> </span></p>
1951 <p class="MsoNormal" align="center" style='text-align:center'>
1952 <b><span style='font-size:16.0pt'>Splint User’s
1953 Manual</span></b></p>
1954 <p class="MsoNormal" align="center" style='text-align:center'>
1956 <p class="MsoNormal" align="center" style='text-align:center'>
1958 <p class="MsoNormal" align="center" style='text-align:center'>7
1960 <p class="TextFontCX"> </p>
1961 <p class="TextFontCX">Splint<a href="#_ftn1" name="_ftnref1"
1962 title=""><span class="MsoFootnoteReference"><span class=
1963 "MsoFootnoteReference"><span style=
1964 'font-size:11.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>
1965 is a tool for statically checking C programs for security
1966 vulnerabilities and programming mistakes. Splint does many
1967 of the traditional lint checks including unused declarations,
1968 type inconsistencies, use before definition, unreachable code,
1969 ignored return values, execution paths with no return, likely
1970 infinite loops, and fall through cases. More powerful
1971 checks are made possible by additional information given in
1972 source code annotations. Annotations are stylized
1973 comments that document assumptions about functions, variables,
1974 parameters and types. In addition to the checks
1975 specifically enabled by annotations, many of the traditional
1976 lint checks are improved by exploiting this additional
1978 <p class="TextFontCX"> </p>
1979 <p class="TextFontCX">As more effort is put into annotating
1980 programs, better checking results. A representational
1981 effort-benefit curve for using Splint is shown in Figure 1.
1982 Splint is designed to be flexible and allow programmers to select
1983 appropriate points on the effort-benefit curve for particular
1984 projects. As different checks are turned on and more
1985 information is given in code annotations the number of bugs that
1986 can be detected increases dramatically.</p>
1987 <p class="TextFontCX"> </p>
1988 <p class="beforelist">Problems detected by Splint include:</p>
1989 <p class="TextFontCX" style=
1990 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
1991 'font-family:Symbol'>·<span style=
1992 'font:7.0pt "Times New Roman"'> </span></span>
1993 Dereferencing a possibly null pointer (Section 2);</p>
1994 <p class="TextFontCX" style=
1995 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
1996 'font-family:Symbol'>·<span style=
1997 'font:7.0pt "Times New Roman"'> </span></span>
1998 Using possibly undefined storage or returning storage that is not
1999 properly defined (Section 3);</p>
2000 <p class="MsoListBullet"><span style=
2001 'font-family:Symbol'>·<span style=
2002 'font:7.0pt "Times New Roman"'> </span></span>
2003 Type mismatches, with greater precision and flexibility than
2004 provided by C compilers (Section 4.1–4.2);</p>
2005 <p class="MsoListBullet"><span style=
2006 'font-family:Symbol'>·<span style=
2007 'font:7.0pt "Times New Roman"'> </span></span>
2008 Violations of information hiding (Section 4.3);</p>
2009 <p class="TextFontCX" style=
2010 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
2011 'font-family:Symbol'>·<span style=
2012 'font:7.0pt "Times New Roman"'> </span></span>
2013 Memory management errors including uses of dangling references and
2014 memory leaks (Section 5);</p>
2015 <p class="TextFontCX" style=
2016 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
2017 'font-family:Symbol'>·<span style=
2018 'font:7.0pt "Times New Roman"'> </span></span>
2019 Dangerous aliasing (Section 6);</p>
2020 <p class="TextFontCX" style=
2021 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
2022 'font-family:Symbol'>·<span style=
2023 'font:7.0pt "Times New Roman"'> </span></span>
2024 Modifications and global variable uses that are inconsistent with
2025 specified interfaces (Section 7);</p>
2026 <p class="TextFontCX" style=
2027 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
2028 'font-family:Symbol'>·<span style=
2029 'font:7.0pt "Times New Roman"'> </span></span>
2030 Problematic control flow such as likely infinite loops (Section
2031 8.3.1), fall through cases or incomplete switches (Section 8.3.2),
2032 and suspicious statements (Section 8.4);</p>
2033 <p class="TextFontCX" style=
2034 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
2035 'font-family:Symbol'>·<span style=
2036 'font:7.0pt "Times New Roman"'> </span></span>
2037 Buffer overflow vulnerabilities (Section 9);</p>
2038 <p class="TextFontCX" style=
2039 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
2040 'font-family:Symbol'>·<span style=
2041 'font:7.0pt "Times New Roman"'> </span></span>
2042 Dangerous macro implementations or invocations (Section 11);
2044 <p class="TextFontCX" style=
2045 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
2046 'font-family:Symbol'>·<span style=
2047 'font:7.0pt "Times New Roman"'> </span></span>
2048 Violations of customized naming conventions. (Section
2050 <p class="TextFontCX"> </p>
2051 <p class="MsoCaption"> </p>
2052 <center><img width="572" height="350" src=
2053 "manual-301_files/image003.gif">
2057 <p class="MsoCaption"><a name="_Toc534824605"></a><a name=
2058 "_Ref534821281">Figure</a> 1. Typical Effort-Benefit
2060 <p class="TextFontCX"> </p>
2061 <p class="TextFontCX">Splint checking can be customized to select
2062 what classes of errors are reported using command line flags and
2063 stylized comments in the code. In addition, users can define
2064 new annotations and associated checks to extend Splint’s
2065 checking or to enforce application specific properties (Section
2067 <p class="TextFontCX"><a name="_Ref343085763"></a><a name=
2068 "_Ref343065516"> </a></p>
2069 <p class="TextFontCX"><b>About This Document</b></p>
2070 <p class="TextFontCX">This document is a guide to using
2071 Splint. Section 1 explains how to run Splint, interpret
2072 messages and control checking. Sections 2–13 describe
2073 particular checks done by Splint. There are some minor
2074 dependencies between sections, but in general they can be read in
2075 any order. Section 14 covers issues involving libraries and
2076 header file inclusion important for running Splint on large
2078 <p class="TextFontCX"> </p>
2079 <p class="TextFontCX">This document does not describe technical
2080 details of the checking. For technical background and
2081 analysis of Splint’s effectiveness in practice, see the
2082 papers available at <a href=
2083 "http://www.splint.org/"><span style='font-size:10.0pt;font-family:Arial'>
2084 http://www.splint.org</span></a>. </p>
2086 <table cellspacing="0" cellpadding="0" hspace="0" width="80%"
2087 style="border-collapse: collapse" bordercolor="#111111">
2089 <td valign="top" align="left" style=
2090 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
2091 <p class="TextFontCX" align="right" style='text-align:right'>
2092 <a name="_Ref349497354"></a><a name=
2093 "_Ref348079997"><i><span style='font-size:9.0pt'>Since human
2094 beings themselves are not fully debugged yet, there will be
2095 bugs in your code no matter what you do.</span></i></a></p>
2096 <p class="TextFontCX" align="right" style=
2097 'margin-left:4.5pt;text-align:right'><span style=
2098 'font-size:9.0pt'>Chris Mason,</span><i><span style=
2099 'font-size:9.0pt'>Zero-defects memo</span></i>
2100 <span style='font-size:9.0pt'>(quoted in <i>Microsoft
2101 Secrets</i>, Cusumano and
2102 Selby)</span></p></td></tr></table></center>
2103 <h1 style='margin-left:0in;text-indent:0in'><a name=
2104 "Section1"></a><a name="_Toc534974932"></a><a name=
2105 "_Ref348785755">1<span style=
2106 'font:7.0pt "Times New Roman"'> </span>
2107 <a id="operation" name="operation"> Operation</a></h1>
2108 <p class="TextFontCX">Splint is invoked by listing files to be
2109 checked. Initialization files, command line flags, and
2110 stylized comments may be used to customize checking globally and
2112 <p class="TextFontCX"> </p>
2113 <p class="TextFontCX">The best way to learn to use Splint, of
2114 course, is to actually use it (if you don’t already have
2115 Splint installed on your system, see Appendix A). Before you
2116 read much further in this document, I recommend finding a small C
2117 program. Then, try running:</p>
2118 <p class="example" align="left">splint *.c</p>
2121 <p class="TextFontCX">For the most C programs, this will produce a
2122 large number of warnings. To turn off reporting for some of
2123 the warnings, try:<a name="_Ref347468509"></a><a name=
2124 "_Ref345591726"></a><a name="_Ref345568136"></a><a name=
2125 "_Ref345515100"></a><a name="_Ref345497041"></a><a name=
2126 "_Ref345435155"></a><a name="_Ref345257971"></a><a name=
2127 "_Ref344916723"></a><a name="_Ref344907348"></a><a name=
2128 "_Ref344891202"></a><a name="_Toc344355397"></a></p>
2129 <p class="example" align="left">splint -weak *.c</p>
2132 <p class="TextFontCX">The <span class="Flag"><span style=
2133 'font-size:10.0pt'>-weak</span></span> flag is a mode flag that
2134 sets many checking parameters to select weaker checking than is
2135 done in the default mode. Other Splint flags will be
2136 introduced in the following sections; a complete list is given in
2138 <h2 style='margin-left:0in;text-indent:0in'><a name=
2139 "_Toc534974933"></a><a name="_Toc344355435">1.1<span style=
2140 'font:7.0pt "Times New Roman"'> </span>
2142 <p class="beforelist">A typical warning message is:</p>
2143 <p class="IndentText" align="left" style="margin-bottom: 0.0003pt">
2144 <span style='font-size:10.0pt;font-family:Arial'>sample.c: (in
2145 function faucet)</span></p>
2146 <p class="IndentText" align="left"><span style=
2147 'font-size:10.0pt;font-family:Arial'>sample.c:11:12</span><span style='font-size:10.0pt; font-family:Arial'>
2148 : Fresh storage x not released before return</span></p>
2149 <p class="IndentText" align="left"><span style=
2150 'font-size:10.0pt;font-family:Arial'> A memory leak has been
2151 detected. Storage allocated locally is not released</span></p>
2152 <p class="IndentText" align="left"><span style=
2153 'font-size:10.0pt;font-family:Arial'> before the last
2154 reference to it is lost. (Use -mustfreefresh to inhibit</span></p>
2155 <p class="IndentText" align="left"><span style=
2156 'font-size:10.0pt;font-family:Arial'> warning)</span></p>
2157 <p class="IndentText" align="left"><span style=
2158 'font-size:10.0pt;font-family:Arial'> sample.c:5:47:
2159 Fresh storage x allocated</span></p>
2162 <p class="afterlist">The first line gives the name of the function
2163 in which the error is found. This is printed before the first
2164 message reported for a function. The second line is the text
2165 of the message. This message reports a memory
2166 leak—storage allocated in a function is not deallocated
2167 before the function returns. The file name, line and column
2168 number where the error is located precedes the text. </p>
2169 <p class="TextFontCX"> </p>
2170 <p class="TextFontCX">The next line is a hint giving more
2171 information about the suspected error, including information on how
2172 the warning message may be suppressed. For this message,
2173 using the <span class="Flag"><span style=
2174 'font-size:10.0pt'>‑mustfreefresh</span></span> flag
2175 would prevent this warning from being reported. This flag can
2176 be set at the command line, or more precisely just around the code
2177 point in question by using annotations (see Section 1.3.2).</p>
2178 <p class="TextFontCX"> </p>
2179 <p class="TextFontCX">The final line of the message gives
2180 additional location information. For this message, it tells
2181 where the leaking storage was allocated.</p>
2182 <p class="TextFontCX"> </p>
2183 <p class="beforelist">The generic message format is (parts enclosed
2184 in square brackets are optional):</p>
2185 <p class="Verbatim" align="left"><span style=
2186 'font-family:Arial'> [<file>:<line> (in
2187 <context>)]</span></p>
2188 <p class="Verbatim" align="left"><span style=
2189 'font-family:Arial'>
2190 <file>:<line>[,<column>]:
2191 <i>message</i></span></p>
2192 <p class="Verbatim" align="left"><span style=
2193 'font-family:Arial'>
2194 [<i>hint</i>]</span></p>
2195 <p class="Verbatim" align="left"><span style=
2196 'font-family:Arial'>
2197 <file>:<line>,<column>: <i>extra location
2198 information, if appropriate</i></span></p>
2201 <p class="afterlist">Users can customize the format and content of
2202 messages printed by Splint. The function context is not
2203 printed if <span class="Flag"><span style=
2204 'font-size:10.0pt'>-showfunc</span></span> is used.
2205 Column numbers are not printed if <span class=
2206 "Flag"><span style='font-size:10.0pt'>‑showcol</span></span> is
2207 used. The <span class="Flag"><span style=
2208 'font-size:10.0pt'>+parenfileformat</span></span> flag
2209 can be used to generate file locations in the format
2210 recognized by Microsoft Visual Studio. If <span class=
2212 'font-size:10.0pt'>+parenfileformat</span></span> is set, the
2213 line number follows the file name in parentheses (e.g.,
2214 <span class="PlainText"><span style=
2215 'font-size:10.0pt;font-family:Arial'>sample.c(11)</span></span>.)
2216 Messages are split into lines of length less than the
2217 value set using <span class="Flag"><span style=
2218 'font-size:10.0pt'>-linelen
2219 <i><number></i></span></span>. The default line
2220 length is 80 characters. Splint attempts to split lines
2221 in a sensible place as near to the line length limit as
2223 <p class="afterlist" style='margin-top:0in'> </p>
2224 <p class="afterlist" style='margin-top:0in'>The <span class=
2226 'font-size:10.0pt'>‑hints</span></span> prevents any
2227 hints from being printed. Normally, a hint is given only the
2228 first time a class of error is reported. To have Splint print
2229 a hint for every message regardless, use <span class=
2231 'font-size:10.0pt'>+forcehints</span></span>.</p>
2232 <h2 style='margin-left:0in;text-indent:0in'><a name=
2233 "_Toc534974934"></a><a name="_Ref348343333"></a><a name=
2234 "_Ref348343330"></a><a name="_Ref348092990"></a><a name=
2235 "_Ref344882148"></a><a name="_Ref344870278"></a><a name=
2236 "_Toc344355436">1.2<span style=
2237 'font:7.0pt "Times New Roman"'> </span>
2239 <p class="TextFontCX">So that many programming styles can be
2240 supported, Splint provides several hundred flags for controlling
2241 checking and message reporting. Some of the flags are
2242 introduced in the body of this document. Appendix B describes
2243 every flag. Modes and shortcut flags are provided for setting
2244 many flags at once. Individual flags can override the mode
2246 <p class="TextFontCX"> </p>
2247 <p class="TextFontCX">Flags are preceded by <span class=
2248 "Flag"><span style='font-size:10.0pt'>+</span></span> or
2249 <span class="Flag"><span style=
2250 'font-size:10.0pt'>-</span></span>. When a flag is preceded
2251 by <span class="Flag"><span style=
2252 'font-size:10.0pt'>+</span></span> we say it is <i>on</i>; when it
2253 is preceded by <span class="Flag"><span style=
2254 'font-size:10.0pt'>-</span></span> it is <i>off</i>. The precise
2255 meaning of on and off depends on the type of flag. </p>
2256 <p class="TextFontCX"> </p>
2257 <p class="TextFontCX">The <span class="Flag"><span style=
2258 'font-size:10.0pt'>+</span></span>/<span class=
2259 "Flag"><span style='font-size:10.0pt'>-</span></span> flag
2260 settings are used for consistency and clarity, but contradict
2261 standard UNIX usage and it is easy to accidentally use the
2262 wrong one. To reduce the likelihood of using the wrong
2263 flag, Splint issues warnings when a flag is set in an unusual
2264 way. Warnings are issued when a flag is redundantly set
2265 to the value it already had (these errors are not reported if
2266 the flag is set using a stylized comment), if a mode flag or
2267 special flag is set after a more specific flag that will be
2268 set by the general flag was already set, if value flags are
2269 given unreasonable values, of if flags are set in an
2270 inconsistent way. The <span class="Flag"><span style=
2271 'font-size: 10.0pt'>-warnflags</span></span> flag
2272 suppresses these warnings.</p>
2273 <p class="TextFontCX"> </p>
2274 <p class="TextFontCX">Default flag settings will be read from
2275 <span class="Keyword"><span style=
2276 'font-size:10.0pt;font-family: Arial;color:windowtext'>~/.splintrc</span></span> if
2277 it is readable. If there is a <span class=
2278 "Keyword"><span style=
2279 'font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span> file
2280 in the working directory, settings in this file will be read next
2281 and its settings will override those in <span class=
2282 "Keyword"><span style=
2283 'font-size:10.0pt;font-family:Arial; color:windowtext'>~/.splintrc</span></span>.
2284 Command-line flags override settings in either file. The
2285 syntax of the <span class="Keyword"><span style=
2286 'font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span> file
2287 is the same as that of command-line flags, except that flags may be
2288 on separate lines and the <span class="CodeText"><span style=
2289 'font-size:10.0pt'>#</span></span> character may be used to
2290 indicate that the remainder of the line is a comment. The
2291 <span class="Flag"><span style=
2292 'font-size:10.0pt'>-nof</span></span> flag prevents the
2293 <span class="Keyword"><span style=
2294 'font-size:10.0pt;font-family: Arial;color:windowtext'>~/.splintrc</span></span> file
2295 from being loaded. The <span class="Flag"><span style=
2296 'font-size:10.0pt'>-f</span></span> <span class=
2298 'font-size:10.0pt'><i><filename></i></span></span> flag
2299 loads options from <i>filename</i>.</p>
2300 <p class="TextFontCX"> </p>
2301 <p class="TextFontCX">To make flag names more readable, hyphens
2302 (<span class="Flag"><span style=
2303 'font-size:10.0pt'>-</span></span>), underscores
2304 (<span class="Flag"><span style=
2305 'font-size:10.0pt'>_</span></span>) and spaces in flags at
2306 the command line are ignored. Hence, <span class=
2308 'font-size:10.0pt'>warnflags</span></span>, <span class=
2310 'font-size:10.0pt'>warn-flags</span></span> and <span class=
2312 'font-size:10.0pt'>warn_flags</span></span> all select the
2313 <span class="Flag"><span style=
2314 'font-size:10.0pt'>warnflags</span></span> option.</p>
2315 <h2 style='margin-left:0in;text-indent:0in'><a name=
2316 "_Toc534974935"></a><a name="_Toc344355442"></a><a name=
2317 "_Ref343086686">1.3<span style=
2318 'font:7.0pt "Times New Roman"'> </span>
2319 Stylized Comments</a></h2>
2320 <p class="TextFontCX">Stylized comments are used to provide extra
2321 information about a type, variable or function interface to improve
2322 checking, or to control flag settings locally.</p>
2323 <p class="TextFontCX"> </p>
2324 <p class="TextFontCX">All stylized comments begin with
2325 <span class="CodeText"><span style=
2326 'font-size:10.0pt'>/*@</span></span> and are closed by the
2327 end of the comment. The role of the <span class=
2328 "CodeText"><span style=
2329 'font-size:10.0pt'>@</span></span> may be played by any
2330 printable character. Use <span class=
2331 "Flag"><span style='font-size:10.0pt'>-commentchar</span></span><span class="Flag">
2333 'font-size:10.0pt'> <i><char></i></span></span> to
2334 select a different stylized comment marker.</p>
2335 <h3 style='margin-left:0in;text-indent:0in'><a name=
2336 "_Toc534974936">1.3.1<span style=
2337 'font:7.0pt "Times New Roman"'> </span>
2338 Annotations</a></h3>
2339 <p class="TextFontCX">Annotations are stylized comments that follow
2340 a definite syntax. Although they are comments, they may only
2341 be used in fixed grammatical contexts (e.g., like a type
2343 <p class="TextFontCX"> </p>
2344 <p class="TextFontCX">Sections 2–6­ describe
2345 annotations for expressing assumptions about variables,
2346 parameters, return values, structure fields and
2347 type definitions. For example, <span class=
2348 "Annot"><span style='font-size:10.0pt'>/*@null@*/</span></span> is
2349 used to express an assumption that a parameter may be NULL.
2350 Section 7 describes annotations for describing function
2351 interfaces. Other annotations are described in later sections
2352 and Section 10 describes mechanisms users can employ to define new
2353 annotations. A summary of annotations is found in Appendix
2355 <p class="TextFontCX"> </p>
2356 <p class="TextFontCX">Some annotations, known as control comments,
2357 may appear between any two tokens in a C program (unlike regular C
2358 comments, control comments should not be used within a single token
2359 as they introduce new separators in the code). Syntactically,
2360 they are no different from standard comments. Control
2361 comments are used to provide source-level control of Splint
2362 checking. They may be used to suppress spurious messages, set
2363 flags, and control checking locally in other ways.</p>
2364 <h3 style='margin-left:0in;text-indent:0in'><a name=
2365 "_Toc534974937"></a><a name="_Ref534648584">1.3.2<span style=
2366 'font:7.0pt "Times New Roman"'> </span>
2367 Setting Flags</a></h3>
2368 <p class="TextFontCX">Most flags (all except those characterized as
2369 “global” in Appendix B) can be set locally using
2370 control comments. A control comment can set flags locally to
2371 override the command line settings. The original flag
2372 settings are restored before processing the next file. The syntax
2373 for setting flags in control comments is the same as that of the
2374 command line, except that flags may also be preceded by
2375 <span class="CodeText"><span style=
2376 'font-size:10.0pt'>=</span></span> to restore their setting
2377 to the original command-line value. For instance,</p>
2378 <p class="example"><span class="Annot"><span style=
2379 'font-size:10.0pt'>/*@+charint</span></span> <span class=
2380 "Annot"><span style=
2381 'font-size:10.0pt'>-modifies</span></span><span class=
2382 "Annot"><span style=
2383 'font-size:10.0pt'>=showfunc</span></span><span class=
2384 "Annot"><span style='font-size:10.0pt'>@*/</span></span></p>
2385 <p class="TextFontCX">sets <span class="Flag"><span style=
2386 'font-size:10.0pt'>charint</span></span> on (this makes
2387 <span class="CodeText"><span style=
2388 'font-size:10.0pt'>char</span></span> and <span class=
2389 "CodeText"><span style='font-size:10.0pt'>int</span></span>
2390 indistinguishable types), sets <span class=
2391 "Flag"><span style='font-size:10.0pt'>modifies</span></span>
2392 off (this prevents reporting of modification errors), and
2393 sets <span class="Flag"><span style=
2394 'font-size:10.0pt'>showfunc</span></span> to its
2395 original setting (this controls whether or not the name
2396 of a function <a name="_Toc344355449">is displayed before a
2397 message).</a><a name="_Ref348845205"></a><a name=
2398 "_Ref348845200"></a> <a name="_Ref348785779"></a></p>
2399 <h1 style='margin-left:0in;text-indent:0in'><a name=
2400 "_Toc534974938"></a><a name="_Ref534641443"></a><a name=
2401 "_Ref534093860"></a><a name="_Ref534050017"></a><a name=
2402 "_Ref534008843">2<span style=
2403 'font:7.0pt "Times New Roman"'> </span>
2404 <a id="null" name="null">Null Dereferences</a></a></h1>
2405 <p class="TextFontCX">A common cause of program failures is when a
2406 null pointer is dereferenced. Splint detects these
2407 errors by distinguishing possibly <span class=
2408 "CodeText"><span style='font-size:10.0pt'>NULL</span></span>
2409 pointers at interface boundaries.</p>
2410 <p class="TextFontCX"> </p>
2411 <p class="TextFontCX">The <span class="Annot"><span style=
2412 'font-size:10.0pt'>null</span></span> annotation is used to
2413 indicate that a pointer value may be <span class=
2414 "CodeText"><span style='font-size:10.0pt'>NULL</span></span>.
2415 A pointer declared with no <span class="Annot"><span style=
2416 'font-size:10.0pt'>null</span></span> annotation, may not be
2417 <span class="CodeText"><span style=
2418 'font-size:10.0pt'>NULL</span></span>. If null checking is
2419 turned on (controlled by <span class="Flag"><span style=
2420 'font-size:10.0pt'>null</span></span>), Splint will report an error
2421 when a possibly null pointer is passed as a parameter, returned as
2422 a result, or assigned to an external reference with no
2423 <span class="Annot"><span style=
2424 'font-size:10.0pt'>null</span></span> qualifier.</p>
2425 <p class="TextFontCX"> </p>
2426 <p class="TextFontCX">If a pointer is declared with the
2427 <span class="Annot"><span style=
2428 'font-size:10.0pt'>null</span></span> annotation, the code
2429 must check that it is not <span class="CodeText"><span style=
2430 'font-size:10.0pt'>NULL</span></span> on all paths leading to
2431 a dereference of the pointer (or the pointer being returned
2432 or passed as a value with no <span class="Annot"><span style=
2433 'font-size:10.0pt'>null</span></span> annotation).
2434 Dereferences of possibly null pointers may be protected by
2435 conditional statements or <span class="CodeText"><span style=
2436 'font-size:10.0pt'>assert</span></span>ions (to see how
2437 <span class="CodeText"><span style=
2438 'font-size:10.0pt'>assert</span></span> is declared see
2439 Section 8.1) that check the pointer is not <span class=
2440 "CodeText"><span style=
2441 'font-size:10.0pt'>NULL</span></span>.</p>
2442 <p class="TextFontCX"> </p>
2443 <p class="TextFontCX">Consider two implementations of
2444 <span class="CodeText"><span style=
2445 'font-size:10.0pt'>firstChar</span></span> in Figure 2. For
2446 <span class="CodeText"><span style=
2447 'font-size:10.0pt'>firstChar1</span></span>, Splint reports
2448 an error since the pointer that is dereferenced is declared
2449 with a <span class="Annot"><span style=
2450 'font-size:10.0pt'>null</span></span> annotation.
2451 For <span class="CodeText"><span style=
2452 'font-size:10.0pt'>firstChar2</span></span>, no error is
2453 reported since the true branch of the <span class=
2454 "CodeText"><span style='font-size:10.0pt'>s ==
2455 NULL</span></span> if statement returns, so the dereference
2456 of <span class="CodeText"><span style=
2457 'font-size:10.0pt'>s</span></span> is only reached if
2458 <span class="CodeText"><span style=
2459 'font-size:10.0pt'>s</span></span> is not <span class=
2460 "CodeText"><span style=
2461 'font-size:10.0pt'>NULL</span></span>.</p>
2463 <table class="MsoNormalTable" border="0" cellspacing="0"
2464 cellpadding="0" style=
2465 'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
2467 <td valign="top" style=
2468 'width:207.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
2469 <p class="TextFontCX" align="center" style='text-align:center'>
2470 <span class="Keyword"><b><span style=
2471 'font-size:10.0pt; color:white'>null.c</span></b></span></p></td>
2472 <td valign="top" style=
2473 'width:220.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
2474 <p class="TextFontCX" align="center" style='text-align:center'>
2475 <b><span style='color:white'>Running
2476 Splint</span></b></p></td></tr>
2478 <td valign="top" style=
2479 'width:207.0pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
2480 <p class="Verbatim"><span style='font-size:9.0pt'> </span></p>
2481 <p class="Verbatim"><span style='font-size:9.0pt'>char firstChar1
2482 (/*@null@*/ char *s)</span></p>
2483 <p class="Verbatim"><span style='font-size:9.0pt'>{<br></span>
2484 <span class="Line"><span style=
2485 'font-size:8.0pt'>3</span></span><span style=
2486 'font-size:9.0pt'> return *s;</span></p>
2487 <p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
2488 <p class="Verbatim"><span style='font-size:9.0pt'> </span></p>
2489 <p class="Verbatim"><span style='font-size:9.0pt'>char firstChar2
2490 (/*@null@*/ char *s)</span></p>
2491 <p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
2492 <p class="Verbatim"><span style='font-size:9.0pt'> if
2493 (s == NULL) return ‘\0’;<br></span> <span class=
2495 'font-size:8.0pt'>9</span></span><span style='font-size:9.0pt'>
2496 return *s;</span></p>
2497 <p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
2498 <td valign="top" style=
2499 'width:220.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
2500 <p class="lclintrun">> splint null.c</p>
2501 <p class="lclintrun">Splint 3.0.1</p>
2502 <p class="lclintrun"> </p>
2503 <p class="lclintrun">null.c: (in function firstChar1)</p>
2504 <p class="lclintrun">null.c:3:11: Dereference of possibly null
2506 <p class="lclintrun"> null.c:1:35: Storage s may become
2508 <p class="lclintrun"> </p>
2509 <p class="lclintrun">Finished checking --- 1 code warning found</p>
2510 <p class="TextFontCX"> </p></td></tr></table>
2511 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
2512 style="border-collapse: collapse" bordercolor="#111111">
2514 <td valign="top" align="left" style=
2515 'padding-top:6.5pt;padding-right: 9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>
2516 <p class="MsoCaption"><a name="_Ref534981289"></a><a name=
2517 "_Toc534824606"></a><a name="_Ref534981293">Figure 2</a>.
2519 <p class="MsoNormal" align="left" style=
2520 'margin-top:0in;margin-right:26.55pt; margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-align:left; background:white'>
2521 <span style='font-size:10.0pt'>Output from running Splint is
2522 displayed in</span> <span style=
2523 'font-size:10.0pt;font-family:"Arial Narrow"'>sans-serif</span>
2524 <span style='font-size:10.0pt'>font. The command line is
2525 preceded by</span> <span style=
2526 'font-size:10.0pt;font-family:Arial'>></span><span style=
2527 'font-size: 10.0pt'>, the rest is output from Splint.
2528 Explanations added to the code or splint output are shown in
2529 <i>italics</i>. Code shown in the figures in this document is
2530 available from the splint web site,</span> <span style=
2531 'font-size:10.0pt;font-family:Arial'>http://www.splint.org</span><span style='font-size:10.0pt'>
2532 . No error is reported for line 9, since the dereference is
2533 reached only if</span> <span class="CodeText"><span style=
2534 'font-size:10.0pt'>s</span></span> <span style=
2535 'font-size:10.0pt'>is non-null. For most of the figures, the
2536 options</span> <span class="Flag"><span style=
2537 'font-size:9.0pt'>-linelen 55 -hints –showcol</span></span>
2538 <span style='font-size:10.0pt'>were used to produce condensed
2539 output, and</span> <span class="Flag"><span style=
2540 'font-size:9.0pt'>–exportlocal</span></span>
2541 <span style='font-size:10.0pt'>to inhibit warnings about
2543 declarations. </span></p></td></tr></table></center>
2544 <h3 style='margin-left:0in;text-indent:0in'><a name=
2545 "_Toc534974939"></a><a name="_Ref344185475">2.1.1<span style=
2546 'font:7.0pt "Times New Roman"'> </span>
2547 Predicate Functions</a></h3>
2548 <p class="TextFontCX">Another way to protect null dereference, is
2549 to declare a function using <span class="Annot"><span style=
2550 'font-size:10.0pt'>nullwhentrue</span></span> or <span class=
2551 "Annot"><span style=
2552 'font-size:10.0pt'>falsewhennull</span></span>(these annotations
2553 where originally <span class="Annot"><span style=
2554 'font-size:10.0pt'>falsenull</span></span> and <span class=
2555 "Annot"><span style='font-size:10.0pt'>truenull</span></span>, but
2556 were renamed to clarify the logical asymmetry; <span class=
2557 "Annot"><span style='font-size:10.0pt'>falsenull</span></span> and
2558 <span class="Annot"><span style=
2559 'font-size:10.0pt'>truenull</span></span> may still be used) and
2560 call the function in a conditional statement before the
2561 <span class="Annot"><span style=
2562 'font-size:10.0pt'>null</span></span>-annotated pointer is
2563 dereferenced. </p>
2564 <p class="TextFontCX"> </p>
2565 <p class="TextFontCX">If a function annotated with
2566 <span class="Annot"><span style=
2567 'font-size:10.0pt'>nullwhentrue</span></span> returns true it
2568 means its first passed parameter is <span class=
2569 "CodeText"><span style='font-size:10.0pt'>NULL</span></span>.
2570 If it returns false, the parameter is not <span class=
2571 "CodeText"><span style=
2572 'font-size:10.0pt'>NULL</span></span>. Note that it may
2573 return true for a parameter that is not <span class=
2574 "CodeText"><span style=
2575 'font-size:10.0pt'>NULL</span></span>. A more
2576 descriptive name for <span class="Annot"><span style=
2577 'font-size:10.0pt'>nullwhentrue</span></span> would be
2578 “if the result is false, the parameter was not
2579 null”. For example, if <span class=
2580 "CodeText"><span style=
2581 'font-size:10.0pt'>isNull</span></span> is declared as,</p>
2582 <p class="example"> /*@nullwhentrue@*/ bool isNull
2583 (/*@null@*/ char *x);</p>
2584 <p class="beforelist">we could write <span class=
2585 "CodeText"><span style=
2586 'font-size: 10.0pt'>firstChar2</span></span>:</p>
2587 <p class="Verbatim"> char firstChar2 (/*@null@*/ char
2589 <p class="Verbatim"> {</p>
2590 <p class="Verbatim" style='margin-left:.5in'>if (isNull (s)) return
2593 <p class="Verbatim"> }</p>
2594 <p class="afterlist">No error is reported since the dereference of
2595 <span class="CodeText"><span style=
2596 'font-size:10.0pt'>s</span></span> is only reached if
2597 <span class="CodeText"><span style=
2598 'font-size:10.0pt'>isNull(s)</span></span> is false, and
2599 since <span class="CodeText"><span style=
2600 'font-size:10.0pt'>isNull</span></span> is declared with the
2601 <span class="Annot"><span style=
2602 'font-size:10.0pt'>nullwhentrue</span></span> annotation this
2603 means <span class="CodeText"><span style=
2604 'font-size:10.0pt'>s</span></span> must not be null.</p>
2605 <p class="TextFontCX"> </p>
2606 <p class="TextFontCX">The <span class="Annot"><span style=
2607 'font-size:10.0pt'>falsewhennull</span></span> annotation is not
2608 quite the logical opposite of <span class=
2609 "Annot"><span style='font-size:10.0pt'>nullwhentrue</span></span>.
2610 If a function declared with <span class="Annot"><span style=
2611 'font-size:10.0pt'>falsewhennull</span></span> returns true,
2612 it means its parameter is definitely not <span class=
2613 "CodeText"><span style=
2614 'font-size:10.0pt'>NULL</span></span>. If it returns
2615 false, the parameter may or may not be <span class=
2616 "CodeText"><span style=
2617 'font-size:10.0pt'>NULL</span></span>. That is a
2618 <span class="Annot"><span style=
2619 'font-size:10.0pt'>falsewhennull</span></span> always returns
2620 false when passed a <span class="CodeText"><span style=
2621 'font-size: 10.0pt'>NULL</span></span> parameter; it may
2622 sometimes return false when passed a non-<span class=
2623 "CodeText"><span style='font-size:10.0pt'>NULL</span></span>
2625 <p class="TextFontCX"> </p>
2626 <p class="beforelist">For example, we could define
2627 <span class="CodeText"><span style=
2628 'font-size:10.0pt'>isNonEmpty</span></span> to return true if
2629 its parameter is not <span class="CodeText"><span style=
2630 'font-size:10.0pt'>NULL</span></span> and has least one
2631 character before the <span class="CodeText"><span style=
2632 'font-size:10.0pt'>NUL</span></span> terminator:</p>
2633 <p class="Verbatim"> /*@falsewhennull@*/ bool
2634 isNonEmpty (/*@null@*/ char *x)</p>
2635 <p class="Verbatim"> {</p>
2636 <p class="Verbatim"> return (x != NULL
2637 && *x != ‘\0’);</p>
2638 <p class="Verbatim"> }</p>
2639 <p class="afterlist">Splint does not check that the implementation
2640 of a function declared with <span class="Annot"><span style=
2641 'font-size:10.0pt'>nullwhentrue</span></span> or <span class=
2642 "Annot"><span style='font-size:10.0pt'>falsewhennull</span></span>
2643 is consistent with its annotation, but assumes the annotation is
2644 correct when code that calls the function is checked.</p>
2645 <h3 style='margin-left:0in;text-indent:0in'><a name=
2646 "_Toc534974940">2.1.2<span style=
2647 'font:7.0pt "Times New Roman"'> </span>
2648 Notnull Annotations</a></h3>
2649 <p class="TextFontCX">The <span class="Annot"><span style=
2650 'font-size:10.0pt'>notnull</span></span> annotation specifies that
2651 a declarator is definitely not <span class=
2652 "CodeText"><span style='font-size:10.0pt'>NULL</span></span>.
2653 By default, this is assumed, but it may be necessary to use
2654 <span class="Annot"><span style=
2655 'font-size:10.0pt'>notnull</span></span> to override a
2656 <span class="Annot"><span style=
2657 'font-size:10.0pt'>null</span></span> in a type
2658 definition. The <span class="Annot"><span style=
2659 'font-size:10.0pt'>null</span></span> annotation may be used
2660 in a type definition to indicate that all instances of the
2661 type may be <span class="CodeText"><span style=
2662 'font-size:10.0pt'>NULL</span></span>. For declarations
2663 of a type declared using <span class="Annot"><span style=
2664 'font-size:10.0pt'>null</span></span>, the <span class=
2665 "Annot"><span style='font-size:10.0pt'>null</span></span>
2666 annotation in the type definition may be overridden with
2667 <span class="Annot"><span style=
2668 'font-size:10.0pt'>notnull</span></span>. This is
2669 particularly useful for parameters to hidden <span class=
2670 "CodeText"><span style=
2671 'font-size:10.0pt'>static</span></span> operations of
2672 abstract types (see Section 4.3) where the null test has
2673 already been done before the function is called, or function
2674 results known to never be <span class="CodeText"><span style=
2675 'font-size:10.0pt'>NULL</span></span>. For an abstract
2676 type, <span class="Flag"><span style=
2677 'font-size:10.0pt'>notnull</span></span> may not be used for
2678 parameters to external functions, since clients should not be
2679 aware of when the concrete representation may by <span class=
2680 "CodeText"><span style=
2681 'font-size:10.0pt'>NULL</span></span>. Parameters to
2682 static functions in the implementation module, however, may
2683 be declared using <span class="Annot"><span style=
2684 'font-size:10.0pt'>notnull</span></span>, since they may only
2685 be called from places where the representation is
2686 accessible. Return values for <span class=
2687 "CodeText"><span style=
2688 'font-size:10.0pt'>static</span></span> or external functions
2689 may be declared using <span class="Annot"><span style=
2690 'font-size:10.0pt'>notnull</span></span>. </p>
2691 <h3 style='margin-left:0in;text-indent:0in'><a name=
2692 "_Toc534974941"></a><a name="_Ref347853058">2.1.3<span style=
2693 'font:7.0pt "Times New Roman"'> </span>
2694 Relaxing Null Checking</a></h3>
2695 <p class="TextFontCX">An additional annotation, <span class=
2696 "Annot"><span style='font-size:10.0pt'>relnull</span></span> may be
2697 used to relax null checking. No error is reported when a
2698 <span class="Annot"><span style=
2699 'font-size:10.0pt'>relnull</span></span> value is dereferenced, or
2700 when a possibly null value is assigned to an identifier declared
2701 using <span class="Annot"><span style=
2702 'font-size:10.0pt'>relnull</span></span>.</p>
2703 <p class="TextFontCX"> </p>
2704 <p class="TextFontCX">This is generally used for structure fields
2705 that may or may not be null depending on some other
2706 constraint. Splint does not report and error when
2707 <span class="CodeText"><span style=
2708 'font-size:10.0pt'>NULL</span></span> is assigned to a
2709 <span class="Annot"><span style=
2710 'font-size:10.0pt'>relnull</span></span> reference, or when a
2711 <span class="Annot"><span style=
2712 'font-size:10.0pt'>relnull</span></span> reference is
2713 dereferenced. It is up to the programmer to ensure that
2714 this constraint is satisfied before the pointer is
2716 <h1 style='margin-left:0in;text-indent:0in'><a name=
2717 "_Ref348845237"></a><a name="_Ref347254431"></a><a name=
2718 "_Ref347169350"></a><a name="_Ref344916590"></a><a name=
2719 "_Ref344907893"></a><a name="_Toc344355407"></a><a name=
2720 "_Toc534974942"></a><a name="_Ref534641444"></a><a name=
2721 "_Ref534093775"></a><a name="_Ref534093769"></a><a name=
2722 "_Ref534049950">3<span style=
2723 'font:7.0pt "Times New Roman"'> </span>
2724 <a id="undefined" name="undefined">Undefined Values</a></a></h1>
2725 <p class="TextFontCX">Like many static checkers, Splint detects
2726 instances where the value of a location is used before it is
2727 defined. This analysis is done at the procedural level.
2728 If there is a path through the procedure that uses a local variable
2729 before it is defined, a use before definition error is
2730 reported. The <span class="Flag"><span style=
2731 'font-size:10.0pt'>usedef</span></span> flag controls use before
2732 definition checking.</p>
2733 <p class="TextFontCX"> </p>
2734 <p class="TextFontCX">Splint can do more checking than standard
2735 checkers though, because the annotations can be used to describe
2736 what storage must be defined and what storage may be undefined at
2737 interface points. Unannotated references are expected to be
2738 completely defined at interface points. This means all
2739 storage reachable from a global variable, parameter to a function,
2740 or function return value is defined before and after a function
2742 <h3 style='margin-left:0in;text-indent:0in'><a name=
2743 "_Toc534974943"></a><a name="_Ref347811030"></a><a name=
2744 "_Ref347204458">3.1.1<span style=
2745 'font:7.0pt "Times New Roman"'> </span>
2746 Undefined Parameters</a></h3>
2747 <p class="TextFontCX">Sometimes, function parameters or return
2748 values are expected to reference undefined or partially defined
2749 storage. For example, a pointer parameter may be intended
2750 only as an address to store a result, or a memory allocator may
2751 return allocated but undefined storage. The
2752 <span class="Annot"><span style=
2753 'font-size:10.0pt'>out</span></span> annotation denotes
2754 a pointer to storage that may be undefined.</p>
2755 <p class="TextFontCX"> </p>
2756 <p class="TextFontCX">Splint does not report an error when a
2757 pointer to allocated but undefined storage is passed as an
2758 <span class="Annot"><span style=
2759 'font-size:10.0pt'>out</span></span> parameter. Within the
2760 body of a function, Splint will assume an <span class=
2761 "Annot"><span style='font-size:10.0pt'>out</span></span> parameter
2762 is allocated but not necessarily bound to a value, so an error is
2763 reported if its value is used before it is defined. </p>
2764 <p class="TextFontCX"> </p>
2765 <p class="TextFontCX">Splint reports an error if storage reachable
2766 by the caller after the call is not defined when the function
2767 returns. This can be suppressed by <span class=
2769 'font-size: 10.0pt'>-must-define</span></span>. After a call
2770 returns, an actual parameter corresponding to an <span class=
2771 "Annot"><span style='font-size:10.0pt'>out</span></span> parameter
2772 is assumed to be completely defined.</p>
2773 <p class="TextFontCX"> </p>
2774 <p class="TextFontCX">When checking unannotated programs, many
2775 spurious use before definition errors may be reported
2776 If <span class="Flag"><span style=
2777 'font-size:10.0pt'>impouts</span></span> is on, no error is
2778 reported when an incompletely-defined parameter is passed to a
2779 formal parameter with no definition annotation, and the actual
2780 parameter is assumed to be defined after the call. The
2781 <span class="Annot"><span style=
2782 'font-size:10.0pt'>/*@in@*/</span></span> annotation can be
2783 used to denote a parameter that must be completely defined, even if
2784 <span class="Flag"><span style=
2785 'font-size:10.0pt'>imp-outs</span></span> is on. If
2786 <span class="Flag"><span style=
2787 'font-size:10.0pt'>imp-outs</span></span> is off, there is an
2788 implicit <span class="Annot"><span style=
2789 'font-size:10.0pt'>in</span></span> annotation on every parameter
2790 with no definition annotation.</p>
2791 <p class="TextFontCX"> </p>
2792 <table class="MsoNormalTable" border="0" cellspacing="0"
2793 cellpadding="0" style='margin-left:.9pt;border-collapse:collapse'>
2795 <td width="40%" valign="top" style=
2796 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
2797 <p class="TextFontCX" align="center" style='text-align:center'>
2798 <span class="Keyword"><b><span style=
2799 'font-size:10.0pt; color:white'>usedef.c</span></b></span></p></td>
2800 <td valign="top" style=
2801 'border-top:1.5pt solid black; border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black; background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
2802 <p class="TextFontCX" align="center" style='text-align:center'>
2803 <b><span style='color:white'>Running
2804 Splint</span></b></p></td></tr>
2806 <td valign="top" style=
2807 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
2808 <p class="MsoNormal"><span class="Keyword"><span style=
2809 'font-size:10.0pt; color:windowtext'>extern void</span></span></p>
2810 <p class="MsoNormal"><span class="Keyword"><span style=
2811 'font-size:10.0pt; color:windowtext'> setVal (/*@out@*/ int
2812 *x);</span></span></p>
2813 <p class="MsoNormal"><span class="Keyword"><span style=
2814 'font-size:10.0pt; color:windowtext'>extern int</span></span></p>
2815 <p class="MsoNormal"><span class="Keyword"><span style=
2816 'font-size:10.0pt; color:windowtext'> getVal (/*@in@*/ int
2817 *x);</span></span></p>
2818 <p class="MsoNormal"><span class="Keyword"><span style=
2819 'font-size:10.0pt; color:windowtext'>extern int
2820 mysteryVal</span></span></p>
2821 <p class="MsoNormal"><span class="Keyword"><span style=
2822 'font-size:10.0pt; color:windowtext'> (int
2823 *x);</span></span></p>
2824 <p class="MsoNormal"><span class="Keyword"><span style=
2825 'font-size:10.0pt; color:windowtext'> </span></span></p>
2826 <p class="MsoNormal" align="left" style='text-align:left'>
2827 <span class="Keyword"><span style=
2828 'font-size:10.0pt;color:windowtext'>int dumbfunc</span></span></p>
2829 <p class="MsoNormal" align="left" style='text-align:left'>
2830 <span class="Keyword"><span style=
2831 'font-size:10.0pt;color:windowtext'> (/*@out@*/ int *x,
2832 int i)</span></span></p>
2833 <p class="MsoNormal"><span class="Keyword"><span style=
2834 'font-size:10.0pt; color:windowtext'>{</span></span></p>
2835 <p class="MsoNormal"><span class="Keyword"><span style=
2836 'font-size:10.0pt; color:windowtext'> if (i >
2837 3)</span></span></p>
2838 <p class="MsoNormal"><span class="Line"><span style=
2839 'font-size:8.0pt'>11</span></span><span class=
2840 "Keyword"><span style='font-size:10.0pt;color:windowtext'>
2841 return *x;</span></span></p>
2842 <p class="MsoNormal"><span class="Keyword"><span style=
2843 'font-size:10.0pt; color:windowtext'> else if (i >
2844 1)</span></span></p>
2845 <p class="MsoNormal"><span class="Line"><span style=
2846 'font-size:8.0pt'>13</span></span><span class=
2847 "Keyword"><span style='font-size:10.0pt;color:windowtext'>
2848 return getVal (x);</span></span></p>
2849 <p class="MsoNormal"><span class="Keyword"><span style=
2850 'font-size:10.0pt; color:windowtext'> else if (i ==
2851 0)</span></span></p>
2852 <p class="MsoNormal"><span class="Line"><span style=
2853 'font-size:8.0pt'>15</span></span><span class=
2854 "Keyword"><span style='font-size:10.0pt;color:windowtext'>
2855 return mysteryVal (x);</span></span></p>
2856 <p class="MsoNormal"><span class="Keyword"><span style=
2857 'font-size:10.0pt; color:windowtext'> else</span></span></p>
2858 <p class="MsoNormal"><span class="Keyword"><span style=
2859 'font-size:10.0pt; color:windowtext'>
2861 <p class="MsoNormal"><span class="Line"><span style=
2862 'font-size:8.0pt'>18</span></span><span class=
2863 "Keyword"><span style='font-size:10.0pt;color:windowtext'>
2864 setVal (x);</span></span></p>
2865 <p class="MsoNormal"><span class="Line"><span style=
2866 'font-size:8.0pt'>19</span></span><span class=
2867 "Keyword"><span style='font-size:10.0pt;color:windowtext'>
2868 return *x;</span></span></p>
2869 <p class="MsoNormal"><span class="Keyword"><span style=
2870 'font-size:10.0pt; color:windowtext'>
2872 <p class="Verbatim"><span class="Keyword"><span style=
2873 'color:windowtext'>}</span></span></p></td>
2874 <td valign="top" style=
2875 'border-top:medium none;border-left:medium none; border-bottom:1.5pt solid black;border-right:1.5pt solid black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
2876 <p class="lclintrun">> splint usedef.c</p>
2877 <p class="lclintrun">usedef.c:11: Value *x used before
2879 <p class="lclintrun">usedef.c:13: Passed storage x not completely
2881 <p class="lclintrun">
2882
2883 (*x is undefined): getVal (x)</p>
2884 <p class="lclintrun">usedef.c:15: Passed storage x not completely
2886 <p class="lclintrun">
2887
2888 (*x is undefined): mysteryVal (x)</p>
2889 <p class="lclintrun"> </p>
2890 <p class="lclintrun">Finished checking --- 3 code warnings</p>
2891 <p class="TextFontCX"><i> </i></p>
2892 <p class="IndentText" style=
2893 'margin-top:0in;margin-right:.85pt;margin-bottom: 0in;margin-left:0in;margin-bottom:.0001pt;page-break-after:avoid'>
2894 <i>No error is reported for line 18, since the incompletely defined
2895 storage</i> <span class="CodeText"><span style=
2896 'font-size:10.0pt'>x</span></span> <i>is passed as an</i>
2897 <span class="CodeText"><span style=
2898 'font-size:10.0pt'>out</span></span> <i>parameter. After the
2899 call,</i> <span class="CodeText"><span style=
2900 'font-size: 10.0pt'>x</span></span> <i>may be dereferenced,
2901 since</i> <span class="Annot"><span style=
2902 'font-size:10.0pt'>setVal</span></span> <i>is assumed to completely
2903 define its</i> <span class="Annot"><span style=
2904 'font-size:10.0pt'>out</span></span> <i>parameter. The
2905 warning for line 15 would not appear if</i> <span class=
2906 "Flag"><span style='font-size:10.0pt'>+impouts</span></span>
2907 <i>were used since there is no</i> <span class=
2908 "Annot"><span style='font-size:10.0pt'>in</span></span>
2909 <i>annotation on the parameter to</i> <span class=
2911 'font-size: 10.0pt'>mysteryVal</span></span><i>.</i></p></td></tr></table>
2913 <div align="center">
2915 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
2916 style="border-collapse: collapse" bordercolor="#111111">
2918 <td valign="top" align="left" style=
2919 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
2920 <p class="MsoCaption"><a name="_Ref347764461"></a><a name=
2921 "_Ref347853047"></a><a name="_Toc534824607">Figure 3. Use
2922 before Definition</a></p></td></tr></table></center></div></div>
2925 <h3 style='margin-left:0in;text-indent:0in'><a name=
2926 "_Toc534974944">3.1.2<span style=
2927 'font:7.0pt "Times New Roman"'> </span>
2928 Relaxing Checking</a></h3>
2929 <p class="TextFontCX">The <span class="Annot"><span style=
2930 'font-size:10.0pt'>reldef</span></span> annotation relaxes
2931 definition checking for a particular declaration. Storage
2932 declared with a <span class="Annot"><span style=
2933 'font-size:10.0pt'>reldef</span></span> annotation is assumed to be
2934 defined when it is used, but no error is reported if it is not
2935 defined before it is returned or passed as a parameter.</p>
2936 <p class="TextFontCX"> </p>
2937 <p class="TextFontCX">It is up to the programmer to check
2938 <span class="Annot"><span style=
2939 'font-size:10.0pt'>reldef</span></span> fields are used
2940 correctly. They should be avoided in most cases, but
2941 may be useful for fields of structures that may or may not be
2942 defined depending on other constraints. </p>
2943 <h3 style='margin-left:0in;text-indent:0in'><a name=
2944 "_Toc534974945"></a><a name="_Ref347853043">3.1.3<span style=
2945 'font:7.0pt "Times New Roman"'> </span>
2946 Partially Defined Structures</a></h3>
2947 <p class="TextFontCX">The <span class="Annot"><span style=
2948 'font-size:10.0pt'>partial</span></span> annotation can be used to
2949 relax checking of structure fields. A structure with
2950 undefined fields may be passed as a <span class=
2951 "Annot"><span style='font-size: 10.0pt'>partial</span></span>
2952 parameter or returned as a <span class="Annot"><span style=
2953 'font-size:10.0pt'>partial</span></span> result. Inside
2954 a function body, no error is reported when the field of a
2955 <span class="Annot"><span style=
2956 'font-size:10.0pt'>partial</span></span> structure is
2957 used. After a call, all fields of a structure that is
2958 passed as a <span class="Annot"><span style=
2959 'font-size:10.0pt'>partial</span></span> parameter are
2960 assumed to be completely defined.</p>
2961 <h1 style='margin-left:0in;text-indent:0in'><a name=
2962 "_Ref534977413"></a><a name="_Toc534974946">4<span style=
2963 'font:7.0pt "Times New Roman"'> </span>
2964 <a id="types" name="types">
2966 <p class="TextFontCX">Strong type checking often reveals
2967 programming errors. Splint can check primitive C types more
2968 strictly and flexibly than typical compilers (4.1) and provides
2969 support a Boolean type (4.2). In addition, users can define
2970 abstract types that provide information hiding (0).</p>
2971 <h2 style='margin-left:0in;text-indent:0in'><a name=
2972 "_Toc534974947"></a><a name="_Ref534642132"></a><a name=
2973 "_Ref533964147"></a><a name="_Toc344355401">4.1<span style=
2974 'font:7.0pt "Times New Roman"'> </span>
2975 Built in C Types</a></h2>
2976 <p align="right"><span style='font-size:9.0pt'><i>Two types
2977 have</i> compatible <i>type if their types are the
2978 same.</i></span></p>
2979 <p class="TextFontCX" align="right" style='text-align:right'>
2980 <span style='font-size:9.0pt'><span style='font-size:9.0pt'>ANSI C,
2981 3.1.2.6.</span></span></p>
2982 <p class="Sidebar"> </p>
2986 <p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
2987 Splint supports stricter checking of built in C types. The
2988 <span class="CodeText"><span style=
2989 'font-size:10.0pt'>char</span></span> and <span class=
2990 "CodeText"><span style='font-size:10.0pt'>enum</span></span> types
2991 can be checked as distinct types, and the different numeric types
2992 can be type-checked strictly.</p>
2993 <h3 style='margin-left:0in;text-indent:0in'><a name=
2994 "_Toc534974948">4.1.1<span style=
2995 'font:7.0pt "Times New Roman"'> </span>
2997 <p class="TextFontCX">The primitive <span class=
2998 "CodeText"><span style='font-size:10.0pt'>char</span></span> type
2999 can be type-checked as a distinct type. If <span class=
3000 "CodeText"><span style='font-size:10.0pt'>char</span></span> is
3001 used as a distinct type, common errors involving assigning
3002 <span class="CodeText"><span style=
3003 'font-size:10.0pt'>int</span></span>s to <span class=
3004 "CodeText"><span style='font-size:10.0pt'>char</span></span>s are
3006 <p class="TextFontCX"> </p>
3007 <p class="TextFontCX">The <span class="Flag"><span style=
3008 'font-size:10.0pt'>+charint</span></span> flag can be used for
3009 checking legacy programs where <span class=
3010 "CodeText"><span style='font-size:10.0pt'>char</span></span>
3011 and <span class="CodeText"><span style=
3012 'font-size:10.0pt'>int</span></span> are used
3013 interchangeably. If <span class="Flag"><span style=
3014 'font-size:10.0pt'>charint</span></span> is on, <span class=
3015 "CodeText"><span style='font-size:10.0pt'>char</span></span>
3016 types indistinguishable from <span class=
3017 "CodeText"><span style=
3018 'font-size:10.0pt'>int</span></span>s. To keep
3019 <span class="CodeText"><span style=
3020 'font-size:10.0pt'>char</span></span> and <span class=
3021 "Keyword"><span style='font-size:10.0pt'>int</span></span> as
3022 distinct types, but allow chars to be used to index arrays,
3023 use <span class="Flag"><span style=
3024 'font-size:10.0pt'>+charindex</span></span>.</p>
3025 <h3 style='margin-left:0in;text-indent:0in'><a name=
3026 "_Toc534974949">4.1.2<span style=
3027 'font:7.0pt "Times New Roman"'> </span>
3028 Enumerators</a></h3>
3029 <p class="TextFontCX">Standard C treats user-declared
3030 <span class="CodeText"><span style=
3031 'font-size:10.0pt'>enum</span></span> types just like
3032 integers. An arbitrary integral value may be assigned
3033 to an <span class="CodeText"><span style=
3034 'font-size:10.0pt'>enum</span></span> type, whether or not it
3035 was listed as an enumerator member. Splint checks each
3036 user-defined <span class="CodeText"><span style=
3037 'font-size:10.0pt'>enum</span></span> type as distinct
3038 type. An error is reported if a value that is not an
3039 enumerator member is assigned to the <span class=
3040 "CodeText"><span style='font-size:10.0pt'>enum</span></span>
3041 type, or if an <span class="CodeText"><span style=
3042 'font-size:10.0pt'>enum</span></span> type is used as an
3043 operand to an arithmetic operator. If the <span class=
3044 "Flag"><span style='font-size:10.0pt'>enumint</span></span>
3045 flag is on, <span class="CodeText"><span style=
3046 'font-size:10.0pt'>enum</span></span> and <span class=
3047 "CodeText"><span style='font-size:10.0pt'>int</span></span>
3048 types may be used interchangeably. Like <span class=
3050 'font-size:10.0pt'>charindex</span></span>, if the
3051 <span class="Flag"><span style=
3052 'font-size:10.0pt'>enumindex</span></span> flag is on,
3053 <span class="CodeText"><span style=
3054 'font-size:10.0pt'>enum</span></span> types may be used to
3056 <h3 style='margin-left:0in;text-indent:0in'><a name=
3057 "_Toc534974950">4.1.3<span style=
3058 'font:7.0pt "Times New Roman"'> </span>
3059 Numeric Types</a></h3>
3060 <p class="TextFontCX">Splint reports where numeric types are
3061 used in dangerous or inconsistent ways. With the strictest
3062 checking, Splint will report an error anytime numeric types do not
3063 match exactly. If the <span class="Flag"><span style=
3064 'font-size:10.0pt'>relax-quals</span></span> flag is on, only those
3065 inconsistencies that may corrupt values are reported. For
3066 example, if an <span class="CodeText"><span style=
3067 'font-size:10.0pt'>int</span></span> is assigned to a variable of
3068 type <span class="CodeText"><span style=
3069 'font-size: 10.0pt'>long</span></span> (or passed as a
3070 <span class="CodeText"><span style=
3071 'font-size:10.0pt'>long</span></span> formal parameter),
3072 Splint will not report an error if <span class=
3074 'font-size:10.0pt'>relax-quals</span></span> is on since a
3075 <span class="CodeText"><span style=
3076 'font-size:10.0pt'>long</span></span> must have at least
3077 enough bits to store an <span class="CodeText"><span style=
3078 'font-size:10.0pt'>int</span></span> without data loss.
3079 On the other hand, an error would be reported if the
3080 <span class="CodeText"><span style=
3081 'font-size:10.0pt'>long</span></span> were assigned to an
3082 <span class="CodeText"><span style=
3083 'font-size:10.0pt'>int</span></span>, since the <span class=
3084 "CodeText"><span style='font-size:10.0pt'>int</span></span>
3085 type may not have enough bits to store the <span class=
3086 "CodeText"><span style='font-size:10.0pt'>long</span></span>
3088 <p class="TextFontCX"> </p>
3089 <p class="TextFontCX">Similarly, if a <span class=
3090 "CodeText"><span style='font-size:10.0pt'>signed</span></span>
3091 value is assigned to an <span class="CodeText"><span style=
3092 'font-size:10.0pt'>unsigned</span></span>, Splint will report an
3093 error since an <span class="CodeText"><span style=
3094 'font-size:10.0pt'>unsigned</span></span> type cannot represent all
3095 <span class="CodeText"><span style=
3096 'font-size:10.0pt'>signed</span></span> values correctly. If
3097 the <span class="Flag"><span style=
3098 'font-size:10.0pt'>+ignore-signs</span></span> flag is on, checking
3099 is relaxed to ignore all sign qualifiers in type comparisons (this
3100 is not recommended, since it will suppress reporting of real bugs,
3101 but may be necessary for quickly checking certain legacy
3103 <h3 style='margin-left:0in;text-indent:0in'><a name=
3104 "_Toc534974951">4.1.4<span style=
3105 'font:7.0pt "Times New Roman"'> </span>
3106 Arbitrary Integral Types</a></h3>
3107 <p class="TextFontCX">Some types are declared to be integral types,
3108 but the concrete type may be implementation dependent. For
3109 example, the standard library declares the types <span class=
3110 "CodeText"><span style='font-size:10.0pt'>size_t</span></span>,
3111 <span class="CodeText"><span style=
3112 'font-size:10.0pt'>ptr_diff</span></span> and <span class=
3113 "CodeText"><span style='font-size:10.0pt'>wchar_t</span></span>,
3114 but does not constrain their types other than limiting them to
3115 integral types. Programs may rely on them being integral
3116 types (e.g., can use <span class="CodeText"><span style=
3117 'font-size:10.0pt'>+</span></span> operator on two
3118 <span class="CodeText"><span style=
3119 'font-size:10.0pt'>size_t</span></span> operands), but should
3120 not rely on a particular representation (e.g., <span class=
3121 "CodeText"><span style='font-size: 10.0pt'>long
3122 unsigned</span></span>). </p>
3123 <p class="TextFontCX"> </p>
3124 <p class="TextFontCX">Splint supports three different kinds of
3125 arbitrary integral types:</p>
3126 <p class="TextFontCX"> </p>
3127 <p class="TextFontCX"><span class="Annot"><span style=
3128 'font-size:10.0pt'>/*@integraltype@*/</span></span></p>
3129 <p class="TextFontCX"><span class="Annot"><font size=
3130 "2"> </font></span> An arbitrary integral
3131 type. The actual type may be any one of <span class=
3132 "CodeText"><span style='font-size:10.0pt'>short</span></span>,
3133 <span class="CodeText"><span style=
3134 'font-size:10.0pt'>int</span></span>, <span class=
3135 "CodeText"><span style='font-size:10.0pt'>long</span></span>,
3136 <span class="CodeText"><span style='font-size:10.0pt'>unsigned
3137 short</span></span>, <span class="CodeText"><span style=
3138 'font-size:10.0pt'>unsigned</span></span>, or <span class=
3139 "CodeText"><span style='font-size:10.0pt'>unsigned
3140 long</span></span>.</p>
3141 <p class="TextFontCX"><span class="Annot"><span style=
3142 'font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>
3143 <p class="TextFontCX"><span class="Annot"><font size=
3144 "2"> </font></span> An arbitrary unsigned integral
3145 type. The actual type may be any one of <span class=
3146 "CodeText"><span style='font-size:10.0pt'>unsigned
3147 short</span></span>, <span class="CodeText"><span style=
3148 'font-size:10.0pt'>unsigned</span></span>, or <span class=
3149 "CodeText"><span style='font-size:10.0pt'>unsigned
3150 long</span></span>.</p>
3151 <p class="TextFontCX"><span class="Annot"><span style=
3152 'font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>
3153 <p class="TextFontCX"><span class="Annot"><font size=
3154 "2"> </font></span> An arbitrary signed integral
3155 type. The actual type may be any one of <span class=
3156 "CodeText"><span style='font-size:10.0pt'>short</span></span>,
3157 <span class="CodeText"><span style=
3158 'font-size:10.0pt'>int</span></span>, or <span class=
3159 "CodeText"><span style='font-size:10.0pt'>long</span></span>.</p>
3160 <p class="TextFontCX"> </p>
3161 <p class="TextFontCX">Splint reports an error if the code depends
3162 on the actual representation of a type declared as an arbitrary
3163 integral. The <span class="Flag"><span style=
3164 'font-size:10.0pt'>match-any-integral</span></span> flag
3165 relaxes checking and allows an arbitrary integral type is allowed
3166 to match any integral type.</p>
3167 <p class="TextFontCX"> </p>
3168 <p class="TextFontCX">Other flags set the arbitrary integral types
3169 to a concrete type. These should only be used if portability
3170 to platforms that may use different representations is not
3171 important. The <span class="Flag"><span style=
3172 'font-size:10.0pt'>long-integral</span></span> and
3173 <span class="Flag"><span style=
3174 'font-size:10.0pt'>long-unsigned-integral</span></span> flags
3175 set the type corresponding to <span class=
3176 "Annot"><span style='font-size: 10.0pt'>/*@integraltype@*/</span></span> to
3177 be <span class="CodeText"><span style=
3178 'font-size:10.0pt'>unsigned long</span></span> and
3179 <span class="CodeText"><span style=
3180 'font-size:10.0pt'>long</span></span> respectively. The
3181 <span class="Flag"><span style=
3182 'font-size:10.0pt'>long-unsigned-unsigned-integral</span></span> flag
3183 sets the type corresponding to <span class=
3184 "Annot"><span style=
3185 'font-size: 10.0pt'>/*@unsignedintegraltype@*/</span></span>
3186 to be <span class="CodeText"><span style=
3187 'font-size:10.0pt'>unsigned long</span></span>. The
3188 <span class="Flag"><span style=
3189 'font-size:10.0pt'>long-signed-integral</span></span> flag
3190 sets the type corresponding to <span class=
3191 "Annot"><span style=
3192 'font-size:10.0pt'>/*@signedintegraltype@*/</span></span> to
3193 be <span class="CodeText"><span style=
3194 'font-size:10.0pt'>long</span></span>.</p>
3195 <h2 style='margin-left:0in;text-indent:0in'><a name=
3196 "_Toc534974952"></a><a name="_Ref534642133"></a><a name=
3197 "_Ref533964143"></a><a name="_Ref344892413"></a><a name=
3198 "_Toc344355400">4.2<span style=
3199 'font:7.0pt "Times New Roman"'> </span>
3200 Boolean Types</a></h2>
3201 <p class="TextFontCX">Pre-ISO99 C had no Boolean representation
3202 – the result of a comparison operator was an integer, and no
3203 type checking is done for test expressions. C99 introduced a
3204 Boolean type (<span class="CodeText"><span style=
3205 'font-size:10.0pt'>_Bool</span></span> and <span class=
3206 "CodeText"><span style='font-size:10.0pt'>bool</span></span>,
3207 <span class="CodeText"><span style=
3208 'font-size:10.0pt'>true</span></span> and <span class=
3209 "CodeText"><span style='font-size:10.0pt'>false</span></span>
3210 macros in <span style=
3211 'font-size:10.0pt;font-family:Arial'>stdbool.h</span>), but did not
3212 strengthen the type checking. Splint supports a Boolean type
3213 that can be checked distinctly from integral types. Many
3214 common errors can be detected by introducing a distinct Boolean
3215 type and stronger type checking.</p>
3216 <p class="TextFontCX"> </p>
3217 <p class="TextFontCX">Splint checks that the test expression in an
3218 <span class="CodeText"><span style=
3219 'font-size:10.0pt'>if</span></span>, <span class=
3220 "CodeText"><span style='font-size:10.0pt'>while</span></span>, or
3221 <span class="CodeText"><span style=
3222 'font-size:10.0pt'>for</span></span> statement or an operand of a
3223 <span class="CodeText"><span style=
3224 'font-size:10.0pt'>&&</span></span>, <span class=
3225 "CodeText"><span style='font-size:10.0pt'>||</span></span> or
3226 <span class="CodeText"><span style=
3227 'font-size:10.0pt'>!</span></span>operator is a Boolean. If
3228 the type of a test expression is not a Boolean, Splint will produce
3229 a warning depending on the type of the test expression and flag
3230 settings. If the test expression has pointer type, the
3231 warning is inhibited by <span class="Flag"><span style=
3232 'font-size:10.0pt'>–predboolptr</span></span> (this can be
3233 used to prevent messages for the idiom of testing if a pointer is
3234 not null without a comparison). If it is type
3235 <span class="CodeText"><span style=
3236 'font-size:10.0pt'>int</span></span>, the warnings is
3237 inhibited by <span class="Flag"><span style=
3238 'font-size:10.0pt'>-pred-bool-int</span></span>. For
3239 all other types, Splint warns unless <span class=
3241 'font-size: 10.0pt'>-pred-bool-others</span></span> is
3242 set. Relations, comparisons and certain standard
3243 library functions are declared to return Booleans.</p>
3244 <p class="TextFontCX"> </p>
3245 <p class="TextFontCX">Since using <span class=
3246 "CodeText"><span style='font-size:10.0pt'>=</span></span> instead
3247 of <span class="CodeText"><span style=
3248 'font-size:10.0pt'>==</span></span> is such a common bug, reporting
3249 of test expressions that are assignments is controlled by the
3250 separate <span class="Flag"><span style=
3251 'font-size:10.0pt'>pred-assign</span></span> flag. The
3252 message can be suppressed by adding extra parentheses around the
3253 test expression.</p>
3254 <p class="TextFontCX"> </p>
3255 <p class="TextFontCX">Use the <span class="Flag"><span style=
3256 'font-size:10.0pt'>–booltype
3257 <name></span></span> flag to select the type name is
3258 used to represent Boolean values. There is no default Boolean
3259 type, although <span class="CodeText"><span style=
3260 'font-size: 10.0pt'>bool</span></span> is used by convention.
3261 The names <span class="CodeText"><span style=
3262 'font-size:10.0pt'>TRUE</span></span> and <span class=
3263 "CodeText"><span style='font-size:10.0pt'>FALSE</span></span> are
3264 assumed to represent true and false Boolean values. To change
3265 the names of true and false, use <span class=
3266 "Flag"><span style='font-size:10.0pt'>-booltrue</span></span>
3267 and <span class="Flag"><span style=
3268 'font-size:10.0pt'>-boolfalse</span></span>. (The
3269 Splint distribution includes an implementation of
3270 <span class="CodeText"><span style=
3271 'font-size:10.0pt'>bool</span></span>, in <span class=
3272 "CodeText"><span style=
3273 'font-size:10.0pt;color:windowtext'>lib/bool.h</span></span>.
3274 However, it isn’t necessary to use this implementation
3275 to get the benefits of Boolean checking.)</p>
3276 <p class="TextFontCX"> </p>
3277 <p class="TextFontCX">Figure 4 illustrates some of the Boolean
3278 checking done by Splint. </p>
3279 <p class="TextFontCX"> </p>
3281 <table class="MsoNormalTable" border="0" cellspacing="0"
3282 cellpadding="0" style=
3283 'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
3284 <tr style='height:13.3pt'>
3285 <td valign="top" style=
3286 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.3pt'>
3287 <p class="TextFontCX" align="center" style='text-align:center'>
3288 <span class="Keyword"><b><span style=
3289 'font-size:10.0pt; color:white'>bool.c</span></b></span></p></td>
3290 <td valign="top" style=
3291 'border-top:1.5pt solid black; border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black; background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
3292 <p class="TextFontCX" align="center" style='text-align:center'>
3293 <b><span style='color:white'>Running
3294 Splint</span></b></p></td></tr>
3296 <td valign="top" style=
3297 'width:2.0in;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:156.15pt'>
3298 <p class="Verbatim"># include "bool.h"</p>
3299 <p class="Verbatim">int f (int i, char *s,</p>
3300 <p class="Verbatim"> bool b1, bool b2)</p>
3301 <p class="Verbatim">{</p>
3302 <p class="Verbatim"><span class="Line"><span style=
3303 'font-size:8.0pt'> 6</span></span> if (i = 3)</p>
3304 <p class="Verbatim"><span class="Line"><span style=
3305 'font-size:8.0pt'> 7</span></span> return
3307 <p class="Verbatim"><span class="Line"><span style=
3308 'font-size:8.0pt'> 8</span></span> if (!i || s)</p>
3309 <p class="Verbatim"><span class="Line"><span style=
3310 'font-size:8.0pt'> 9</span></span> return
3312 <p class="Verbatim"><span class="Line"><span style=
3313 'font-size:8.0pt'>10</span></span> if (s)</p>
3314 <p class="Verbatim"><span class="Line"><span style=
3315 'font-size:8.0pt'>11</span></span> return 7;</p>
3316 <p class="Verbatim"><span class="Line"><span style=
3317 'font-size:8.0pt'>12</span></span> if (b1 == b2)</p>
3318 <p class="Verbatim"><span class="Line"><span style=
3319 'font-size:8.0pt'>13</span></span> return 3;</p>
3320 <p class="Verbatim"><span class="Line"><span style=
3321 'font-size:8.0pt'>14</span></span> return 2;</p>
3322 <p class="Verbatim">}</p></td>
3323 <td valign="top" style=
3324 'border-top:medium none;border-left: medium none;border-bottom:1.5pt solid black;border-right:1.5pt solid black; padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
3325 <p class="lclintrun">> splint bool.c +predboolptr
3326 –booltype bool</p>
3327 <p class="lclintrun"> </p>
3328 <p class="lclintrun">bool.c:6: Test expression for if is assignment
3329 expression: i = 3</p>
3330 <p class="lclintrun">bool.c:6: Test expression for if not bool,
3332 <p class="lclintrun">bool.c:7: Return value type bool does not
3333 match declared type int: b1</p>
3334 <p class="lclintrun">bool.c:8: Operand of ! is non-boolean (int):
3336 <p class="lclintrun">bool.c:8: Right operand of || is non-boolean
3337 (char *): !i || s</p>
3338 <p class="lclintrun">bool.c:10: Test expression for if not bool,
3340 <p class="lclintrun">bool.c:12: Use of == with bool variables
3341 (risks inconsistency because</p>
3342 <p class="lclintrun">
3343
3344 of multiple true values): b1 == b2</p>
3345 <p class="lclintrun"> </p>
3346 <p class="lclintrun" style='page-break-after:avoid'>Finished
3347 checking --- 7 code warnings found</p></td></tr></table>
3348 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
3350 <td valign="top" align="left" style=
3351 'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
3352 <p class="MsoCaption"><a name="_Ref533964137"></a><a name=
3353 "_Toc534824608"></a><a name="_Ref534821769">Figure 4</a>.
3354 Boolean Checking</p></td></tr></table></center>
3355 <h2 style='margin-left:0in;text-indent:0in'><a name=
3356 "_Toc534974953"></a><a name="_Ref534970776">4.3<span style=
3357 'font:7.0pt "Times New Roman"'> </span>
3358 Abstract Types</a></h2>
3359 <p class="TextFontCX">Information hiding is a technique for
3360 handling complexity. By hiding implementation details,
3361 programs can be understood and developed in distinct modules and
3362 the effects of a change can be localized. One technique for
3363 information hiding is data abstraction. An
3364 abstract type is used to represent some natural program
3365 abstraction. It provides functions for manipulating instances
3366 of the type. The module that implements these functions is
3367 called the <i>implementation</i> module. We call the
3368 functions that are part of the implementation of an abstract type
3369 the <i>operations</i> of the type. Other modules that use the
3370 abstract type are called <i>clients</i>.</p>
3371 <p class="TextFontCX"> </p>
3372 <p class="TextFontCX">Clients may use the type name and operations,
3373 but should not manipulate or rely on the actual representation of
3374 the type. Only the implementation module may manipulate the
3375 representation of an abstract type. This hides information,
3376 since implementers and maintainers of client modules should not
3377 need to know anything about how the abstract type is implemented.
3378 It provides modularity, since the representation of an abstract
3379 type can be changed without having to change any client code.</p>
3380 <p class="TextFontCX"> </p>
3381 <p class="TextFontCX">Splint supports abstract types by detecting
3382 places where client code depends on the concrete representation of
3383 an abstract type. Some examples of abstraction violations
3384 detected by Splint are shown in Figure 5.</p>
3385 <p class="beforelist"> </p>
3386 <p class="beforelist">To declare an abstract type, the
3387 <span class="Annot"><span style=
3388 'font-size:10.0pt'>abstract</span></span> annotation is
3389 added to a <span class="CodeText"><span style=
3390 'font-size:10.0pt'>typedef</span></span>. For example
3391 (in <span class="Keyword"><span style=
3392 'font-size:10.0pt;font-family: Arial;color:windowtext'>mstring.h</span></span>),</p>
3393 <p class="example">typedef /*@abstract@*/ char *mstring;</p>
3394 <p class="TextFontCX">declares <span class=
3395 "CodeText"><span style='font-size:10.0pt'>mstring</span></span>
3396 as an abstract type. It is implemented using a
3397 <span class="CodeText"><span style='font-size:10.0pt'>char
3398 *</span></span>, but clients of the type should not depend on
3399 or need to be aware of this. If it later becomes
3400 apparent that a better representation such as a string table
3401 should be used, we should be able to change the
3402 implementation of <span class="CodeText"><span style=
3403 'font-size: 10.0pt'>mstring</span></span> without having to
3404 change or inspect any client code.</p>
3405 <p class="TextFontCX"> </p>
3406 <p class="TextFontCX">In a client module, abstract types are
3407 checked by name, not structure. Splint reports an error if an
3408 instance of <span class="CodeText"><span style=
3409 'font-size:10.0pt'>mstring</span></span> is passed as a
3410 <span class="CodeText"><span style='font-size:10.0pt'>char
3411 *</span></span> (for instance, as an argument to <span class=
3412 "CodeText"><span style=
3413 'font-size: 10.0pt'>strlen</span></span>), since the
3414 correctness of this call depends on the representation of the
3415 abstract type. Splint also reports errors if any C
3416 operator except assignment (<span class=
3417 "CodeText"><span style='font-size:10.0pt'>=</span></span>) or
3418 <span class="CodeText"><span style=
3419 'font-size:10.0pt'>sizeof</span></span> is used on an
3420 abstract type. The assignment operator is allowed since
3421 its semantics do not depend on the representation of the type
3422 (for abstract types whose instances can change value, a
3423 client does need to know if assignment has copy or sharing
3424 semantics as discussed in Section 4.3.2). The use of
3425 <span class="CodeText"><span style=
3426 'font-size:10.0pt'>sizeof</span></span> is also
3427 permitted, since this is the only way for clients to allocate
3428 pointers to the abstract type. Type casting objects to
3429 or from abstract types in a client module is an abstraction
3430 violation and will generate a warning message.</p>
3431 <p class="TextFontCX"> </p>
3432 <p class="TextFontCX">Normally, Splint will assume a type
3433 definition is not abstract unless the <span class=
3434 "Annot"><span style='font-size:10.0pt'>/*@abstract@*/</span></span>
3435 qualifier is used. If instead you want all user-defined types
3436 to be abstract types unless they are marked as <span class=
3437 "Annot"><span style='font-size:10.0pt'>concrete</span></span>, the
3438 <span class="Flag"><span style=
3439 'font-size:10.0pt'>+imp-abstract</span></span> flag can be
3440 used. This adds an implicit <span class=
3441 "Annot"><span style='font-size:10.0pt'>abstract</span></span>
3442 annotation to any <span class="CodeText"><span style=
3443 'font-size:10.0pt'>typedef</span></span> that is not marked
3444 with <span class="Annot"><span style=
3445 'font-size:10.0pt'>/*@concrete@*/</span></span>.</p>
3446 <p class="TextFontCX"> </p>
3448 <table class="MsoNormalTable" border="0" cellspacing="0"
3449 cellpadding="0" style=
3450 'width:418.5pt;margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
3451 <tr style='height:13.45pt'>
3452 <td valign="top" style=
3453 'width:211.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
3454 <p class="TextFontCX" align="center" style='text-align:center'>
3455 <span class="Keyword"><b><span style=
3456 'font-size:10.0pt; color:white'>palindrome.c</span></b></span></p></td>
3457 <td valign="top" style=
3458 'width:207.0pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
3459 <p class="TextFontCX" align="center" style='text-align:center'>
3460 <b><span style='color:white'>Running
3461 Splint</span></b></p></td></tr>
3462 <tr style='height:196.2pt'>
3463 <td valign="top" style=
3464 'width:211.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>
3465 <p class="Verbatim"><span style='font-size:9.0pt'># include
3467 <p class="Verbatim"><span style='font-size:9.0pt'># include
3468 "mstring.h"</span></p>
3469 <p class="Verbatim"><span style='font-size:9.0pt'> </span></p>
3470 <p class="Verbatim"><span style='font-size:9.0pt'>bool isPalindrome
3471 (mstring s)</span></p>
3472 <p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
3473 <p class="Verbatim"><span class="Line"><span style=
3474 'font-size:8.0pt'> 6</span></span> <span style=
3475 'font-size:9.0pt'>char *current = (char *) s;</span></p>
3476 <p class="Verbatim"><span class="Line"><span style=
3477 'font-size:8.0pt'> 7</span></span> <span style=
3478 'font-size:9.0pt'>int i, len = (int) strlen (s);</span></p>
3479 <p class="Verbatim"><span style='font-size:9.0pt'> </span></p>
3480 <p class="Verbatim"><span style='font-size:9.0pt'> for (i =
3481 0; i <= (len+1) / 2; i++)</span></p>
3482 <p class="Verbatim"><span style=
3483 'font-size:9.0pt'> {</span></p>
3484 <p class="Verbatim"><span class="Line"><span style=
3485 'font-size:8.0pt'>11</span></span><span style=
3486 'font-size:9.0pt'> if (current[i] !=
3487 s[len-i-1])</span></p>
3488 <p class="Verbatim"><span style=
3489 'font-size:9.0pt'> return
3491 <p class="Verbatim"><span style=
3492 'font-size:9.0pt'> }</span></p>
3493 <p class="Verbatim"><span style='font-size:9.0pt'> return
3495 <p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
3496 <p class="Verbatim"><span style='font-size:9.0pt'> </span></p>
3497 <p class="Verbatim"><span style='font-size:9.0pt'>bool callPal
3499 <p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
3500 <p class="Verbatim"><span class="Line"><span style=
3501 'font-size:8.0pt'>19</span></span><i><span style=
3502 'font-size:9.0pt;font-family:Arial'> </span></i>
3503 <span style='font-size:9.0pt'>return (isPalindrome
3504 ("bob"));</span></p>
3505 <p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
3506 <td valign="top" style=
3507 'width:207.0pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>
3508 <p class="lclintrun">> splint palindrome.c</p>
3509 <p class="lclintrun"> </p>
3510 <p class="lclintrun">palindrome.c:6: Cast from underlying</p>
3511 <p class="lclintrun"> abstract type mstring:
3513 <p class="lclintrun">palindrome.c:7: Function strlen expects
3515 <p class="lclintrun"> 1 to be char * gets
3517 <p class="lclintrun">palindrome.c:11: Array fetch from
3519 <p class="lclintrun"> (mstring): s[len - i -
3521 <p class="lclintrun">palindrome.c:19: Function isPalindrome</p>
3522 <p class="lclintrun"> expects arg 1 to be mstring
3524 <p class="lclintrun"> "bob"</p>
3525 <p class="TextFontCX"> </p>
3526 <p class="lclintrun">Finished checking --- 4 code warnings</p>
3527 <p class="TextFontCX"><span style=
3528 'font-size: 9.0pt;font-family:Times'> </span></p></td></tr></table>
3529 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
3531 <td valign="top" style=
3532 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
3533 <p class="MsoCaption"><a name="_Toc534824609"></a><a name=
3534 "_Toc347255385"></a><a name="_Ref344908730"></a><a name=
3535 "_Ref344908735">Figure 5</a>. Information Hiding
3536 Violations</p></td></tr></table></center>
3537 <p align="right"><i><span style=
3538 'font-size:9.0pt'> Traditionally, programming books wax
3539 mathematical when they arrive at the topic of abstract data
3541 Such books make it seem as if you’d never actually use an
3542 abstract data type except as a sleep aid.</span></i></p>
3544 <p class="TextFontCX" align="right" style='text-align:right'>
3546 'font-size:9.0pt'> </span></i>
3547 <span style='font-size:9.0pt'> Steve
3548 McConnell</span></p>
3549 <p class="TextFontCX"><i> </i></p>
3550 <h3 style='margin-left:0in;text-indent:0in'><a name=
3551 "_Toc534974954"></a><a name="_Ref344892422"></a><a name=
3552 "_Ref344870884"></a><a name="_Toc344355398">4.3.1<span style=
3553 'font:7.0pt "Times New Roman"'> </span>
3554 Controlling Access</a></h3>
3555 <p class="TextFontCX">Where code may manipulate the representation
3556 of an abstract type, we say the code has <i>access</i> to that
3557 type. If code has access to an abstract type, the
3558 representation of the type and the abstract type are
3559 indistinguishable. Usually, a single program module that is
3560 the only code that has access to the type representation implements
3561 an abstract type. Sometimes, more complicated access control
3562 is desired if the implementation of an abstract type is split
3563 across program files, or particular client code needs to access the
3565 <p class="TextFontCX"> </p>
3566 <p class="beforelist">There are a several ways of selecting what
3567 code has access the representation of an abstract type:</p>
3568 <p class="TextFontCX" style=
3569 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
3570 'font-family:Symbol'>·<span style=
3571 'font:7.0pt "Times New Roman"'> </span></span>
3572 Modules. An abstract type defined in <i><span style=
3573 'font-size: 10.0pt;font-family:Arial'>M</span></i><span class="Keyword">
3575 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
3576 is accessible in <i><span style=
3577 'font-size:10.0pt;font-family:Arial'>M</span></i><span class=
3578 "Keyword"><span style=
3579 'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>.
3580 Controlled by the <span class="Flag"><span style=
3581 'font-size:10.0pt'>accessmodule</span></span> flag. This
3582 means when <span class="Flag"><span style=
3583 'font-size:10.0pt'>accessmodule</span></span> is on, as it is by
3584 default, the module access rule is in effect. If
3585 <span class="Flag"><span style=
3586 'font-size:10.0pt'>accessmodule</span></span> is off (when
3587 <span class="Flag"><span style=
3588 'font-size:10.0pt'>-access-module</span></span> is used), the
3589 module access rule is not in effect and an abstract type
3590 defined in <i><span style=
3591 'font-size:10.0pt;font-family:Arial'>M</span></i><span class=
3592 "Keyword"><span style=
3593 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
3594 is not necessarily accessible in <i><span style=
3595 'font-size:10.0pt;font-family: Arial'>M</span></i><span class="Keyword">
3597 'font-size:10.0pt; font-family:Arial;color:windowtext'>.c</span></span>.</p>
3598 <p class="TextFontCX" style=
3599 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
3600 'font-family:Symbol'>·<span style=
3601 'font:7.0pt "Times New Roman"'> </span></span>
3602 File names. An abstract type named <span class=
3603 "CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
3604 is accessible in files named <span class=
3605 "CodeText"><i><span style='font-size:10.0pt'>type.<extension></span></i></span>.
3606 For example, the representation of <span class=
3607 "CodeText"><span style=
3608 'font-size: 10.0pt'>mstring</span></span> is accessible in
3609 <span class="CodeText"><span style=
3610 'font-size:10.0pt'>mstring.h</span></span> and <span class=
3611 "CodeText"><span style=
3612 'font-size:10.0pt'>mstring.c</span></span>. Controlled
3613 by the <span class="Flag"><span style=
3614 'font-size:10.0pt'>access-file</span></span> flag.</p>
3615 <p class="MsoListBullet"><span style=
3616 'font-family:Symbol'>·<span style=
3617 'font:7.0pt "Times New Roman"'> </span></span>
3618 Function names. An abstract type named <span class=
3619 "CodeText"><i><span style=
3620 'font-size: 10.0pt'>type</span></i></span> may be accessible in a
3621 function named <span class="CodeText"><i><span style=
3622 'font-size:10.0pt'>type_name</span></i></span> or
3623 <span class="CodeText"><i><span style=
3624 'font-size:10.0pt'>typeName</span></i></span>. For
3625 example, <span class="CodeText"><span style=
3626 'font-size:10.0pt'>mstring_length</span></span> and
3627 <span class="CodeText"><span style=
3628 'font-size:10.0pt'>mstringLength</span></span> would have
3629 access to the <span class="CodeText"><span style=
3630 'font-size:10.0pt'>mstring</span></span> abstract type.
3631 Controlled by <span class="Flag"><span style=
3632 'font-size:10.0pt'>accessfunction</span></span> and the
3633 naming convention (see Section 12).</p>
3634 <p class="TextFontCX" style=
3635 'margin-left:12.95pt; text-indent:-12.95pt'><span style=
3636 'font-family:Symbol'>·<span style=
3637 'font:7.0pt "Times New Roman"'> </span></span>
3638 Access control comments. The syntax <span class=
3639 "Annot"><span style='font-size:10.0pt'>/*@access
3640 <i>type</i>,<sup>+</sup>@*/</span></span><a href="#_ftn2"
3641 name="_ftnref2" title=""><span class=
3642 "MsoFootnoteReference"><span class=
3643 "MsoFootnoteReference"><span style=
3644 'font-size:11.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>
3645 allows the following code to access the representation of
3646 <span class="CodeText"><i><span style=
3647 'font-size:10.0pt'>type</span></i></span>. Similarly,
3648 <span class="Annot"><span style=
3649 'font-size:10.0pt'>/*@noaccess</span></span> <span class=
3650 "Annot"><span style=
3651 'font-size:10.0pt'><i>type</i>,<sup>+</sup>@*/</span></span>
3652 restricts access to the representation of <span class=
3653 "CodeText"><i><span style=
3654 'font-size: 10.0pt'>type</span></i></span>. The type in
3655 a <span class="Annot"><span style=
3656 'font-size:10.0pt'>noaccess</span></span> comment must have
3657 been declared as an abstract type.</p>
3658 <h3 style='margin-left:0in;text-indent:0in'><a name=
3659 "_Toc534974955"></a><a name="_Toc344355399"></a><a name=
3660 "_Ref343240525"></a><a name="_Ref343240518">4.3.2<span style=
3661 'font:7.0pt "Times New Roman"'> </span>
3663 <p class="TextFontCX">We can view types as being <i>mutable</i> or
3664 <i>immutable</i>. A type is mutable if passing it as a
3665 parameter to a function call can change the value of an instance of
3666 the type. For example, the primitive type <span class=
3667 "CodeText"><span style='font-size:10.0pt'>int</span></span> is
3668 immutable. If <span class="CodeText"><span style=
3669 'font-size:10.0pt'>i</span></span> is a local variable of type
3670 <span class="CodeText"><span style=
3671 'font-size:10.0pt'>int</span></span> and no variables point to the
3672 location where <span class="CodeText"><span style=
3673 'font-size:10.0pt'>i</span></span> is stored, the value of
3674 <span class="CodeText"><span style=
3675 'font-size:10.0pt'>i</span></span> must be the same before and
3676 after the call <span class="CodeText"><span style=
3677 'font-size:10.0pt'>f (i)</span></span>. Structure and union
3678 types are also immutable, since they are copied when they are
3679 passed as arguments. On the other hand, pointer types are
3680 mutable. If <span class="CodeText"><span style=
3681 'font-size:10.0pt'>x</span></span> is a local variable of type
3682 <span class="CodeText"><span style='font-size:10.0pt'>int
3683 *</span></span>, the value of <span class=
3684 "CodeText"><span style='font-size:10.0pt'>*x</span></span>
3685 (and hence, the value of the object <span class=
3686 "CodeText"><span style='font-size:10.0pt'>x</span></span>)
3687 can be changed by the function call <span class=
3688 "CodeText"><span style=
3689 'font-size:10.0pt'>g(x)</span></span>. </p>
3690 <p class="TextFontCX"> </p>
3691 <p class="TextFontCX">The mutability of a concrete type is
3692 determined by its type definition. For abstract types, mutability
3693 does not depend on the type representation but on what operations
3694 the type provides. If an abstract type has operations that may
3695 change the value of instances of the type, the type is
3696 mutable. If not, it is immutable. The value of an
3697 instance of an immutable type never changes. Since object
3698 sharing is noticeable only for mutable types, they are checked
3699 differently from immutable types.</p>
3700 <p class="TextFontCX"> </p>
3701 <p class="beforelist">The <span class="Annot"><span style=
3702 'font-size:10.0pt'>/*@mutable@*/</span></span> and
3703 <span class="Annot"><span style=
3704 'font-size:10.0pt'>/*@immutable@*/</span></span> annotations
3705 are used to declare an abstract type as mutable or
3706 immutable. (If neither is used, the abstract type is
3707 assumed to be mutable.) For example,</p>
3708 <p class="Verbatim"> typedef /*@abstract@*/
3709 /*@mutable@*/ char *mstring;</p>
3710 <p class="Verbatim"> typedef /*@abstract@*/
3711 /*@immutable@*/ int weekDay;</p>
3712 <p class="afterlist">declares <span class=
3713 "CodeText"><span style='font-size:10.0pt'>mstring</span></span>
3714 as a mutable abstract type and <span class=
3715 "CodeText"><span style=
3716 'font-size: 10.0pt'>weekDay</span></span> as an immutable
3718 <p class="TextFontCX"> </p>
3719 <p class="TextFontCX">Clients of a mutable abstract type need to
3720 know the semantics of assignment. After the assignment
3721 expression <span class="CodeText"><span style='font-size:10.0pt'>s
3722 = t</span></span>, do <span class="CodeText"><span style=
3723 'font-size:10.0pt'>s</span></span> and <span class=
3724 "CodeText"><span style='font-size:10.0pt'>t</span></span> refer to
3725 the same object (that is, will changes to the value of
3726 <span class="CodeText"><span style=
3727 'font-size:10.0pt'>s</span></span> also change the value of
3728 <span class="CodeText"><span style=
3729 'font-size:10.0pt'>t</span></span>).</p>
3730 <p class="TextFontCX"> </p>
3731 <p class="TextFontCX">Splint prescribes that all abstract types
3732 have sharing semantics, so <span class=
3733 "CodeText"><span style='font-size:10.0pt'>s</span></span> and
3734 <span class="CodeText"><span style=
3735 'font-size:10.0pt'>t</span></span> would indeed be the same
3736 object. Splint will produce a warning if a mutable type
3737 is implemented with a representation (e.g., a <span class=
3738 "CodeText"><span style=
3739 'font-size:10.0pt'>struct</span></span>) that does not
3740 provide sharing semantics (controlled by <span class=
3742 'font-size:10.0pt'>mutrep</span></span> flag). </p>
3743 <p class="TextFontCX"> </p>
3744 <p class="TextFontCX">The mutability of an abstract type is not
3745 necessarily the same as the mutability of its representation. We
3746 could use the immutable concrete type <span class=
3747 "CodeText"><span style='font-size:10.0pt'>int</span></span> to
3748 represent mutable strings using an index into a string table, or
3749 declare <span class="CodeText"><span style=
3750 'font-size:10.0pt'>mstring</span></span> as immutable as long as no
3751 operations are provided that modify the value of an
3752 <span class="CodeText"><span style=
3753 'font-size:10.0pt'>mstring</span></span>.</p>
3756 <h2 style='margin-left:0in;text-indent:0in'><a name=
3757 "_Toc534974956"></a><a name="_Toc344355422"></a><a name=
3758 "_Ref343109614">4.3.3<span style=
3759 'font:7.0pt "Times New Roman"'> </span>
3760 Semi-Abstract Types</a></h2>
3762 Sometimes it is useful to have a type that is abstract in some ways, but can be used with the standard numerical operators. Splint supports numabstract types for this purpose. The /*@numabstract@*/ annotation denotes a numabstract type. Splint will report warnings when numabstract types are used inconsistently, but allow binary numeric operators to operate on two values of the same numabstract type.
3764 Several flags control the strictness of type checking for numabstract types:
3765 <span class="flag">numabstract, numabstractcast, numabstractlit, numabstractindex,
3768 <span class="flag"> numabstractprint
3773 <h2 style='margin-left:0in;text-indent:0in'><a name=
3774 "_Toc534974956"></a><a name="_Toc344355422"></a><a name=
3775 "_Ref343109614">4.4<span style=
3776 'font:7.0pt "Times New Roman"'> </span>
3777 Polymorphism</a></h2>
3778 <p class="TextFontCX">In C, all declarators must be declared to
3779 have exactly one type. This makes it impossible to write
3780 functions that operate on more than one type of parameter –
3781 for example, we cannot use the same square function for
3782 <span class="CodeText"><span style=
3783 'font-size:10.0pt'>int</span></span>s and <span class=
3784 "CodeText"><span style=
3785 'font-size:10.0pt'>float</span></span>s. Because of the
3786 stricter type checking made possible by Splint, it is often
3787 useful to declare a parameter that has more than one possible
3789 <p class="TextFontCX"> </p>
3790 <p class="TextFontCX">Splint provides alternate types to indicate
3791 that a declaration may be one of several possible types. The
3792 <span class="Annot"><span style='font-size:10.0pt'>/*@alt
3793 <i>type</i>,<sup>+</sup>@*/</span></span> annotation creates a
3794 union type. For example, <span class=
3795 "CodeText"><span style='font-size:10.0pt'>int</span></span>
3796 <a href="mailto:/*@alt"><span class="Annot"><span style=
3797 'font-size:10.0pt'>/*@alt</span></span></a><span class=
3798 "Annot"><span style='font-size:10.0pt'>char,
3799 unsigned</span></span> <a href="mailto:char@*/"><span class=
3800 "Annot"><span style=
3801 'font-size:10.0pt'>char@*/</span></span></a><span class=
3802 "CodeText"><span style='font-size:10.0pt'>c</span></span>
3803 declares <span class="CodeText"><span style=
3804 'font-size:10.0pt'>c</span></span> such that either an
3805 <span class="CodeText"><span style=
3806 'font-size:10.0pt'>int</span></span>, <span class=
3807 "CodeText"><span style='font-size:10.0pt'>char</span></span>
3808 or <span class="CodeText"><span style=
3809 'font-size:10.0pt'>unsigned char</span></span> value may be
3810 assigned to it without warning.</p>
3811 <p class="TextFontCX"> </p>
3812 <p class="TextFontCX">One use of alternate types is to specify the
3813 type of a macro that operates on multiple types of operands (see
3814 Section 11.2.1). Alternate types are also useful for
3815 declaring functions for which the return value may be safely
3816 ignored (see Section 8.4.2). A function can be declared to
3817 return <span class="CodeText"><i><span style=
3818 'font-size:10.0pt'>t</span></i></span> <a href=
3819 "mailto:/*@alt"><span class="Annot"><span style=
3820 'font-size:10.0pt'>/*@alt</span></span></a><a href=
3821 "mailto:void@*/"><span class="Annot"><span style=
3822 'font-size:10.0pt'>void@*/</span></span></a> to indicate that it
3823 returns a value of type <span class=
3824 "CodeText"><i><span style='font-size:10.0pt'>t</span></i></span>,
3825 but there should be not warning if that value is ignored.</p>
3826 <h1 style='margin-left:0in;text-indent:0in'><a name=
3827 "_Toc534974957"></a><a name="_Ref534008388">5<span style=
3828 'font:7.0pt "Times New Roman"'> </span>
3829 <a id="memory" name="memory">
3830 Memory Management</a>
3832 <p class="TextFontCX">About half the bugs in typical C programs can
3833 be attributed to memory management problems. Memory
3834 management bugs are notoriously difficult to detect through
3835 traditional techniques. Often, the symptom of the bug is far
3836 removed from its actual source. Memory management bugs often
3837 only appear sporadically and some bugs may only be apparent when
3838 compiler optimizations are turned on or the code is compiled on a
3839 different platform. Run-time tools offer some help, but are
3840 cumbersome to use and limited to detecting errors that occur when
3841 test cases are run. By detecting these errors statically, we
3842 can be confident that certain types of errors will never occur and
3843 provide verified documentation on the memory management behavior of
3844 a program. </p>
3845 <p class="TextFontCX"> </p>
3846 <p class="beforelist">Splint can detect many memory management
3847 errors at compile time including using storage that may have been
3848 deallocated (Section 5.2), memory leaks (Section 5.2), or
3849 returning a pointer to stack-allocated storage (Section
3851 <p align="right"><i><span style='font-size:9.0pt'>Yea, from the
3852 table of my memory I'll wipe away all trivial fond records, all
3854 all forms, all pressures past, that youth and observation copied
3855 there.</span></i><br>
3856 <span style='font-size:9.0pt'>Hamlet prefers
3857 garbage collection (Shakespeare, Hamlet. Act I, Scene
3859 <p class="afterlist">Most of these checks depend on annotations
3860 added to programs to document assumptions related to memory
3861 management and pointer values. By documenting these
3862 assumptions for function interfaces, variables, type definitions
3863 and structure fields, memory management bugs can be detected at
3864 their source — where an assumption is violated. In
3865 addition, precise documentation about memory management decisions
3866 makes it easier to change code.</p>
3867 <h2 style='margin-left:0in;text-indent:0in'><a name=
3868 "_Toc534974958"></a><a name="_Toc344355408">5.1<span style=
3869 'font:7.0pt "Times New Roman"'> </span>
3870 Storage Model</a></h2>
3871 <p class="TextFontCX">This section describes execution-time
3872 concepts for describing the state of storage more precisely than
3873 can be done using standard C terminology. Certain uses of
3874 storage are likely to indicate program bugs, and are reported as
3875 anomalies.<a href="#_ftn3" name="_ftnref3" title=
3876 ""><span class="MsoFootnoteReference"><b><span class=
3877 "MsoFootnoteReference"><b><span style=
3878 'font-size:11.0pt;font-family:"Times New Roman"'>[3]</span></b></span></b></span></a></p>
3879 <p class="TextFontCX"> </p>
3880 <p class="TextFontCX">Splint assumes a CLU-like object storage
3881 model.<a href="#_ftn4" name="_ftnref4" title=""><span class=
3882 "MsoFootnoteReference"><span class=
3883 "MsoFootnoteReference"><span style=
3884 'font-size:11.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>
3885 An <i>object</i> is a typed region of storage. Some objects
3886 use a fixed amount of storage that is allocated and deallocated
3887 automatically by the compiler. Other objects use dynamic
3888 storage that must be managed by the program.</p>
3889 <p class="TextFontCX"> </p>
3890 <p class="TextFontCX">Storage is <i>undefined</i> if it has not
3891 been assigned a value, and <i>defined</i> after it has been
3892 assigned a value. An object is <i>completely defined</i> if
3893 all storage that may be reached from it is defined. What
3894 storage is reachable from an object depends on the type and value
3895 of the object. For example, if <span class=
3896 "CodeText"><span style='font-size:10.0pt'>p</span></span> is a
3897 pointer to a structure, <span class="CodeText"><span style=
3898 'font-size:10.0pt'>p</span></span> is completely defined if the
3899 value of <span class="CodeText"><span style=
3900 'font-size:10.0pt'>p</span></span> is <span class=
3901 "CodeText"><span style='font-size:10.0pt'>NULL</span></span>, or if
3902 every field of the structure <span class=
3903 "CodeText"><span style='font-size:10.0pt'>p</span></span>
3904 points to is completely defined.</p>
3905 <p class="TextFontCX"> </p>
3906 <p class="TextFontCX">When an expression is used as the left side
3907 of an assignment expression we say it is <i>used as an
3908 lvalue</i>. Its location in memory is used, but not its
3909 value. Undefined storage may be used as an lvalue since only
3910 its location is needed. When storage is used in any other
3911 way, such as on the right side of an assignment, as an operand to a
3912 primitive operator (including the indirection operator,
3913 <span class="CodeText"><span style=
3914 'font-size:10.0pt'>*</span></span>),<a href="#_ftn5" name=
3915 "_ftnref5" title=""><span class=
3916 "MsoFootnoteReference"><span class=
3917 "MsoFootnoteReference"><span style=
3918 'font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>
3919 or as a function parameter, we say it is <i>used as an
3920 rvalue</i>. It is an anomaly to use undefined storage
3922 <p class="TextFontCX"> </p>
3923 <p class="TextFontCX">A <i>pointer</i> is a typed memory
3924 address. A pointer is either <i>live</i> or
3925 <i>dead</i>. A live pointer is either <span class=
3926 "CodeText"><span style='font-size:10.0pt'>NULL</span></span> or an
3927 address within allocated storage. A pointer that points to an
3928 object is an <i>object</i> pointer. A pointer that points
3929 inside an object (e.g., to the third element of an allocated block)
3930 is an <i>offset</i> pointer. A pointer that points to
3931 allocated storage that is not defined is an <i>allocated</i>
3932 pointer. The result of dereferencing an allocated pointer is
3933 undefined storage. Hence, it is an anomaly to use it as an
3934 rvalue. A dead (or “dangling”) pointer does not
3935 point to allocated storage. A pointer becomes dead if the
3936 storage it points to is deallocated (e.g., the pointer is passed to
3937 the <span class="CodeText"><span style=
3938 'font-size:10.0pt'>free</span></span> library function.) It
3939 is an anomaly to use a dead pointer as an rvalue.</p>
3940 <p class="TextFontCX"> </p>
3941 <p class="TextFontCX">There is a special object <i>null</i>
3942 corresponding to the <span class="CodeText"><span style=
3943 'font-size:10.0pt'>NULL</span></span>pointer in a C program.
3944 A pointer that may have the value <span class=
3945 "CodeText"><span style='font-size:10.0pt'>NULL</span></span> is a
3946 <i>possibly-null</i> pointer. It is an anomaly to use a
3947 possibly-null pointer where a non-null pointer is expected (e.g.,
3948 certain function arguments or the indirection operator).</p>
3949 <h2 style='margin-left:0in;text-indent:0in'><a name=
3950 "_Toc534974959"></a><a name="_Ref347476065"></a><a name=
3951 "_Ref347469133"></a><a name="_Ref347465595"></a><a name=
3952 "_Ref344893840"></a><a name="_Toc344355409">5.2<span style=
3953 'font:7.0pt "Times New Roman"'> </span>
3954 Deallocation Errors</a></h2>
3955 <p class="TextFontCX">There are two kinds of deallocation errors
3956 with which we are concerned: deallocating storage when there
3957 are other live references to the same storage, or failing to
3958 deallocate storage before the last reference to it is lost.
3959 To handle these deallocation errors, we introduce a concept of an
3960 obligation to release storage. Every time storage is
3961 allocated, it creates an obligation to release the storage.
3962 This obligation is attached to the reference to which the storage
3963 is assigned.<a href="#_ftn6" name="_ftnref6" title=
3964 ""><span class="MsoFootnoteReference"><span class=
3965 "MsoFootnoteReference"><span style=
3966 'font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>
3967 Before the scope of the reference is exited or it is assigned
3968 to a new value, the storage to which it points must be
3969 released. Annotations can be used to indicate that
3970 this obligation is transferred through a return value,
3971 function parameter or assignment to an external
3973 <p align="right"><i><span style='font-size:9.0pt'>‘Tis in my
3974 memory lock’d, and you yourself shall keep the key of
3976 <span style='font-size:9.0pt'>Ophelia prefers explicit
3977 deallocation (Hamlet. Act I, Scene iii)</span></p>
3978 <h3 style='margin-left:0in;text-indent:0in'><a name=
3979 "_Toc534974960">5.2.1<span style=
3980 'font:7.0pt "Times New Roman"'> </span>
3981 Unshared References</a></h3>
3982 <p class="TextFontCX">The <span class="Annot"><span style=
3983 'font-size:10.0pt'>only</span></span> annotation is used to
3984 indicate a reference is the only pointer to the object it points
3985 to. We can view the reference as having an obligation to
3986 release this storage. This obligation is satisfied by
3987 transferring it to some other reference in one of three ways:</p>
3988 <p class="MsoListBullet"><span style=
3989 'font-family:Symbol'>·<span style=
3990 'font:7.0pt "Times New Roman"'> </span></span>
3991 pass it as an actual parameter corresponding to a formal parameter
3992 declared with an <span class="Annot"><span style=
3993 'font-size:10.0pt'>only</span></span>
3994 annotation </p>
3995 <p class="MsoListBullet"><span style=
3996 'font-family:Symbol'>·<span style=
3997 'font:7.0pt "Times New Roman"'> </span></span>
3998 assign it to an external reference declared with an
3999 <span class="Annot"><span style=
4000 'font-size:10.0pt'>only</span></span> annotation</p>
4001 <p class="MsoListBullet"><span style=
4002 'font-family:Symbol'>·<span style=
4003 'font:7.0pt "Times New Roman"'> </span></span>
4004 return it as a result declared with an <span class=
4005 "Annot"><span style='font-size:10.0pt'>only</span></span>
4007 <p class="afterlist">After the release obligation is transferred,
4008 the original reference is a dead pointer and the storage it points
4009 to may not be used.</p>
4010 <p class="TextFontCX"> </p>
4011 <p class="TextFontCX">All obligations to release storage stem from
4012 primitive allocation routines (e.g., <span class=
4013 "CodeText"><span style='font-size:10.0pt'>malloc</span></span>),
4014 and are ultimately satisfied by calls to <span class=
4015 "CodeText"><span style='font-size:10.0pt'>free</span></span>.
4016 The standard library declared the primitive allocation and
4017 deallocation routines.</p>
4018 <p class="TextFontCX"> </p>
4019 <p class="TextFontCX">The basic memory allocator,
4020 <span class="CodeText"><span style=
4021 'font-size:10.0pt'>malloc</span></span>, is declared:</p>
4022 <p class="example"><a href="mailto:/*@only@*/">/*@only@*/</a>
4023 /*@null@*/ void *malloc (size_t size);</p>
4024 <p class="TextFontCX">It returns an object that is referenced only
4025 by the function return value. </p>
4026 <p class="TextFontCX"> </p>
4027 <p class="TextFontCX">The deallocator, <span class=
4028 "CodeText"><span style='font-size:10.0pt'>free</span></span>, is
4029 declared:<a href="#_ftn7" name="_ftnref7" title=
4030 ""><span class="MsoFootnoteReference"><span class=
4031 "MsoFootnoteReference"><span style=
4032 'font-size:11.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a></p>
4033 <p class="example">void free (/*@only@*/ <a href=
4034 "mailto:/*@out@*/">/*@out@*/</a> <a href=
4035 "mailto:/*@null@*/">/*@null@*/</a> void *ptr);</p>
4037 <table class="MsoNormalTable" border="0" cellspacing="0"
4038 cellpadding="0" style=
4039 'margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
4041 <td valign="top" style=
4042 'width:193.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
4043 <p class="TextFontCX" align="center" style='text-align:center'>
4044 <a name="_Ref344990094"><span class="Keyword"><b><span style=
4045 'font-size:10.0pt;color:white'>only.c</span></b></span></a></p></td>
4046 <td valign="top" style=
4047 'width:225.0pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
4048 <p class="TextFontCX" align="center" style='text-align:center'>
4049 <b><span style='color:white'>Running
4050 Splint</span></b></p></td></tr>
4052 <td valign="top" style=
4053 'width:193.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
4054 <p class="Verbatim"><i><span style=
4055 'font-size:8.0pt;font-family:Arial'>1 </span></i>
4056 <span style='font-size:9.5pt'>extern /*@only@*/ int
4058 <p class="Verbatim"><span style='font-size:9.5pt'> </span></p>
4059 <p class="Verbatim"><span style='font-size:9.5pt'>/*@only@*/ int
4061 <p class="Verbatim"><span style='font-size:9.5pt'>f (/*@only@*/ int
4062 *x, int *y,</span></p>
4063 <p class="Verbatim"><span style='font-size:9.5pt'> int
4065 <p class="Verbatim"><span style='font-size:9.5pt'> /*@globals
4067 <p class="Verbatim"><span style='font-size:9.5pt'>{</span></p>
4068 <p class="Verbatim"><i><span style=
4069 'font-size:8.0pt;font-family:Arial'> 8</span></i>
4070 <span style='font-size:9.5pt'>int *m = (int *)</span></p>
4071 <p class="Verbatim"><i><span style=
4072 'font-size:8.0pt;font-family:Arial'> 9</span></i><span style='font-size:9.5pt'>
4073 malloc (sizeof (int));</span></p>
4074 <p class="Verbatim"><span style='font-size:9.5pt'> </span></p>
4075 <p class="Verbatim"><i><span style=
4076 'font-size:8.0pt;font-family:Arial'>11</span></i>
4077 <span style='font-size:9.5pt'>glob =
4078 y; </span> <i><span style=
4079 'font-size:9.5pt; font-family:"Times New Roman"'>Memory
4081 <p class="Verbatim"><i><span style=
4082 'font-size:8.0pt;font-family:Arial'>12</span></i>
4083 <span style='font-size:9.5pt'>free (x);</span></p>
4084 <p class="Verbatim"><i><span style=
4085 'font-size:8.0pt;font-family:Arial'>13</span></i>
4086 <span style='font-size:9.5pt'>*m =
4087 *x; </span> <i><span style=
4088 'font-size:9.5pt; font-family:"Times New Roman"'>Use after
4090 <p class="Verbatim"><i><span style=
4091 'font-size:8.0pt;font-family:Arial'>14</span></i>
4092 <span style='font-size:9.5pt'>return
4093 z; </span> <i><span style=
4094 'font-size:9.5pt; font-family:"Times New Roman"'>Memory leak
4095 detected</span></i><i><span style=
4096 'font-size:9.5pt;font-family:Arial'> </span></i></p>
4097 <p class="TextFontCX"><span style=
4098 'font-size: 9.5pt'>}</span></p></td>
4099 <td valign="top" style=
4100 'width:225.0pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
4101 <p class="lclintrun">> splint only.c</p>
4102 <p class="lclintrun">only.c:11: Only storage glob (type int *) not
4104 <p class="lclintrun">
4105
4106 before assignment: glob = y</p>
4107 <p class="lclintrun"> only.c:1: Storage glob becomes
4109 <p class="lclintrun">only.c:11: Implicitly temp storage y assigned
4111 <p class="lclintrun">
4112
4114 <p class="lclintrun">only.c:13: Dereference of possibly null
4116 <p class="lclintrun"> only.c:8: Storage m may become
4118 <p class="lclintrun">only.c:13: Variable x used after being
4120 <p class="lclintrun"> only.c:12: Storage x released</p>
4121 <p class="lclintrun">only.c:14: Implicitly temp storage z returned
4123 <p class="lclintrun">only.c:14: Fresh storage m not released before
4125 <p class="lclintrun" style='page-break-after:avoid'>
4126 only.c:9: Fresh storage m
4127 allocated </p></td></tr></table>
4128 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
4130 <td valign="top" align="left" style=
4131 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
4132 <p class="MsoCaption"><a name="_Toc534824610">Figure 6.
4133 Memory Management</a></p></td></tr></table>
4134 <p class="TextFontCX">The parameter to <span class=
4135 "CodeText"><span style='font-size:10.0pt'>free</span></span> must
4136 reference an unshared object. Since the parameter is declared
4137 using <span class="Annot"><span style=
4138 'font-size:10.0pt'>only</span></span>, the caller may not use the
4139 referenced object after the call, and may not pass in a reference
4140 to a shared object. There is nothing special about
4141 <span class="CodeText"><span style=
4142 'font-size:10.0pt'>malloc</span></span> and <span class=
4143 "CodeText"><span style='font-size:10.0pt'>free</span></span>
4144 — their behavior can be described entirely in terms of the
4145 provided annotations.</p>
4146 <h3 style='margin-left:0in;text-indent:0in'><a name=
4147 "_Ref347468963"></a><a name="_Toc534974961"></a><a name=
4148 "_Ref347469360">5.2.2<span style=
4149 'font:7.0pt "Times New Roman"'> </span>
4150 Temporary Parameters</a></h3>
4151 <p class="TextFontCX">The <span class="Annot"><span style=
4152 'font-size:10.0pt'>temp</span></span> annotation is used to
4153 declare a function parameter that is used temporarily by the
4154 function. An error is reported if the function releases the
4155 storage associated with a <span class="Annot"><span style=
4156 'font-size:10.0pt'>temp</span></span> formal parameter or creates
4157 new aliases to it that are visible after the function
4158 returns. Any storage may be passed as a <span class=
4159 "Annot"><span style='font-size:10.0pt'>temp</span></span>
4160 parameter, and it satisfies its original memory constraints after
4161 the function returns.</p>
4162 <h3 style='margin-left:0in;text-indent:0in'><a name=
4163 "_Toc534974962">5.2.3<span style=
4164 'font:7.0pt "Times New Roman"'> </span>
4165 Owned and Dependent References</a></h3>
4166 <p class="TextFontCX">In real programs it is sometimes necessary to
4167 have storage that is shared between several possibly
4168 references. The <span class="Annot"><span style=
4169 'font-size:10.0pt'>owned</span></span> and <span class=
4170 "Annot"><span style='font-size:10.0pt'>dependent</span></span>
4171 annotations provide a more flexible way of managing storage, at the
4172 cost of less checking. The <span class=
4173 "Annot"><span style='font-size:10.0pt'>owned</span></span>
4174 annotation denotes a reference with an obligation to release
4175 storage. Unlike <span class="Annot"><span style=
4176 'font-size:10.0pt'>only</span></span>, however, other
4177 external references marked with <span class=
4178 "Annot"><span style=
4179 'font-size:10.0pt'>dependent</span></span> annotations may
4180 share this object. It is up to the programmer to ensure
4181 that the lifetime of a <span class="Annot"><span style=
4182 'font-size:10.0pt'>dependent</span></span> reference is
4183 contained within the lifetime of the corresponding
4184 <span class="Annot"><span style=
4185 'font-size:10.0pt'>owned</span></span> reference.</p>
4186 <h3 style='margin-left:0in;text-indent:0in'><a name=
4187 "_Toc534974963"></a><a name="_Ref347805800">5.2.4<span style=
4188 'font:7.0pt "Times New Roman"'> </span>
4189 Keep Parameters</a></h3>
4190 <p class="TextFontCX">The <span class="Annot"><span style=
4191 'font-size:10.0pt'>keep</span></span> annotation is similar to
4192 <span class="Annot"><span style=
4193 'font-size:10.0pt'>only</span></span>, except the caller may use
4194 the reference after the call. The called function must assign
4195 the <span class="Annot"><span style=
4196 'font-size:10.0pt'>keep</span></span> parameter to an
4197 <span class="Annot"><span style=
4198 'font-size:10.0pt'>only</span></span> reference, or pass it
4199 as a <span class="Annot"><span style=
4200 'font-size:10.0pt'>keep</span></span> parameter to another
4201 function. It is up to the programmer to make sure that
4202 the calling function does not use this reference after it is
4203 released. The <span class="Annot"><span style=
4204 'font-size:10.0pt'>keep</span></span> annotation is useful
4205 for adding an object to a collection (e.g., a symbol table),
4206 where it is known that it will not be deallocated until the
4208 <h3 style='margin-left:0in;text-indent:0in'><a name=
4209 "_Toc534974964"></a><a name="_Ref347469304">5.2.5<span style=
4210 'font:7.0pt "Times New Roman"'> </span>
4211 Shared References</a></h3>
4212 <p class="TextFontCX">If Splint is used to check a program designed
4213 to be used in a garbage-collected environment, there may be storage
4214 that is shared by one or more references and never explicitly
4215 released. The <span class="Annot"><span style=
4216 'font-size:10.0pt'>shared</span></span> annotation declares storage
4217 that may be shared arbitrarily, but never released.</p>
4218 <h3 style='margin-left:0in;text-indent:0in'><a name=
4219 "_Toc534974965"></a><a name="_Ref348341639">5.2.6<span style=
4220 'font:7.0pt "Times New Roman"'> </span>
4221 Stack References</a></h3>
4222 <p class="TextFontCX">Local variables that are not allocated
4223 dynamically are stored on a call stack. When a function
4224 returns, its stack frame is deallocated, destroying the storage
4225 associated with the function’s local variables. A
4226 memory error occurs if a pointer into this storage is live after
4227 the function returns. Splint detects errors involving stack
4228 references exported from a function through return values or
4229 assignments to references reachable from global variables or actual
4230 parameters. No annotations are needed to detect stack
4231 reference errors, since it is clear from a declaration if storage
4232 is allocated on the function stack. Figure 7 gives and
4233 example of errors reported involving stack-allocated storage.</p>
4235 <table class="MsoNormalTable" border="0" cellspacing="0"
4236 cellpadding="0" style=
4237 'margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
4239 <td valign="top" style=
4240 'width:2.25in;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
4241 <p class="TextFontCX" align="center" style='text-align:center'>
4242 <span class="Keyword"><b><span style=
4243 'font-size:10.0pt; color:white'>stack.c</span></b></span></p></td>
4244 <td valign="top" style=
4245 'width:256.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
4246 <p class="TextFontCX" align="center" style='text-align:center'>
4247 <b><span style='color:white'>Running
4248 Splint</span></b></p></td></tr>
4250 <td valign="top" style=
4251 'width:2.25in;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
4252 <p class="Verbatim">int *glob;</p>
4253 <p class="Verbatim"> </p>
4254 <p class="Verbatim">/*@dependent@*/ int *</p>
4255 <p class="Verbatim"> f (int **x)</p>
4256 <p class="Verbatim">{</p>
4257 <p class="Verbatim"> int sa[2] = { 0, 1 };</p>
4258 <p class="Verbatim"> int loc = 3;</p>
4259 <p class="Verbatim"> </p>
4260 <p class="Verbatim"><span class="Line"><span style=
4261 'font-size:8.0pt'> 9</span></span> glob = &loc;</p>
4262 <p class="Verbatim"><span class="Line"><span style=
4263 'font-size:8.0pt'>10</span></span> *x = &sa[0];</p>
4264 <p class="Verbatim"> </p>
4265 <p class="Verbatim"><span class="Line"><span style=
4266 'font-size:8.0pt'>12</span></span> return &loc;</p>
4267 <p class="Verbatim">} </p></td>
4268 <td valign="top" style=
4269 'width:256.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
4270 <p class="lclintrun">> splint stack.c</p>
4271 <p class="lclintrun">stack.c:12: Stack-allocated storage &loc
4273 <p class="lclintrun">
4274
4275 from return value: &loc</p>
4276 <p class="lclintrun">stack.c:12: Stack-allocated storage *x
4278 <p class="lclintrun">
4279
4281 <p class="lclintrun"> stack.c:10: Storage *x becomes
4283 <p class="lclintrun">stack.c:12: Stack-allocated storage glob
4285 <p class="lclintrun">
4286
4287 from global glob</p>
4288 <p class="lclintrun"> stack.c:9: Storage glob becomes
4290 <p class="lclintrun"> </p>
4291 <p class="TextFontCX" align="left" style=
4292 'text-align:left;page-break-after:avoid'><i>A</i>
4293 <span class="Annot"><span style=
4294 'font-size:10.0pt'>dependent</span></span> <i>annotation is
4295 used on the return value. Without this, other warnings
4296 would be reported, since the result would have an
4297 implicit</i> <span class="Annot"><span style=
4298 'font-size: 10.0pt'>only</span></span>
4299 <i>annotation.</i></p></td></tr></table>
4300 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
4302 <td valign="top" style=
4303 'padding-top:5.05pt;padding-right: 9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>
4304 <p class="MsoCaption"><a name="_Toc534824611"></a><a name=
4305 "_Ref534821941">Figure 7</a>. Stack-Allocated
4306 Storage</p></td></tr></table></center>
4307 <h3 style='margin-left:0in;text-indent:0in'><a name=
4308 "_Toc534974966">5.2.7<span style=
4309 'font:7.0pt "Times New Roman"'> </span>
4310 Inner Storage</a></h3>
4311 <p class="TextFontCX">An annotation always applies to the outermost
4312 level of storage. For example,</p>
4313 <p class="example">/*@only@*/ int **x;</p>
4314 <p class="beforelist">declares <span class=
4315 "CodeText"><span style='font-size:10.0pt'>x</span></span> as
4316 an unshared pointer to a pointer to an <span class=
4317 "CodeText"><span style=
4318 'font-size:10.0pt'>int</span></span>. The <span class=
4319 "Flag"><span style='font-size:10.0pt'>only</span></span>
4320 annotation applies to <span class="CodeText"><span style=
4321 'font-size:10.0pt'>x</span></span>, but not to <span class=
4322 "CodeText"><span style=
4323 'font-size:10.0pt'>*x</span></span>. To apply
4324 annotations to inner storage a type definition may be
4326 <p class="Verbatim"> typedef /*@only@*/ int *oip;</p>
4327 <p class="Verbatim"> /*@only@*/ oip *x;</p>
4328 <p class="afterlist">Now, x is an <span class=
4329 "Annot"><span style='font-size:10.0pt'>only</span></span>
4330 pointer to an <span class="Annot"><span style=
4331 'font-size:10.0pt'>oip</span></span>, which is an
4332 <span class="Annot"><span style=
4333 'font-size:10.0pt'>only</span></span> pointer to an
4334 <span class="Annot"><span style=
4335 'font-size:10.0pt'>int</span></span>.</p>
4336 <p class="afterlist">When annotations are used in type definitions,
4337 they may be overridden in instance declarations. For
4339 <p class="example">/*@dependent@*/ oip x;</p>
4340 <p class="TextFontCX">makes <span class=
4341 "CodeText"><span style='font-size:10.0pt'>x</span></span> a
4342 <span class="Annot"><span style=
4343 'font-size:10.0pt'>dependent</span></span> pointer to an
4344 <span class="CodeText"><span style=
4345 'font-size:10.0pt'>int</span></span>. Another way to
4346 apply annotations to inner storage is to use a state clause
4347 (see Section 7.4).</p>
4348 <h2 style='margin-left:0in;text-indent:0in'><a name=
4349 "_Toc534974967"></a><a name="_Ref347812243"></a><a name=
4350 "_Ref344893978"></a><a name="_Toc344355410">5.3<span style=
4351 'font:7.0pt "Times New Roman"'> </span>
4352 Implicit Memory Annotations</a></h2>
4353 <p class="TextFontCX">Since it is important that Splint can check
4354 unannotated programs effectively, the meaning of declarations with
4355 no memory annotations is chosen to minimize the number of
4356 annotations needed to get useful checking on an unannotated
4358 <p class="TextFontCX"> </p>
4359 <p class="TextFontCX">An implicit memory management annotation may
4360 be assumed for declarations with no explicit memory management
4361 annotation. Implicit annotations are checked identically to
4362 the corresponding explicit annotation, except error messages
4363 indicate that they result from an implicit annotation. Figure
4364 8 illustrates some implicit annotations.</p>
4365 <p class="TextFontCX"> </p>
4366 <p class="TextFontCX">Unannotated function parameters are assumed
4367 to be <span class="Annot"><span style=
4368 'font-size:10.0pt'>temp</span></span>. This means if memory
4369 checking is turned on for an unannotated program, all functions
4370 that release storage referenced by a parameter or assign a global
4371 variable to alias the storage will produce error messages.
4372 (Controlled by <span class="Flag"><span style=
4373 'font-size:10.0pt'>paramimptemp</span></span>.)</p>
4374 <p class="TextFontCX"> </p>
4376 <table class="MsoNormalTable" border="0" cellspacing="0"
4377 cellpadding="0" style=
4378 'width:423.0pt;margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
4379 <tr style='page-break-inside:avoid'>
4380 <td colspan="2" valign="top" style=
4381 'width:423.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
4382 <p class="TextFontCX" align="center" style='text-align:center'>
4383 <span class="Keyword"><b><span style=
4384 'font-size:10.0pt; color:white'>implicit.c</span></b></span></p></td></tr>
4386 <td valign="top" style=
4387 'width:207.0pt;border-top:none;border-left: solid black 1.5pt;border-bottom:solid black 1.5pt;border-right:none; padding:0in 5.4pt 0in 5.4pt'>
4388 <p class="Verbatim">typedef struct {</p>
4389 <p class="Verbatim"> <span class=
4390 "implicit"><b>only</b></span> char *name;</p>
4391 <p class="Verbatim"> int val;</p>
4392 <p class="Verbatim">} *rec;</p>
4393 <p class="Verbatim"> </p>
4394 <p class="Verbatim">extern <span class=
4395 "implicit"><b>only</b></span> rec rec_last ;</p>
4396 <p class="Verbatim"> </p>
4397 <p class="Verbatim">extern <span class=
4398 "implicit"><b>only</b></span> rec</p>
4399 <p class="Verbatim"> rec_create (<span class=
4400 "implicit"><b>temp</b></span> char *name,</p>
4401 <p class="Verbatim">
4402
4404 <p class="TextFontCX"><i>Annotations in</i> <span class=
4405 "Keyword"><b><i><span style=
4406 'font-size:10.0pt;color:windowtext'>italics</span></i></b></span>
4407 <i>are not present in the code, but may be implied depending on
4408 flag settings.</i></p></td>
4409 <td valign="top" style=
4410 'width:3.0in;border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
4411 <p class="TextFontCX"> </p>
4412 <p class="TextFontCX" align="left" style='text-align:left'>
4413 <i>Implicit</i> <span class="Annot"><i><span style=
4414 'font-size:10.0pt'>only</span></i></span> <i>annotation on mutable
4415 structure field if</i> <span class="Flag"><span style=
4416 'font-size:10.0pt'>structimponly</span></span> <i>is on.</i></p>
4417 <p class="lclintrun"><i> </i></p>
4418 <p class="TextFontCX" align="left" style='text-align:left'>
4419 <i>Implicit</i> <span class="Annot"><span style=
4420 'font-size:10.0pt'>only</span></span> <i>annotation on mutable
4421 global variables if</i> <span class="Flag"><span style=
4422 'font-size:10.0pt'>globimponly</span></span> <i>is on.</i></p>
4423 <p class="TextFontCX" align="left" style='text-align:left'>
4425 <p class="TextFontCX" align="left" style=
4426 'text-align:left;page-break-after:avoid'><i>Implicit</i>
4427 <span class="Annot"><span style=
4428 'font-size:10.0pt'>only</span></span> <i>annotation on mutable
4429 function result if</i> <span class="Flag"><span style=
4430 'font-size: 10.0pt'>retimponly</span></span> <i>is set.
4431 Implicit</i> <span class="Annot"><span style=
4432 'font-size:10.0pt'>temp</span></span> <i>annotation on mutable
4433 parameter if</i> <span class="Flag"><span style=
4434 'font-size:10.0pt'>paramimptemp</span></span> <i>is
4435 set.</i></p></td></tr></table>
4436 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
4438 <td valign="top" align="left" style=
4439 'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
4440 <p class="MsoCaption"><a name="_Toc534824612"></a><a name=
4441 "_Ref534822006">Figure 8</a>. Implicit
4442 Annotations</p></td></tr></table></center>
4443 <p class="TextFontCX">Unannotated return values, structure fields
4444 and global variables are assumed to be <span class=
4445 "Annot"><span style='font-size:10.0pt'>only</span></span>.
4446 With implicit annotations (on by default), turning on memory
4447 checking for an unannotated program will produce errors for any
4448 function that does not return unshared storage or assignment of
4449 shared storage to a global variable or structure field. If an
4450 exposure qualifier is used (see Section 6.2), the implied
4451 <span class="Annot"><span style=
4452 'font-size: 10.0pt'>dependent</span></span> annotation is used
4453 instead of the more generally implied <span class=
4454 "Annot"><span style='font-size:10.0pt'>only</span></span>
4455 annotation. (Controlled by <span class=
4456 "Flag"><span style='font-size:10.0pt'>retimponly</span></span>,
4457 <span class="Flag"><span style=
4458 'font-size:10.0pt'>structimponly</span></span> and
4459 <span class="Flag"><span style=
4460 'font-size:10.0pt'>globimponly</span></span>. The
4461 <span class="Flag"><span style=
4462 'font-size:10.0pt'>allimponly</span></span> flag sets
4463 all of the implicit only flags.) </p>
4464 <h2 style='margin-left:0in;text-indent:0in'><a name=
4465 "_Toc534974968"></a><a name="_Ref534970957"></a><a name=
4466 "_Ref347469058"></a><a name="_Ref344907383"></a><a name=
4467 "_Toc344355411">5.4<span style=
4468 'font:7.0pt "Times New Roman"'> </span>
4469 Reference Counting</a></h2>
4470 <p class="TextFontCX">Another approach to memory management is to
4471 add a field to a type to explicitly keep track of the number of
4472 references to that storage. Every time a reference is added
4473 or lost the reference count is adjusted accordingly; if it would
4474 become zero, the storage is released. Reference counting it
4475 difficult to do without automatic checking since it is easy to
4476 forget to increment or decrement the reference count, and
4477 exceedingly difficult to track down these errors.</p>
4478 <p class="TextFontCX"> </p>
4479 <p class="TextFontCX">Splint supports reference counting by using
4480 annotations to constrain the use of reference counted storage in a
4481 manner similar to other memory management annotations.</p>
4482 <p class="TextFontCX"> </p>
4483 <p class="TextFontCX">A reference counted type is declared using
4484 the <span class="Annot"><span style=
4485 'font-size:10.0pt'>refcounted</span></span> annotation. Only
4486 pointer to <span class="CodeText"><span style=
4487 'font-size:10.0pt'>struct</span></span> types may be declared as
4488 <span class="Annot"><span style=
4489 'font-size:10.0pt'>refcounted</span></span>, since reference
4490 counted storage must have a field to count the references.
4491 One field in the structure (or integral type) is preceded by the
4492 <span class="Annot"><span style=
4493 'font-size:10.0pt'>refs</span></span> annotation to indicate that
4494 the value of this field is the number of live references to the
4495 structure. For example (in <span class="Keyword"><span style=
4496 'font-size:10.0pt;font-family:Arial; color:windowtext'>rstring.h</span></span>),</p>
4497 <p class="Verbatim" style='margin-top:6.0pt'>
4498 typedef /*@abstract@*/
4499 /*@refcounted@*/ struct {</p>
4500 <p class="Verbatim">
4501 /*@refs@*/ int refs;</p>
4502 <p class="Verbatim"> char
4504 <p class="Verbatim"> } *rstring;</p>
4505 <p class="afterlist">declares <span class=
4506 "CodeText"><span style='font-size:10.0pt'>rstring</span></span>
4507 as an abstract, reference-counted type. The
4508 <span class="CodeText"><span style=
4509 'font-size:10.0pt'>refs</span></span> field counts the number
4510 of references and the <span class="CodeText"><span style=
4511 'font-size:10.0pt'>contents</span></span> field holds the
4512 contents of a string.</p>
4513 <p class="TextFontCX"> </p>
4515 <table class="MsoNormalTable" border="0" cellspacing="0"
4516 cellpadding="0" style=
4517 'width:425.5pt;margin-left:.2in;border-collapse:collapse'>
4519 <td valign="top" style=
4520 'width:267.05pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
4521 <p class="TextFontCX" align="center" style='text-align:center'>
4522 <span class="Keyword"><b><span style=
4523 'font-size:10.0pt; color:white'>rstring.c</span></b></span></p></td>
4524 <td valign="top" style=
4525 'width:158.45pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
4526 <p class="TextFontCX" align="center" style='text-align:center'>
4527 <b><span style='color:white'>Running
4528 Splint</span></b></p></td></tr>
4530 <td valign="top" style=
4531 'width:267.05pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
4532 <p class="Verbatim"><span style='font-size:9.0pt'># include
4533 "rstring.h"</span></p>
4534 <p class="Verbatim"><span style='font-size:9.0pt'> </span></p>
4535 <p class="Verbatim"><span style='font-size:9.0pt'>static rstring
4536 rstring_ref (rstring r)</span></p>
4537 <p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
4538 <p class="Verbatim"><span style='font-size:9.0pt'>
4539 r->refs++;</span></p>
4540 <p class="Verbatim"><span class="Line"><span style=
4541 'font-size:8.0pt'>6</span></span> <span style=
4542 'font-size:9.0pt'>return r;</span></p>
4543 <p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
4544 <p class="Verbatim"><span style='font-size:9.0pt'> </span></p>
4545 <p class="Verbatim"><span style='font-size:9.0pt'>rstring
4546 rstring_first (rstring r1, rstring r2)</span></p>
4547 <p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
4548 <p class="Verbatim"><span style='font-size:9.0pt'> if (strcmp
4549 (r1->contents, r2->contents) < 0)</span></p>
4550 <p class="Verbatim"><span class="Line"><span style=
4551 'font-size:8.0pt'>12</span></span><span style=
4552 'font-size:9.0pt'> return r1;</span></p>
4553 <p class="Verbatim"><span style='font-size:9.0pt'>
4555 <p class="Verbatim"><span class="Line"><span style=
4556 'font-size:8.0pt'>14</span></span><span style=
4557 'font-size:9.0pt'> return rstring_ref
4559 <p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
4560 <td valign="top" style=
4561 'width:158.45pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
4562 <p class="lclintrun">> splint rstring.c</p>
4563 <p class="lclintrun">rstring.c:12: Reference counted </p>
4564 <p class="lclintrun"> storage returned without
4566 <p class="lclintrun"> reference count: r1</p>
4567 <p class="lclintrun"><i> </i></p>
4568 <p class="TextFontCX" align="left" style='text-align:left'>
4569 <i><span style='font-size:10.0pt'>No error is reported for line 6
4570 since the reference count was incremented. No error is
4571 reported for line 14, since</span></i> <span class=
4572 "CodeText"><i><span style=
4573 'font-size:10.0pt'>rstring_ref</span></i></span><i><span style='font-size:10.0pt'>
4574 returns a new reference.</span></i></p>
4575 <p class="TextFontCX" align="left" style=
4576 'text-align:left;page-break-after:avoid'><span style=
4577 'font-size:10.0pt'> </span></p></td></tr></table>
4578 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
4581 <td valign="top" align="left" style=
4582 'padding-top:.1in;padding-right: 0in;padding-bottom:.1in;padding-left:0in'>
4583 <p class="MsoCaption"><a name="_Toc534824613"></a><a name=
4584 "_Ref534822069">Figure 9</a>. Reference
4585 Counting</p></td></tr></table></center>
4588 <p class="TextFontCX">All functions that return <span class=
4589 "Annot"><span style='font-size:10.0pt'>refcounted</span></span>
4590 storage must increase the reference count before returning.
4591 Splint cannot determine if the reference count was increased, so
4592 any function that directly returns a reference to
4593 <span class="Annot"><span style=
4594 'font-size:10.0pt'>refcounted</span></span> storage will
4595 produce an error. This is avoided, by using a function
4596 to return a new reference (e.g., <span class=
4597 "CodeText"><span style=
4598 'font-size:10.0pt'>rstring_ref</span></span> in Figure
4600 <p class="TextFontCX"> </p>
4601 <p class="TextFontCX">A reference counted type may be passed as a
4602 <span class="Annot"><span style=
4603 'font-size:10.0pt'>temp</span></span> or <span class=
4604 "Annot"><span style='font-size:10.0pt'>dependent</span></span>
4605 parameter. It may not be passed as an <span class=
4606 "Annot"><span style='font-size:10.0pt'>only</span></span>
4607 parameter. Instead, the <span class=
4608 "Annot"><span style='font-size:10.0pt'>killref</span></span>
4609 annotation is used to denote a parameter whose reference is
4610 eliminated by the function call. Like <span class=
4611 "Annot"><span style='font-size:10.0pt'>only</span></span>
4612 parameters, an actual parameter corresponding to a
4613 <span class="Annot"><span style=
4614 'font-size:10.0pt'>killref</span></span> formal parameter may
4615 not be used in the calling function after the call.
4616 Splint checks that the implementation of a function releases
4617 all <span class="Annot"><span style=
4618 'font-size:10.0pt'>killref</span></span> parameters, either
4619 by passing them as <span class="Annot"><span style=
4620 'font-size: 10.0pt'>killref</span></span> parameters, or
4621 assigning or returning them without increasing the reference
4623 <h1 style='margin-left:0in;text-indent:0in'><a name=
4624 "_Ref348845247"></a><a name="_Ref348796245"></a><a name=
4625 "_Toc344355413"></a><a name="_Ref344355210"></a><a name=
4626 "_Ref343064238"></a><a name="_Ref343064188"></a><a name=
4627 "_Toc534974969"></a><a name="_Ref534642796"></a><a name=
4628 "_Ref534642146">6<span style=
4629 'font:7.0pt "Times New Roman"'> </span>
4630 <a id="sharing" name="sharing">
4631 Sharing</a></a></h1>
4632 <p class="TextFontCX">Errors involving unexpected sharing of
4633 storage can cause serious problems. Undocumented sharing may
4634 lead to unpredictable modifications, and some library calls (e.g.,
4635 <span class="CodeText"><span style=
4636 'font-size:10.0pt'>strcpy</span></span>) have undefined behavior if
4637 parameters share storage. Another class of sharing errors
4638 occurs when clients of an abstract type may obtain a reference to
4639 mutable storage that is part of the abstract representation.
4640 This exposes the representation of the abstract type, since clients
4641 may modify an instance of the abstract type indirectly through this
4643 <h2 style='margin-left:0in;text-indent:0in'><a name=
4644 "_Ref534977801"></a><a name="_Toc534974970">6.1<span style=
4645 'font:7.0pt "Times New Roman"'> </span>
4647 <p class="TextFontCX">Splint detects errors involving dangerous
4648 aliasing of parameters. Some of these errors are already
4649 detected through the standard memory annotations (e.g.,
4650 <span class="Annot"><span style=
4651 'font-size:10.0pt'>only</span></span> parameters may not
4652 be aliases.) Two additional annotations are
4653 provided for constraining aliasing of parameters and return
4655 <h3 style='margin-left:0in;text-indent:0in'><a name=
4656 "_Toc534974971"></a><a name="_Ref347469444">6.1.1<span style=
4657 'font:7.0pt "Times New Roman"'> </span>
4658 Unique Parameters</a></h3>
4659 <p class="TextFontCX">The <span class="Annot"><span style=
4660 'font-size:10.0pt'>unique</span></span> annotation denotes a
4661 parameter that may not be aliased by any other storage reachable
4662 from the function implementation — that is, any storage
4663 reachable through the other parameters or global variables used by
4664 the function. The <span class="Annot"><span style=
4665 'font-size:10.0pt'>unique</span></span> annotation places similar
4666 constraints on function parameters as the <span class=
4667 "Annot"><span style='font-size:10.0pt'>only</span></span>
4668 annotation, but it does not transfer the obligation to release
4669 storage. Splint will report an error if a <span class=
4670 "Annot"><span style='font-size:10.0pt'>unique</span></span>
4671 parameter may be aliased by another parameter or global
4673 <p class="TextFontCX"> </p>
4674 <p class="TextFontCX">Splint reports an error if a function returns
4675 a reference to storage reachable from one of its parameters (if
4676 <span class="Flag"><span style=
4677 'font-size:10.0pt'>retalias</span></span> is on) since this may
4678 introduce unexpected aliases in the body of the calling function
4679 when the result is assigned.</p>
4680 <p class="TextFontCX"> </p>
4681 <p class="TextFontCX">Figure 10 illustrated sharing checks.
4682 An error is reported since the first parameter to the library
4683 function <span class="CodeText"><span style=
4684 'font-size:10.0pt'>strcpy</span></span> is declared with
4685 unique. If a <span class="CodeText"><span style=
4686 'font-size:10.0pt'>unique</span></span> qualifier were added to the
4687 parameter declaration for <span class="CodeText"><span style=
4688 'font-size:10.0pt'>s</span></span> or <span class=
4689 "CodeText"><span style='font-size:10.0pt'>t</span></span>, no error
4690 would be reported. </p>
4692 <table class="MsoNormalTable" border="0" cellspacing="0"
4693 cellpadding="0" style=
4694 'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
4696 <td valign="top" style=
4697 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
4698 <p class="TextFontCX" align="center" style='text-align:center'>
4699 <span class="Keyword"><b><span style=
4700 'font-size:10.0pt; color:white'>unique.c</span></b></span></p></td>
4701 <td valign="top" style=
4702 'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
4703 <p class="TextFontCX" align="center" style='text-align:center'>
4704 <b><span style='color:white'>Running
4705 Splint</span></b></p></td></tr>
4707 <td valign="top" style=
4708 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
4709 <p class="Verbatim"># include <string.h></p>
4710 <p class="Verbatim"> </p>
4711 <p class="Verbatim">void </p>
4712 <p class="Verbatim">capitalize (/*@out@*/ char *s,</p>
4713 <p class="Verbatim">
4714 char *t)</p>
4715 <p class="Verbatim">{</p>
4716 <p class="Verbatim"><span class="Line"><span style=
4717 'font-size:8.0pt'> 7</span></span> strcpy (s, t);</p>
4718 <p class="Verbatim"> *s = toupper (*s);</p>
4719 <p class="Verbatim">}</p></td>
4720 <td valign="top" style=
4721 'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
4722 <p class="lclintrun">> splint unique.c</p>
4723 <p class="lclintrun"> </p>
4724 <p class="lclintrun">unique.c: (in function capitalize)</p>
4725 <p class="lclintrun">unique.c:7: Parameter 1 (s) to function strcpy
4727 <p class="lclintrun"> declared unique but may be
4728 aliased externally by</p>
4729 <p class="lclintrun"> parameter 2 (t)</p>
4730 <p class="lclintrun"> </p></td></tr></table>
4731 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
4733 <td valign="top" align="left" style=
4734 'padding-top:6.5pt;padding-right: 9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>
4735 <p class="MsoCaption"><a name="_Toc534824614"></a><a name=
4736 "_Ref534822167">Figure 10</a>. Unique
4737 parameters</p></td></tr></table></center>
4738 <h3 style='margin-left:0in;text-indent:0in'><a name=
4739 "_Toc534974972"></a><a name="_Ref347469448">6.1.2<span style=
4740 'font:7.0pt "Times New Roman"'> </span>
4741 Returned Parameters</a></h3>
4742 <p class="TextFontCX">The <span class="Annot"><span style=
4743 'font-size:10.0pt'>returned</span></span> annotation denotes a
4744 parameter that may be aliased by the return value. Splint
4745 checks the call assuming the result may be an alias to the
4746 <span class="Annot"><span style=
4747 'font-size:10.0pt'>returned</span></span> parameter.</p>
4748 <p class="TextFontCX"> </p>
4749 <p class="TextFontCX">Consider the following code excerpt:</p>
4750 <p class="TextFontCX"> </p>
4751 <p class="Verbatim">extern intSet intSet_insert (/*@returned@*/
4752 intSet s, int x);</p>
4753 <p class="Verbatim"> </p>
4754 <p class="Verbatim">intSet intSet_singleton (int x)</p>
4755 <p class="Verbatim">{</p>
4756 <p class="Verbatim"><span class="Line"><span style=
4757 'font-size:8.0pt'>7</span></span> return (intSet_insert
4758 (intSet_new (), x));</p>
4759 <p class="TextFontCX">}</p>
4760 <p class="TextFontCX"> </p>
4761 <p class="TextFontCX">Without the <span class=
4762 "Annot"><span style='font-size:10.0pt'>returned</span></span>
4763 qualifier on the parameter to <span class=
4764 "CodeText"><span style=
4765 'font-size:10.0pt'>intSet_insert</span></span>, a memory leak
4766 error would be reported for line 7, since the <span class=
4767 "Annot"><span style='font-size:10.0pt'>only</span></span>
4768 storage returned by <span class="CodeText"><span style=
4769 'font-size:10.0pt'>intSet_new</span></span> is not
4770 released. Because of the <span class=
4771 "Annot"><span style='font-size:10.0pt'>returned</span></span>
4772 qualifier, Splint assumes the result of <span class=
4773 "CodeText"><span style=
4774 'font-size:10.0pt'>intSet_insert</span></span> is the same
4775 storage as its first parameter, in this case the storage
4776 returned by <span class="CodeText"><span style=
4777 'font-size:10.0pt'>intSet_new</span></span>. No error
4778 is reported, since the only storage is then transferred
4779 through the return value (which has an implicit only
4780 annotation, see Section 5.3).</p>
4781 <h2 style='margin-left:0in;text-indent:0in'><a name=
4782 "_Ref344907981"></a><a name="_Ref344894258"></a><a name=
4783 "_Ref344809320"></a><a name="_Toc344355414"></a><a name=
4784 "_Toc534974973"></a><a name="_Ref345591408"></a><a name=
4785 "_Ref345591053">6.2<span style=
4786 'font:7.0pt "Times New Roman"'> </span>
4788 <p class="TextFontCX">Splint detects places where the
4789 representation of an abstract type is exposed. This occurs if
4790 a client has a pointer to storage that is part of the
4791 representation of an instance of the abstract type. The
4792 client can then modify or examine the storage this points to, and
4793 manipulate the value of the abstract type instance without using
4795 <p class="TextFontCX"> </p>
4796 <p class="TextFontCX">There are three ways a representation may be
4798 <p class="TextFontCX" style=
4799 'margin-left:.25in; text-indent:-.25in'>1.<span style=
4800 'font:7.0pt "Times New Roman"'> </span>
4801 Returning (or assigning to a global variable) an object that
4802 includes a pointer to a mutable component of an abstract
4803 type representation. (Controlled by <span class=
4805 'font-size:10.0pt'>ret-expose</span></span>).</p>
4806 <p class="TextFontCX" style=
4807 'margin-left:.25in; text-indent:-.25in'>2.<span style=
4808 'font:7.0pt "Times New Roman"'> </span>
4809 Assigning a mutable component of an abstract object to storage
4810 reachable from an actual parameter or a global variable that may be
4811 used after the call. This means the client may
4812 manipulate the abstract object using the actual parameter after the
4813 call. Note that if the corresponding formal parameter is
4814 declared <span class="Annot"><span style=
4815 'font-size:10.0pt'>only</span></span>, the caller may not use the
4816 actual parameter after the call so the representation is not
4817 exposed. (Controlled by <span class="Flag"><span style=
4818 'font-size:10.0pt'>assign-expose</span></span>).</p>
4819 <p class="TextFontCX" style=
4820 'margin-left:.25in; text-indent:-.25in'>3.<span style=
4821 'font:7.0pt "Times New Roman"'> </span>
4822 Casting mutable storage to or from an abstract type.
4823 (Controlled by <span class="Flag"><span style=
4824 'font-size:10.0pt'>cast-expose</span></span>).</p>
4825 <p class="afterlist">Annotations may be used to allow exposed
4826 storage to be returned safely by restricting how the caller may use
4827 the returned storage.</p>
4828 <h3 style='margin-left:0in;text-indent:0in'><a name=
4829 "_Toc534974974"></a><a name="_Ref347469553">6.2.1<span style=
4830 'font:7.0pt "Times New Roman"'> </span>
4831 Read-Only Storage</a></h3>
4832 <p class="beforelist">It is often useful for a function to return a
4833 pointer to internal storage (or an instance of a mutable abstract
4834 type) that is intended only as an <i>observer</i>. The caller
4835 may use the result, but should not modify the storage it points
4836 to. For example, consider a naïve implementation of the
4837 <span class="CodeText"><span style=
4838 'font-size:10.0pt'>employee_getName</span></span> operation for the
4839 abstract <span class="CodeText"><span style=
4840 'font-size:10.0pt'>employee</span></span> type:</p>
4841 <p class="Verbatim"> typedef /*@abstract@*/ struct
4843 <p class="Verbatim"> char *name;</p>
4844 <p class="Verbatim"> int id;</p>
4845 <p class="Verbatim"> } *employee;</p>
4846 <p class="Verbatim"> …</p>
4847 <p class="Verbatim"> char *employee_getName (employee
4848 e) { return e->name; }</p>
4849 <p class="afterlist">Splint produces a message to indicate that the
4850 return value exposes the representation. One solution would
4851 be to return a fresh copy of <span class=
4852 "CodeText"><span style='font-size:10.0pt'>e->name</span></span>.
4853 This is expensive, though, especially if we expect
4854 <span class="CodeText"><span style=
4855 'font-size:10.0pt'>employee_getName</span></span> is used
4856 mainly just to get a string for searching or printing.
4857 Instead, we could change the declaration of <span class=
4858 "CodeText"><span style=
4859 'font-size:10.0pt'>employee_getName</span></span> to:</p>
4860 <p class="example">extern /*@observer@*/ char *employee_getName
4862 <p class="TextFontCX">Now, the original implementation is
4863 correct. The declaration indicates that the caller may not
4864 modify the result, so it is acceptable to return shared
4865 storage. (The program must also not use the returned observer
4866 storage after any other calls to the abstract type module using the
4867 same parameter. Splint does not attempt to check this, and in
4868 practice it is rarely a problem.) Splint checks that the
4869 caller does not modify the return value. An error is reported
4870 if observer storage is modified directly, passed as a function
4871 parameter that may be modified, assigned to a global variable or
4872 reference derivable from a global variable that is not declared
4873 with an <span class="Annot"><span style=
4874 'font-size: 10.0pt'>observer</span></span> annotation , or returned
4875 as a function result or a reference derivable from the function
4876 result that is not annotation with an <span class=
4877 "Annot"><span style='font-size:10.0pt'>observer</span></span>
4879 <h4 style='margin-left:0in;text-indent:0in'><a name=
4880 "_Ref347469563"></a><a name="_Ref348017065">String
4882 <p class="TextFontCX">A program that attempts to modify a
4883 string literal has undefined behavior [ISO, 6.4.5]. This is
4884 not enforced by most C compilers, and can lead to particularly
4885 pernicious bugs that only appear when optimizations are turned on
4886 and the compiler attempts to minimize storage for string
4887 literals. Splint can be used to check that string literals
4888 are not modified, by treating them as -<span class=
4889 "Annot"><span style=
4890 'font-size:10.0pt'>observer</span></span> storage. If
4891 <span class="Flag"><span style=
4892 'font-size:10.0pt'>+read-only-strings</span></span> is set (default
4893 in standard mode), Splint will report an error if a string literal
4895 <h3 style='margin-left:0in;text-indent:0in'><a name=
4896 "_Toc534974975">6.2.2<span style=
4897 'font:7.0pt "Times New Roman"'> </span>
4898 Exposed Storage</a></h3>
4899 <p class="TextFontCX">Sometimes it is necessary to expose the
4900 representation of an abstract type. This may be evidence of a
4901 design flaw, but in some cases is justified for efficiency
4902 reasons. The <span class="Annot"><span style=
4903 'font-size:10.0pt'>exposed</span></span> annotation denotes
4904 storage that is exposed. It may be used on a return value for
4905 results that reference storage internal to an abstract
4906 representation, on a parameter value to indicate a parameter that
4907 may be assigned directly to part of an abstract representation
4908 (note that if the parameter is annotated with <span class=
4909 "Annot"><span style='font-size:10.0pt'>only</span></span>, it is
4910 not an error to assign it to part of an abstract representation,
4911 since the caller may not use the storage after the call returns),
4912 or on a field of an abstract representation to indicate that
4913 external references to the storage may exist. <a name=
4914 "_Toc344355415"></a><a name="_Ref343064165"></a><a name=
4915 "_Ref347254440"></a><a name="_Ref347169365">An error is reported
4916 if</a> <span class="Annot"><span style=
4917 'font-size:10.0pt'>exposed</span></span> storage is released, but
4918 unlike an <span class="Annot"><span style=
4919 'font-size:10.0pt'>observer</span></span>, no error is reported if
4920 it is modified. Figure 11 shows examples of exposure problems
4921 detected by Splint.</p>
4922 <p class="TextFontCX"> </p>
4924 <table class="MsoNormalTable" border="0" cellspacing="0"
4925 cellpadding="0" style=
4926 'margin-left:6.75pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
4928 <td width="45%" valign="top" style=
4929 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
4930 <p class="TextFontCX" align="center" style='text-align:center'>
4931 <span class="Keyword"><b><span style=
4932 'font-size:10.0pt; color:white'>exposure.c</span></b></span></p></td>
4933 <td valign="top" style=
4934 'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
4935 <p class="TextFontCX" align="center" style='text-align:center'>
4936 <b><span style='color:white'>Running
4937 Splint</span></b></p></td></tr>
4939 <td valign="top" style=
4940 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
4941 <p class="Verbatim"># include "employee.h"</p>
4942 <p class="Verbatim"> </p>
4943 <p class="Verbatim">char *</p>
4944 <p class="Verbatim">employee_getName (employee e)</p>
4945 <p class="Verbatim">{</p>
4946 <p class="Verbatim"><span class="Line"><span style=
4947 'font-size:8.0pt'>6</span></span> return e->name;</p>
4948 <p class="Verbatim">}</p>
4949 <p class="Verbatim"> </p>
4950 <p class="Verbatim">/*@observer@*/ char *</p>
4951 <p class="Verbatim">employee_obsName (employee e)</p>
4952 <p class="Verbatim">{ return e->name; }</p>
4953 <p class="Verbatim"> </p>
4954 <p class="Verbatim">/*@exposed@*/ char *</p>
4955 <p class="Verbatim">employee_exposeName (employee e)</p>
4956 <p class="Verbatim">{ return e->name; }</p>
4957 <p class="Verbatim"> </p>
4958 <p class="Verbatim">void</p>
4959 <p class="Verbatim">employee_capName (employee e)</p>
4960 <p class="Verbatim">{</p>
4961 <p class="Verbatim"> char *name;</p>
4962 <p class="Verbatim"> </p>
4963 <p class="Verbatim"> name = employee_obsName (e);</p>
4964 <p class="Verbatim"><span class="Line"><span style=
4965 'font-size:8.0pt'>23</span></span> *name = toupper (*name);</p>
4966 <p class="Verbatim">}</p></td>
4967 <td valign="top" style=
4968 'border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
4969 <p class="lclintrun">> splint exposure.c +checks</p>
4970 <p class="lclintrun"> </p>
4971 <p class="lclintrun">exposure.c:6: Function returns reference
4973 <p class="lclintrun">
4974
4975 parameter e: e->name</p>
4976 <p class="lclintrun">exposure.c:6: Return value exposes rep of</p>
4977 <p class="lclintrun">
4978
4979 employee: e->name</p>
4980 <p class="lclintrun">exposure.c:6: Released storage e->name
4982 <p class="lclintrun">
4983
4984 from parameter at return point</p>
4985 <p class="lclintrun"> exposure.c:6: Storage e->name
4987 <p class="lclintrun">exposure.c:23: Suspect modification of
4989 <p class="lclintrun">
4990
4991 name: *name = toupper(*name)</p>
4992 <p class="TextFontCX" style='page-break-after: avoid'> </p>
4993 <p class="TextFontCX" align="left" style=
4994 'text-align:left;page-break-after:avoid'><i><span style=
4995 'font-size: 10.0pt'>Three messages are reported for line 6 where a
4996 mutable field of an abstract type is returned with no sharing
4997 qualifier (without</span></i> <span class="Flag"><span style=
4998 'font-size:10.0pt'>+checks</span></span><i><span style=
4999 'font-size:10.0pt'>only the third one would be reported.) The
5000 error for line 23 reports a modification of an observer. If
5001 the call in line 22 were changed to call</span></i>
5002 <span class="CodeText"><span style=
5003 'font-size: 10.0pt'>employee_exposeName</span></span><i><span style='font-size:10.0pt'>
5004 , no error would be reported.</span></i></p></td></tr></table>
5005 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
5007 <td valign="top" style=
5008 'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
5009 <p class="MsoCaption"><a name="_Toc534824615">Figure 11.
5010 Exposure</a></p></td></tr></table></center>
5011 <p class="TextFontCX"> </p>
5012 <h1 style='margin-left:0in;text-indent:0in'><a name=
5013 "_Ref361649198"></a><a name="_Ref361649165"></a><a name=
5014 "_Ref354415790"></a><a name="_Ref350062908"></a><a name=
5015 "_Ref348845273"></a><a name="_Ref345591297"></a><a name=
5016 "_Ref344916609"></a><a name="_Ref344894369"></a><a name=
5017 "_Ref344891459"></a><a name="_Ref344798185"></a><a name=
5018 "_Toc344355418"></a><a name="_Toc534974976"></a><a name=
5019 "_Ref534014913"></a><a name="_Ref534014715"></a><a name=
5020 "_Ref348871484">7<span style=
5021 'font:7.0pt "Times New Roman"'> </span>
5022 <a id="function" name="function">
5023 Function Interfaces</a></a></h1>
5024 <p class="TextFontCX">Functions communicate with their calling
5025 environment through an interface. The caller communicates the
5026 values of actual parameters and global variables to the function,
5027 and the function communicates to the caller through the return
5028 value, global variables and storage reachable from the actual
5029 parameters. By keeping interfaces narrow (restricting the
5030 amount of information visible across a function interface), we can
5031 understand and implement functions independently. </p>
5032 <p class="TextFontCX"> </p>
5033 <p class="TextFontCX">A function prototype documents the interface
5034 to a function. It serves as a contract between the function
5035 and its caller. In early versions of C, the function
5036 “prototype” was very limited. It described the
5037 type returned by the function but nothing about its
5038 parameters. ANSI C (1989) provided function prototypes with
5039 the ability to add information on the number and types of parameter
5040 to a function. Splint provides the means to express much more
5041 about a function interface such as what global variable the
5042 function may use and what values visible to the caller it may
5044 <p class="TextFontCX"> </p>
5045 <p class="TextFontCX">The extra interface information places
5046 constraints on both how the function may be called and how it may
5047 be implemented. Splint reports places where these constraints
5048 are not satisfied. Typically, these indicate bugs in the code
5049 or errors in the interface documentation.</p>
5050 <p class="TextFontCX"> </p>
5051 <p class="TextFontCX">This section describes annotations that may
5052 be added to a function declaration to document what global
5053 variables the function implementation may use and what values
5054 visible to its caller it may modify.</p>
5055 <h2 style='margin-left:0in;text-indent:0in'><a name=
5056 "_Toc534974977"></a><a name="_Ref348845225"></a><a name=
5057 "_Ref344908335"></a><a name="_Ref344892358"></a><a name=
5058 "_Toc344355403">7.1<span style=
5059 'font:7.0pt "Times New Roman"'> </span>
5060 Modifications</a></h2>
5061 <p class="TextFontCX">The modifies clause lists what values visible
5062 to the caller may be modified by a function. Modifies clauses
5063 limit what values a function may modify, but they do not require
5064 that listed values are always modified. The declaration,</p>
5065 <p class="example">int f (int *p, int *q) /*@modifies *p@*/;</p>
5066 <p class="TextFontCX">declares a function <span class=
5067 "CodeText"><span style='font-size:10.0pt'>f</span></span> that may
5068 modify the value pointed to by its first argument but may not
5069 modify the value of its second argument or any global state.</p>
5070 <p class="TextFontCX"> </p>
5071 <p class="TextFontCX">Splint checks that a function does not modify
5072 any caller-visible value not encompassed by its modifies clause and
5073 does modify all values listed in its modifies clause on some
5074 possible execution of the function. Figure 12 shows an
5075 example of modifies checking done by Splint.</p>
5076 <p class="TextFontCX"> </p>
5078 <table class="MsoNormalTable" border="0" cellspacing="0"
5079 cellpadding="0" style='margin-left:5.4pt;border-collapse:collapse'
5082 <td width="40%" valign="top" style=
5083 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>
5084 <p class="TextFontCX" align="center" style='text-align:center'>
5085 <a name="_Ref344908343"><span class="Keyword"><b><span style=
5086 'font-size:10.0pt;color:white'>modify.c</span></b></span></a></p></td>
5087 <td width="60%" valign="top" style=
5088 'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>
5089 <p class="TextFontCX" align="center" style='text-align:center'>
5090 <b><span style='color:white'>Running
5091 Splint</span></b></p></td></tr>
5092 <tr style='height:120.9pt'>
5093 <td valign="top" style=
5094 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>
5095 <p class="Verbatim">void setx (int *x, int *y)</p>
5096 <p class="Verbatim"> /*@modifies *x@*/</p>
5097 <p class="Verbatim">{</p>
5098 <p class="Verbatim"><span class="Line"><span style=
5099 'font-size:8.0pt'>4</span></span> *y = *x;</p>
5100 <p class="Verbatim">}</p>
5101 <p class="Verbatim"> </p>
5102 <p class="Verbatim">void sety (int *x, int *y)</p>
5103 <p class="Verbatim"> /*@modifies *y@*/</p>
5104 <p class="Verbatim">{</p>
5105 <p class="Verbatim"> setx (y, x);</p>
5106 <p class="Verbatim">}</p></td>
5107 <td width="60%" valign="top" style=
5108 'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>
5109 <p class="lclintrun">> splint modify.c +checks</p>
5110 <p class="lclintrun">modify.c:4: Undocumented modification of *y:
5112 <p class="lclintrun">modify.c:5: Suspect object listed in modifies
5114 <p class="lclintrun">
5115
5116 not modified: *x</p>
5117 <p class="lclintrun"> modify.c:1: Declaration of
5119 <p class="TextFontCX"><i><span style=
5120 'font-size: 10.0pt'> </span></i></p>
5121 <p class="TextFontCX" style='page-break-after: avoid'>
5122 <i><span style='font-size:10.0pt'>There are
5123 n</span></i><i><span style='font-size:10.0pt'>o errors
5124 for</span></i> <span class="CodeText"><span style=
5125 'font-size:10.0pt'>sety</span></span><i><span style=
5126 'font-size:10.0pt'>– the call to</span></i>
5127 <span class="CodeText"><span style=
5128 'font-size:10.0pt'>setx</span></span><i><span style=
5129 'font-size:10.0pt'>modifies the value<br>
5130 pointed to by its first parameter (</span></i><span class=
5131 "CodeText"><span style=
5132 'font-size:10.0pt'>y</span></span><i><span style=
5133 'font-size:10.0pt'>) as documented by the<br>
5134 modifies clause. The</span></i> <span class=
5136 'font-size:10.0pt'>checks</span></span><i><span style=
5137 'font-size:10.0pt'>mode turns on</span></i> <span class=
5139 'font-size:10.0pt'>mustmod</span></span><i><span style=
5140 'font-size:10.0pt'>checking,<br>
5141 so the second error concerning missing documented<br>
5142 modifications is reported.</span></i></p></td></tr>
5144 <td style='border:none'></td>
5145 <td style='border:none'></td></tr></table>
5146 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
5148 <td valign="top" style=
5149 'padding-top:4.3pt;padding-right: .3in;padding-bottom:4.3pt;padding-left:.3in'>
5150 <p class="MsoCaption"><a name="_Toc534824616"></a><a name=
5151 "_Ref534822865">Figure 12</a>.
5152 Modification</p></td></tr></table></center>
5155 <h3 style='margin-left:0in;text-indent:0in'><a name=
5156 "_Toc534974978">7.1.1<span style=
5157 'font:7.0pt "Times New Roman"'> </span>
5158 State Modifications</a></h3>
5159 <p class="beforelist">A few special names are provided for
5160 describing function modifications that effect state not
5161 identifiable through parameters or global variables:</p>
5162 <p class="TextFontCX"><span class="Annot"><span style=
5163 'font-size:10.0pt'>internalState</span></span></p>
5164 <p class="IndentText">The function modifies some internal state
5165 (that is, the value of a <span class="CodeText"><span style=
5166 'font-size:10.0pt'>static</span></span> variable). Even
5167 though a client cannot access the internal state directly, it is
5168 important to know that something may be modified by the function
5169 call both for clear documentation and for checking undefined order
5170 of evaluation (Section 8.2) and side effect free parameters
5171 (Section 11.2.1).</p>
5172 <p class="TextFontCX"><span class="Annot"><span style=
5173 'font-size:10.0pt'>fileSystem</span></span></p>
5174 <p class="IndentText">The function modifies the file system.
5175 Any modification that may change the system state is considered a
5176 file system modification. All functions that modify an object
5177 of type pointer to <span class="CodeText"><span style=
5178 'font-size:10.0pt'>FILE</span></span> also modify the file
5179 system. In addition, functions that do not modify a
5180 <span class="CodeText"><span style=
5181 'font-size:10.0pt'>FILE</span></span> pointer but modify some state
5182 that is visible outside this process also modify the file system
5183 (e.g., <span class="CodeText"><span style=
5184 'font-size:10.0pt'>rename</span></span>). The flag
5185 <span class="Flag"><span style=
5186 'font-size:10.0pt'>mod-file-system</span></span> controls reporting
5187 of undocumented file system modifications.</p>
5188 <p class="MsoListBullet"><span class="Annot"><span style=
5189 'font-size:10.0pt'>nothing</span></span></p>
5190 <p class="IndentText">The function modifies nothing (i.e., it is
5191 side effect free).</p>
5192 <p class="TextFontCX" style='margin-left:.5in'> </p>
5193 <p class="TextFontCX">The annotation, <span class=
5194 "Annot"><span style='font-size:10.0pt'>/*@*/</span></span> in a
5195 function declaration or definition (after the parameter list,
5196 before the semi-colon or function body) denotes a function that
5197 modifies nothing and does not use any global variables (see Section
5199 <h3 style='margin-left:0in;text-indent:0in'><a name=
5200 "_Toc534974979"></a><a name="_Ref345591515">7.1.2<span style=
5201 'font:7.0pt "Times New Roman"'> </span>
5202 Missing Modifies Clauses</a></h3>
5203 <p class="TextFontCX">Splint is designed so programs with many
5204 functions that are declared without modifies clauses can be checked
5205 effectively. Unless <span class="Flag"><span style=
5206 'font-size:10.0pt'>modnomods</span></span> is in on, no
5207 modification errors are reported checking a function declared with
5208 no modifies clause. </p>
5209 <p class="TextFontCX"> </p>
5210 <p class="TextFontCX">A function with no modifies clause is an
5211 <i>unconstrained</i> function since there are no documented
5212 constraints on what it may modify. When an unconstrained
5213 function is called, it is checked differently from a function
5214 declared with a modifies clause. To prevent spurious errors,
5215 no modification error is reported at the call site unless the
5216 <span class="Flag"><span style=
5217 'font-size:10.0pt'>mod-uncon</span></span> flag is on.
5218 Flags control whether errors involving unconstrained functions are
5219 reported for other checks that depend on modifications (side effect
5220 free macro parameters (Section 11.2.1), undefined evaluation
5221 order (Section 8.2), and likely infinite loops (Section
5223 <h2 style='margin-left:0in;text-indent:0in'><a name=
5224 "_Ref534980042"></a><a name="_Toc534974980"></a><a name=
5225 "_Ref534972121"></a><a name="_Ref348845219"></a><a name=
5226 "_Ref347475720"></a><a name="_Ref347171487"></a><a name=
5227 "_Ref344908307"></a><a name="_Ref344893725"></a><a name=
5228 "_Toc344355404">7.2<span style=
5229 'font:7.0pt "Times New Roman"'> </span>
5230 Global Variables</a></h2>
5231 <p class="TextFontCX">Another aspect of a function’s
5232 interface, is the global variables it uses. A globals list in
5233 a function declaration lists external variables that may be used in
5234 the function body. Splint checks that global variables used
5235 in a procedure match those listed in its globals list. A global is
5236 used in a function if it appears in the body directly, or it is in
5237 the globals list of a function called in the body. Splint reports
5238 if a global that is used in a procedure is not listed in its
5239 globals list, and if a listed global is not used in the function
5240 implementation. Figure 13 shows an example function
5241 definition with a globals list and associated checking done by
5244 <table class="MsoNormalTable" border="0" cellspacing="0"
5245 cellpadding="0" style=
5246 'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
5247 <tr style='height:13.25pt'>
5248 <td valign="top" style=
5249 'width:202.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>
5250 <p class="TextFontCX" align="center" style='text-align:center'>
5251 <span class="Keyword"><b><span style=
5252 'font-size:10.0pt; color:white'>globals.c</span></b></span></p></td>
5253 <td valign="top" style=
5254 'width:220.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>
5255 <p class="TextFontCX" align="center" style='text-align:center'>
5256 <b><span style='color:white'>Running
5257 Splint</span></b></p></td></tr>
5258 <tr style='height:70.65pt'>
5259 <td valign="top" style=
5260 'width:202.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>
5261 <p class="Verbatim"><span style='font-size:9.5pt'>int glob1,
5263 <p class="Verbatim"><span style='font-size:9.5pt'> </span></p>
5264 <p class="Verbatim"><span class="Line"><span style=
5265 'font-size:8.0pt'>3</span></span> <span style='font-size:9.5pt'>int
5266 f (void) /*@globals glob1;@*/</span></p>
5267 <p class="Verbatim"><span style='font-size:9.5pt'>{</span></p>
5268 <p class="Verbatim"><span class="Line"><span style=
5269 'font-size:8.0pt'>5 </span></span> <span style=
5270 'font-size:9.5pt'>return glob2;</span></p>
5271 <p class="Verbatim"><span style='font-size:9.5pt'>}</span></p></td>
5272 <td valign="top" style=
5273 'width:220.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>
5274 <p class="lclintrun">> splint globals.c +checks</p>
5275 <p class="lclintrun"> </p>
5276 <p class="lclintrun">globals.c:5: Undocumented use of global
5278 <p class="lclintrun">globals.c:3: Global glob1 listed but not
5280 <p class="lclintrun"> </p>
5281 <p class="lclintrun" style='page-break-after:avoid'>
5282 </p></td></tr></table>
5283 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
5285 <td valign="top" align="left" style=
5286 'padding-top:8.65pt;padding-right: 9.35pt;padding-bottom:8.65pt;padding-left:9.35pt'>
5287 <p class="MsoCaption"><a name="_Ref349498221"></a><a name=
5288 "_Ref349498215"></a><a name="_Ref347468808"></a><a name=
5289 "_Ref347468791"></a><a name="_Ref344908072"></a><a name=
5290 "_Ref344908069"></a><a name="_Ref344893745"></a><a name=
5291 "_Toc344355405"></a><a name="_Toc534824617"></a><a name=
5292 "_Ref534822988">Figure 13</a>. Global
5293 Variables</p></td></tr></table></center>
5294 <h3 style='margin-left:0in;text-indent:0in'><a name=
5295 "_Toc534974981">7.2.1<span style=
5296 'font:7.0pt "Times New Roman"'> </span>
5297 Controlling Globals Checking</a></h3>
5298 <p class="TextFontCX">Whether on not an error is reported for a use
5299 of a global variable in a given function depends on the scope of
5300 the variable (file <span class="CodeText"><span style=
5301 'font-size:10.0pt'>static</span></span> or external), the checking
5302 annotation used in the variable declaration or the implicit
5303 annotation if no checking annotation is used, whether or not the
5304 function is declared with a globals list, and flag settings.</p>
5305 <p class="TextFontCX"> </p>
5306 <p class="beforelist">A global or file static variable declaration
5307 may be preceded by an annotation to indicate how the variable
5308 should be checked. In order of decreasing checks, the
5309 annotations are:</p>
5310 <p class="TextFontCX"><span class="Annot"><span style=
5311 'font-size:10.0pt'>/*@checkedstrict@*/</span></span></p>
5312 <p class="IndentText">Strictest checking. Undocumented uses
5313 and modifications of the variable are reported in all functions
5314 whether or not they have a globals list (unless <span class=
5316 'font-size:10.0pt'>check-strict-globs</span></span> is off).</p>
5317 <p class="TextFontCX"><span class="Annot"><span style=
5318 'font-size:10.0pt'>/*@checked@*/</span></span></p>
5319 <p class="IndentText">Undocumented use of the variable is reported
5320 in a function with a globals list, but not in a function declared
5321 with no globals (unless <span class="Flag"><span style=
5322 'font-size:10.0pt'>glob-noglobs</span></span> is on).<a name=
5324 <p class="TextFontCX"><span class="Annot"><span style=
5325 'font-size:10.0pt'>/*@checkmod@*/</span></span></p>
5326 <p class="IndentText">Undocumented uses of the variable are not
5327 reported, but undocumented modifications are reported.
5328 (If <span class="Flag"><span style=
5329 'font-size:10.0pt'>mod-globs-nomods</span></span> is on, errors are
5330 reported even in functions declared with no modifies clause or
5332 <p class="TextFontCX"><span class="Annot"><span style=
5333 'font-size:10.0pt'>/*@unchecked@*/</span></span></p>
5334 <p class="IndentText">No messages are reported for undocumented use
5335 or modification of this global variable.</p>
5336 <p class="afterlist">If a variable has none of these annotations,
5337 an implicit annotation is determined by the flag
5339 <p class="TextFontCX"> </p>
5340 <p class="TextFontCX">Different flags control the implicit
5341 annotation for variables declared with global scope and variables
5342 declared with file scope (i.e., using the <span class=
5343 "CodeText"><span style='font-size:10.0pt'>static</span></span>
5344 storage qualifier). To set the implicit annotation for global
5345 variables declared in <span class="Flag"><i><span style=
5346 'font-size:10.0pt'>context</span></i></span> (<span class=
5347 "Flag"><span style='font-size:10.0pt'>globs</span></span> for
5348 external variables or <span class="Flag"><span style=
5349 'font-size:10.0pt'>statics</span></span> for file static variable)
5350 to be <span class="Flag"><i><span style=
5351 'font-size:10.0pt'>annotation</span></i></span> (<span class=
5352 "Flag"><span style='font-size:10.0pt'>checked</span></span>,
5353 <span class="Flag"><span style=
5354 'font-size:10.0pt'>checkmod</span></span>, <span class=
5355 "Flag"><span style='font-size:10.0pt'>checkedstrict</span></span>)
5356 use <span class="Flag"><span style=
5357 'font-size:10.0pt'>imp<i><annotation>
5358 <context></i></span></span>. For example,
5359 <span class="Flag"><span style=
5360 'font-size:10.0pt'>+imp-checked-strict-statics</span></span>
5361 makes the implicit checking on unqualified file static
5362 variables <span class="Flag"><span style=
5363 'font-size:10.0pt'>checkedstrict</span></span>. See
5364 Appendix B for a complete list of globals checking flags.</p>
5365 <h3 style='margin-left:0in;text-indent:0in'><a name=
5366 "_Toc534974982"></a><a name="_Ref534971010">7.2.2<span style=
5367 'font:7.0pt "Times New Roman"'> </span></a>
5368 Definition State</h3>
5369 <p class="TextFontCX">Annotations can be used in the globals list
5370 of a function declaration to describe the states of global
5371 variables before and after the call. If a global is preceded
5372 by <span class="Annot"><span style=
5373 'font-size:10.0pt'>undef</span></span>, it is assumed to be
5374 undefined before the call. Thus, no error is reported if the global
5375 is not defined when the function is called, but an error is
5376 reported if the global is used in the function body before it is
5377 defined. The <span class="Annot"><span style=
5378 'font-size:10.0pt'>killed</span></span> annotation denotes a
5379 global variable that may be undefined when the call
5380 returns. For globals that contain dynamically allocated
5381 storage, a <span class="Annot"><span style=
5382 'font-size:10.0pt'>killed</span></span> global variable is similar
5383 to an <span class="Annot"><span style=
5384 'font-size:10.0pt'>only</span></span> parameter (Section
5385 5.2). An error is reported if it contains the only reference
5386 to storage that is not released before the call returns.
5387 Figure 14 illustrated <span class="Annot"><span style=
5388 'font-size:10.0pt'>killed</span></span> and <span class=
5389 "Annot"><span style='font-size:10.0pt'>undef</span></span>
5392 <table class="MsoNormalTable" border="0" cellspacing="0"
5393 cellpadding="0" style=
5394 'margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
5396 <td valign="top" style=
5397 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
5398 <p class="TextFontCX" align="center" style='text-align:center'>
5399
5400 <span class="Keyword"><b><span style=
5401 'font-size:10.0pt;color:white'>annotglobs.c</span></b></span></p></td>
5402 <td valign="top" style=
5403 'width:198.8pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
5404 <p class="TextFontCX" align="center" style='text-align:center'>
5405 <b><span style='color:white'>Running
5406 Splint</span></b></p></td></tr>
5408 <td valign="top" style=
5409 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>
5410 <p class="Verbatim">int globnum;</p>
5411 <p class="Verbatim"> </p>
5412 <p class="Verbatim">struct {</p>
5413 <p class="Verbatim"> char *firstname, *lastname;</p>
5414 <p class="Verbatim"> int id;</p>
5415 <p class="Verbatim">} globname;</p>
5416 <p class="Verbatim"> </p>
5417 <p class="Verbatim">void</p>
5418 <p class="Verbatim">initialize (/*@only@*/ char *name)</p>
5419 <p class="Verbatim"> /*@globals undef globnum,</p>
5420 <p class="Verbatim">
5421
5422 undef globname @*/</p>
5423 <p class="Verbatim">{</p>
5424 <p class="Verbatim"><span class="Line"><span style=
5425 'font-size:8.0pt'>13</span></span> globname.id = globnum;</p>
5426 <p class="Verbatim"> globname.lastname = name;</p>
5427 <p class="Verbatim"><span class="Line"><span style=
5428 'font-size:8.0pt'>15</span></span>}</p>
5429 <p class="Verbatim"> </p>
5430 <p class="Verbatim">void finalize (void)</p>
5431 <p class="Verbatim"> /*@globals killed globname@*/</p>
5432 <p class="Verbatim">{</p>
5433 <p class="Verbatim"> free (globname.lastname);</p>
5434 <p class="Verbatim"><span class="Line"><span style=
5435 'font-size:8.0pt'>21</span></span> }</p></td>
5436 <td valign="top" style=
5437 'width:198.8pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>
5438 <p class="lclintrun">> splint annotglobs.c</p>
5439 <p class="lclintrun"> </p>
5440 <p class="lclintrun">annotglobs.c:13: Undef global globnum used</p>
5441 <p class="lclintrun">
5442
5443 before definition</p>
5444 <p class="lclintrun">annotglobs.c:15: Global storage globname</p>
5445 <p class="lclintrun"> contains 1 undefined field
5447 <p class="lclintrun"> returns: firstname</p>
5448 <p class="lclintrun">annotglobs.c:21: Only storage</p>
5449 <p class="lclintrun"> globname.firstname (type
5451 <p class="lclintrun"> from killed global is not
5453 <p class="lclintrun" style='page-break-after:avoid'>
5454 (memory leak)</p></td></tr></table>
5455 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
5457 <td valign="top" align="left" style=
5458 'padding-top:10.1pt;padding-right: 9.35pt;padding-bottom:10.1pt;padding-left:9.35pt'>
5459 <p class="MsoCaption"><a name="_Toc534824618"></a><a name=
5460 "_Ref534823055">Figure 14</a>. Annotated Globals
5461 Lists</p></td></tr></table></center>
5462 <h2 style='margin-left:0in;text-indent:0in'><a name=
5463 "_Toc534974983"></a><a name="_Ref344894947"></a><a name=
5464 "_Toc344355406">7.3<span style=
5465 'font:7.0pt "Times New Roman"'> </span>
5466 Declaration Consistency</a></h2>
5467 <p class="TextFontCX">Splint checks that function declarations and
5468 definitions are consistent. The general rule is that the
5469 <i>first</i> declaration of a function implies all later
5470 declarations and definitions. If a function is declared in a
5471 header file, the first declaration processed is its first
5472 declaration (if it is declared in more than one header file an
5473 error is reported if <span class="Flag"><span style=
5474 'font-size:10.0pt'>redecl</span></span> is set)
5475 <span style='display:none'>(if the same function is declared
5476 in more than one header file ???)</span>. Otherwise,
5477 the first declaration in the file defining the function is
5478 its first declaration.</p>
5479 <p class="TextFontCX"> </p>
5480 <p class="TextFontCX">Later declarations may not include variables
5481 in the globals list that were not included in the first
5482 declaration. The exception to this is when the first
5483 declaration is in a header file and the later declaration or
5484 definition includes file static variables. Since these are
5485 not visible in the header file, they can not be included in the
5486 header file declaration. Similarly, the modifies clause of a
5487 later declaration may not include objects that are not modifiable
5488 in the first declaration. The later declaration may be more
5489 specific. For example, if the header declaration is:</p>
5490 <p class="example" style='text-indent:.3in'>extern void setName
5491 (employee e, char *s) /*@modifies e@*/;</p>
5492 <p class="TextFontCX">the later declaration could be,</p>
5493 <p class="example"> void setName (employee e, char *)
5494 /*@modifies e->name@*/;</p>
5495 <p class="TextFontCX">If <span class="CodeText"><span style=
5496 'font-size:10.0pt'>employee</span></span> is an abstract type, the
5497 declaration in the header should not refer to a particular
5498 implementation (i.e., it shouldn’t rely on there being a
5499 <span class="CodeText"><span style=
5500 'font-size:10.0pt'>name</span></span> field), but the
5501 implementation declaration can be more specific. </p>
5502 <p class="TextFontCX"> </p>
5503 <p class="TextFontCX">This rule also applies to file static
5504 variables. The header declaration for a function that
5505 modifies a file static variable should use <span class=
5506 "Annot"><span style='font-size:10.0pt'>modifies
5507 internalState</span></span> since file static variables are not
5508 visible to clients. The implementation declaration should
5509 list the actual file static variables that may be modified.</p>
5510 <h2 style='margin-left:0in;text-indent:0in'><a name=
5511 "_Toc534974984"></a><a name="_Ref354411787">7.4<span style=
5512 'font:7.0pt "Times New Roman"'> </span>
5513 State Clauses</a></h2>
5514 <p class="TextFontCX">Sometimes it is necessary to specify function
5515 interfaces at a lower level than is possible with the standard
5516 annotations. For example, if a function defines some fields
5517 of a returned structure but does not define all the fields.
5518 The <span class="Annot"><span style=
5519 'font-size:10.0pt'>/*@special@*/</span></span> annotation is used
5520 to mark a parameter, global variable, or return value that is
5521 described using state clauses. </p>
5522 <p class="TextFontCX"> </p>
5523 <p class="TextFontCX">State clauses may be used to constrain the
5524 state of a parameter or return value before or after a call.
5525 One or more state clauses may appear in a function declaration,
5526 before the modifies or globals clauses. State clauses may be
5527 listed in any order, but the same state clause should not be used
5528 more than once. In a state clause list, <span class=
5529 "CodeText"><span style='font-size:10.0pt'>result</span></span> is
5530 used to refer to the return value of the function. </p>
5531 <p class="TextFontCX"> </p>
5532 <p class="TextFontCX" style='margin-bottom:6.0pt'>The following
5533 state clauses are used to describe the definition state or
5534 parameters before and after the function is called and the return
5535 value after the function returns:</p>
5536 <p class="TextFontCX"><span class="Annot"><span style=
5537 'font-size:10.0pt'>/*@uses
5538 <i><references></i>@*/</span></span></p>
5539 <p class="indentbefore0">References in a <span class=
5540 "Annot"><span style='font-size:10.0pt'>uses</span></span> clause
5541 must be completely defined before the function is called.
5542 They are assumed to be defined at function entrance when the
5543 function is checked.</p>
5544 <p class="TextFontCX"><span class="Annot"><span style=
5545 'font-size:10.0pt'>/*@sets
5546 <i><references></i>@*/</span></span></p>
5547 <p class="indentbefore0">References in a <span class=
5548 "Annot"><span style='font-size:10.0pt'>sets</span></span> clause
5549 must be allocated before the function is called. They are
5550 completely defined after the function returns. They are assumed to
5551 be allocated but undefined storage at function entrance and an
5552 error is reported if there is a path on which they are not defined
5553 before the function returns.</p>
5554 <p class="TextFontCX"><span class="Annot"><span style=
5555 'font-size:10.0pt'>/*@defines
5556 <i><references></i>@*/</span></span></p>
5557 <p class="indentbefore0">References in a <span class=
5558 "Annot"><span style='font-size:10.0pt'>defines</span></span> clause
5559 must not refer to unshared, allocated storage before the function
5560 is called. They are completely defined after the function
5561 returns. When the function is checked, they are assumed to be
5562 undefined at function entrance and an error is reported if there is
5563 a path on which they are not defined before the function
5565 <p class="TextFontCX"><span class="Annot"><span style=
5566 'font-size:10.0pt'>/*@allocates
5567 <i><references></i>@*/</span></span></p>
5568 <p class="indentbefore0">References in an <span class=
5569 "Annot"><span style='font-size:10.0pt'>allocates</span></span>
5570 clause must be unallocated before the function is called.
5571 They are allocated but not necessarily defined after the function
5572 returns. An error is reported if there is a path through the
5573 function on which they are not allocated before the function
5575 <p class="TextFontCX"><span class="Annot"><span style=
5576 'font-size:10.0pt'>/*@releases
5577 <references>@*/</span></span></p>
5578 <p class="IndentText">References in the <span class=
5579 "Annot"><span style='font-size:10.0pt'>releases</span></span>
5580 clause are deallocated by the function. They must be storage
5581 that could be passed as an <span class="Annot"><span style=
5582 'font-size:10.0pt'>only</span></span> parameter before the
5583 function is called, and are dead pointers after the function
5584 returns. They are assumed to be defined at function entrance
5585 and an error is reported if they refer to live, allocated storage
5586 at any return point.</p>
5587 <p class="TextFontCX"> </p>
5588 <p class="TextFontCX">Some examples of state clauses are shown in
5589 Figure 15. The <span class="Annot"><span style=
5590 'font-size: 10.0pt'>defines</span></span> clause for
5591 <span class="CodeText"><span style=
5592 'font-size:10.0pt'>record_new</span></span> indicates that
5593 the <span class="CodeText"><span style=
5594 'font-size:10.0pt'>id</span></span> field of the structure
5595 pointed to by the result is defined, but the <span class=
5596 "CodeText"><span style='font-size:10.0pt'>name</span></span>
5597 field is not. So, <span class="CodeText"><span style=
5598 'font-size:10.0pt'>record_create</span></span> needs to call
5599 <span class="CodeText"><span style=
5600 'font-size:10.0pt'>record_setName</span></span> to define the
5601 name field. Similarly, the <span class=
5602 "Annot"><span style='font-size:10.0pt'>releases</span></span>
5603 clause for <span class="CodeText"><span style=
5604 'font-size:10.0pt'>record_clearName</span></span> indicates
5605 that no storage is associated with the <span class=
5606 "CodeText"><span style='font-size:10.0pt'>name</span></span>
5607 field of its parameter after the return, so no failure to
5608 deallocate storage message is produced for the call to
5609 <span class="CodeText"><span style=
5610 'font-size:10.0pt'>free</span></span> in <span class=
5611 "CodeText"><span style=
5612 'font-size:10.0pt'>record_free</span></span>. The
5613 <span class="Annot"><span style='font-size:10.0pt'>ensures
5614 isnull</span></span> clause is described in the next
5617 <table class="MsoNormalTable" border="0" cellspacing="0"
5618 cellpadding="0" style=
5619 'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
5621 <td valign="top" style=
5622 'width:423.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
5623 <p class="TextFontCX" align="center" style='text-align:center'>
5624 <span class="Keyword"><b><span style=
5625 'font-size:10.0pt; color:white'>clauses.c</span></b></span></p></td></tr>
5627 <td valign="top" style=
5628 'width:423.0pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
5629 <p class="Verbatim">typedef struct</p>
5630 <p class="Verbatim">{</p>
5631 <p class="Verbatim"> int id;</p>
5632 <p class="Verbatim"> /*@only@*/ char *name;</p>
5633 <p class="Verbatim">} *record;</p>
5634 <p class="Verbatim"> </p>
5635 <p class="Verbatim">static /*@special@*/ record record_new
5637 <p class="Verbatim"> /*@defines result->id@*/</p>
5638 <p class="Verbatim">{</p>
5639 <p class="Verbatim"> record r = (record) malloc (sizeof
5641 <p class="Verbatim"> </p>
5642 <p class="Verbatim"> assert (r != NULL);</p>
5643 <p class="Verbatim"> r->id = 3;</p>
5644 <p class="Verbatim"> return r;</p>
5645 <p class="Verbatim">}</p>
5646 <p class="Verbatim"> </p>
5647 <p class="Verbatim">static void</p>
5648 <p class="Verbatim"> record_setName (/*@special@*/
5649 record r, /*@only@*/ char *name)</p>
5650 <p class="Verbatim"> /*@defines r->name@*/</p>
5651 <p class="Verbatim">{</p>
5652 <p class="Verbatim"> r->name = name;</p>
5653 <p class="Verbatim">}</p>
5654 <p class="Verbatim"> </p>
5655 <p class="Verbatim">record record_create (/*@only@*/ char
5657 <p class="Verbatim">{</p>
5658 <p class="Verbatim"> record r = record_new ();</p>
5659 <p class="Verbatim"> record_setName (r, name);</p>
5660 <p class="Verbatim"> return r;</p>
5661 <p class="Verbatim">}</p>
5662 <p class="Verbatim"> </p>
5663 <p class="Verbatim">void record_clearName (/*@special@*/ record
5665 <p class="Verbatim"> /*@releases r->name@*/</p>
5666 <p class="Verbatim"> /*@ensures isnull
5668 <p class="Verbatim">{</p>
5669 <p class="Verbatim"> free (r->name);</p>
5670 <p class="Verbatim"> r->name = NULL;</p>
5671 <p class="Verbatim">}</p>
5672 <p class="Verbatim"> </p>
5673 <p class="Verbatim">void record_free (/*@only@*/ record r)</p>
5674 <p class="Verbatim">{</p>
5675 <p class="Verbatim"> record_clearName (r);</p>
5676 <p class="Verbatim"> free (r);</p>
5677 <p class="Verbatim">}</p>
5678 <p class="Verbatim" style='page-break-after:avoid'>
5679 </p></td></tr></table>
5680 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
5682 <td valign="top" style=
5683 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
5684 <p class="MsoCaption"><a name="_Toc534824619"></a><a name=
5685 "_Ref354412972">Figure 15</a>. State
5686 Clauses</p></td></tr></table></center>
5687 <p class="TextFontCX"><span class="Keyword"><span style=
5688 'font-size:10.0pt'> </span></span></p>
5689 <h2 style='margin-left:0in;text-indent:0in'><a name=
5690 "_Toc534974985"></a><a name="_Ref534888798">7.5<span style=
5691 'font:7.0pt "Times New Roman"'> </span>
5692 Requires and Ensures Clauses</a></h2>
5693 <p class="TextFontCX">More general assumptions about state of
5694 parameters and globals before and after a function is called can be
5695 described using <span class="Annot"><i><span style=
5696 'font-size:10.0pt'>requires</span></i></span> and
5697 <span class="Annot"><i><span style=
5698 'font-size:10.0pt'>ensures</span></i></span> clauses. A
5699 <span class="Annot"><span style=
5700 'font-size:10.0pt'>requires</span></span> clause specifies a
5701 predicate that must be true at a call site; when checking a
5702 function implementation Splint assumes the constraints given
5703 in its <span class="Annot"><span style=
5704 'font-size:10.0pt'>requires</span></span> clauses are true at
5705 function entry. An <span class="Annot"><span style=
5706 'font-size:10.0pt'>ensures</span></span> clause specifies a
5707 predicate that is true at a call site after the call returns;
5708 when checking a function implementation Splint warns if there
5709 is an execution path that does not return with a state that
5710 satifies the constraints given in its <span class=
5711 "Annot"><span style='font-size:10.0pt'>ensures</span></span>
5712 clauses. A function declaration can have many
5713 <span class="Annot"><span style=
5714 'font-size:10.0pt'>requires</span></span> and <span class=
5715 "Annot"><span style='font-size:10.0pt'>ensures</span></span>
5716 clauses as long as their meanings are not contradictory.</p>
5717 <p class="TextFontCX"> </p>
5718 <p class="TextFontCX">The following constraints can be stated using
5719 <span class="Annot"><span style=
5720 'font-size:10.0pt'>requires</span></span> and <span class=
5721 "Annot"><span style='font-size:10.0pt'>ensures</span></span>
5723 <h6 style='margin-left:0in;text-indent:0in'><b>Aliasing
5724 Annotations</b></h6>
5725 <p class="TextFontCX"><span class="Annot"><span style=
5726 'font-size:10.0pt'>/*@requires
5727 only<i><references></i>@*/</span></span>; <span class=
5728 "Annot"><span style='font-size:10.0pt'>/*@ensures
5729 only<i><references></i>@*/</span></span></p>
5730 <p class="TextFontCX"><span class="Annot"><span style=
5731 'font-size:10.0pt'>/*@requires
5732 shared<i><references></i>@*/</span></span>;
5733 <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
5734 shared<i><references></i>@*/</span></span></p>
5735 <p class="TextFontCX"><span class="Annot"><span style=
5736 'font-size:10.0pt'>/*@requires
5737 owned<i><references></i>@*/</span></span>; <span class=
5738 "Annot"><span style='font-size:10.0pt'>/*@ensures
5739 owned<i><references></i>@*/</span></span></p>
5740 <p class="TextFontCX"><span class="Annot"><span style=
5741 'font-size:10.0pt'>/*@requires
5742 dependent<i><references></i>@*/</span></span>;
5743 <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
5744 dependent<i><references></i>@*/</span></span></p>
5745 <p class="IndentText">References refer to <span class=
5746 "Annot"><span style='font-size:10.0pt'>only</span></span>,
5747 <span class="Annot"><span style=
5748 'font-size:10.0pt'>shared</span></span>, <span class=
5749 "Annot"><span style='font-size:10.0pt'>owned</span></span> or
5750 <span class="Annot"><span style=
5751 'font-size:10.0pt'>dependent</span></span> storage before
5752 (<span class="Annot"><span style=
5753 'font-size:10.0pt'>requires</span></span>) or after
5754 (<span class="Annot"><span style=
5755 'font-size:10.0pt'>ensures</span></span>) the call.</p>
5756 <h6 style='margin-left:0in;text-indent:0in'><b>Exposure
5757 Annotations</b></h6>
5758 <p class="TextFontCX"><span class="Annot"><span style=
5759 'font-size:10.0pt'>/*@requires
5760 observer<i><references></i>@*/</span></span>;
5761 <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
5762 observer<i><references></i>@*/</span></span></p>
5763 <p class="TextFontCX"><span class="Annot"><span style=
5764 'font-size:10.0pt'>/*@requires
5765 exposed<i><references></i>@*/</span></span>;
5766 <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
5767 exposed <i><references></i>@*/</span></span></p>
5768 <p class="IndentText">References refer to <span class=
5769 "Annot"><span style='font-size:10.0pt'>observer</span></span> or
5770 <span class="Annot"><span style=
5771 'font-size:10.0pt'>exposed</span></span> storage before
5772 (<span class="Annot"><span style=
5773 'font-size:10.0pt'>requires</span></span>) or after
5774 (<span class="Annot"><span style=
5775 'font-size:10.0pt'>ensures</span></span>) the call.</p>
5776 <h6 style='margin-left:0in;text-indent:0in'><b>Null</b>
5777 <b>State</b><b>Annotations</b></h6>
5778 <p class="TextFontCX"><span class="Annot"><span style=
5779 'font-size:10.0pt'>/*@requires
5780 isnull<i><references></i>@*/</span></span>;
5781 <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
5782 isnull<i><references></i>@*/</span></span></p>
5783 <p class="IndentText">References have the value <span class=
5784 "CodeText"><span style='font-size:10.0pt'>NULL</span></span> before
5785 (<span class="Annot"><span style=
5786 'font-size:10.0pt'>requires</span></span>) or after
5787 (<span class="Annot"><span style=
5788 'font-size:10.0pt'>ensures</span></span>) the call.
5789 Note, this is not the same name or meaning as the
5790 <span class="Annot"><span style=
5791 'font-size:10.0pt'>null</span></span> annotation (which means
5792 the value may or may not be <span class="Annot"><span style=
5793 'font-size:10.0pt'>NULL</span></span>.)</p>
5794 <p class="TextFontCX"><span class="Annot"><span style=
5795 'font-size:10.0pt'>/*@requires
5796 notnull<i><references></i>@*/</span></span>;
5797 <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
5798 notnull<i><references></i>@*/</span></span></p>
5799 <p class="IndentText">References do not have the value
5800 <span class="CodeText"><span style=
5801 'font-size:10.0pt'>NULL</span></span> before (<span class=
5802 "Annot"><span style=
5803 'font-size:10.0pt'>requires</span></span>) or after
5804 (<span class="Annot"><span style=
5805 'font-size:10.0pt'>ensures</span></span>) the call.</p>
5806 <p class="TextFontCX"> </p>
5807 <h1 style='margin-left:0in;text-indent:0in'><a name=
5808 "_Toc534974986"></a><a name="_Ref534642886"></a><a name=
5809 "_Ref483663682">8<span style=
5810 'font:7.0pt "Times New Roman"'> </span>
5811 <a id="control" name="control">
5812 Control Flow</a></a></h1>
5813 <p class="TextFontCX">The section describes checking done by Splint
5814 related to control flow. Many of these checks are
5815 significantly improved because of the extra information that is
5816 known about the program when annotations are provided.</p>
5817 <h2 style='margin-left:0in;text-indent:0in'><a name=
5818 "_Toc534974987"></a><a name="_Ref345859337"></a><a name=
5819 "_Ref344907653"></a><a name="_Ref344894343"></a><a name=
5820 "_Ref344873752"></a><a name="_Toc344355417">8.1<span style=
5821 'font:7.0pt "Times New Roman"'> </span>
5823 <p class="TextFontCX">To detect certain errors and avoid spurious
5824 errors, it is important to know something about the control flow
5825 behavior of called functions. Without additional information,
5826 Splint assumes that all functions eventually return and execution
5827 continues normally at the call site. </p>
5828 <p class="TextFontCX"> </p>
5829 <p class="TextFontCX">The <span class="Annot"><span style=
5830 'font-size:10.0pt'>noreturn</span></span> annotation is used
5831 to denote a function that never returns<a href="#_ftn8" name=
5832 "_ftnref8" title=""><span class=
5833 "MsoFootnoteReference"><span class="MsoFootnoteReference"><span style='font-size:11.0pt;font-family:"Times New Roman"'>
5834 [8]</span></span></span></a>. For example,</p>
5835 <p class="example"><span class="Annot"><span style=
5836 'font-size:10.0pt'>extern /*@noreturn@*/ void fatalerror
5837 (/*@observer@*/ char *s);</span></span></p>
5838 <p class="beforelist">declares <span class=
5839 "CodeText"><span style='font-size:10.0pt'>fatalerror</span></span>
5840 to never return. This enables Splint to correctly
5841 analyze code like,</p>
5842 <p class="TextFontCX"><span class="Keyword"><span style=
5843 'font-size:10.0pt'> if (x == NULL) fatalerror
5844 ("Yikes!");</span></span></p>
5845 <p class="TextFontCX"><span class="Keyword"><span style=
5846 'font-size:10.0pt'> *x = 3;</span></span></p>
5847 <p class="afterlist">Other functions may return, but sometimes (or
5848 usually) return normally. The <span class=
5849 "Annot"><span style='font-size:10.0pt'>maynotreturn</span></span>
5850 annotation denotes a function that may or may not
5851 return. This may be useful for documentation, but does
5852 not help checking much, since Splint must assume that a
5853 function declared with <span class="Annot"><span style=
5854 'font-size:10.0pt'>maynotreturn</span></span> returns
5855 normally when checking the code. The <span class=
5856 "Annot"><span style=
5857 'font-size:10.0pt'>alwaysreturns</span></span> annotation
5858 denotes a function that always returns (but Splint does no
5859 checking to verify this).</p>
5860 <p class="TextFontCX"> </p>
5861 <p class="TextFontCX">To describe non-returning functions more
5862 precisely, the <span class="Annot"><span style=
5863 'font-size:10.0pt'>noreturnwhentrue</span></span> and
5864 <span class="Annot"><span style=
5865 'font-size:10.0pt'>noreturnwhenfalse</span></span> annotations
5866 may be used. Similar to <span class=
5867 "Annot"><span style='font-size: 10.0pt'>nullwhentrue</span></span>
5868 and <span class="Annot"><span style=
5869 'font-size:10.0pt'>falsewhennull</span></span> (see Section
5870 2.1.1), <span class="Annot"><span style=
5871 'font-size:10.0pt'>noreturnwhentrue</span></span> and
5872 <span class="Annot"><span style=
5873 'font-size:10.0pt'>noreturnwhenfalse</span></span> mean that
5874 a function never returns if the value of its first argument
5875 is true (<span class="Annot"><span style=
5876 'font-size:10.0pt'>noreturnwhentrue</span></span>) or false
5877 (<span class="Annot"><span style=
5878 'font-size:10.0pt'>noreturnwhenfalse</span></span>).
5879 They may be used only on functions whose first argument is a
5880 Boolean. </p>
5881 <p class="TextFontCX"> </p>
5882 <p class="TextFontCX" style='margin-bottom:6.0pt'>Hence, a function
5883 declared with <span class="Annot"><span style=
5884 'font-size:10.0pt'>noreturnwhenwfalse</span></span> must not return
5885 if the value of its argument is false. For example, the
5886 standard library declares <span class="Keyword"><span style=
5887 'font-size:10.0pt'>assert</span></span> as<a href="#_ftn9"
5888 name="_ftnref9" title=""><span class=
5889 "MsoFootnoteReference"><span class=
5890 "MsoFootnoteReference"><span style=
5891 'font-size:11.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>:</p>
5892 <p class="example" style=
5893 'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>
5894 /*@noreturnwhenfalse@*/ void</p>
5895 <p class="example" style=
5896 'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>
5897 assert (/*@sef@*/ bool /*@alt int@*/ pred);</p>
5898 <p class="beforelist" style='margin-top:6.0pt'>This way, code
5900 <p class="Verbatim"> assert (x != NULL);</p>
5901 <p class="Verbatim"> *x = 3;</p>
5902 <p class="TextFontCX">is checked without reporting a false warning,
5903 since the <span class="Annot"><span style=
5904 'font-size:10.0pt'>noreturnwhenwfalse</span></span> annotation on
5905 <span class="CodeText"><span style=
5906 'font-size:10.0pt'>assert</span></span> means the deference of
5907 <span class="CodeText"><span style=
5908 'font-size:10.0pt'>x</span></span> is not reached is
5909 <span class="CodeText"><span style='font-size:10.0pt'>x !=
5910 NULL</span></span> is false.</p>
5911 <h2 style='margin-left:0in;text-indent:0in'><a name=
5912 "_Toc534974988"></a><a name="_Ref350066608">8.2<span style=
5913 'font:7.0pt "Times New Roman"'> </span>
5914 Undefined</a> Behavior</h2>
5915 <p class="TextFontCX">The order in which side effects take place in
5916 a C program is not entirely defined by the code. Certain
5917 execution points are known as <i>sequence points</i> — a
5918 function call (after the arguments have been evaluated), the end of
5919 a full expression (an initializer, expression in an expression
5920 statement, the control expression of an <span class=
5921 "CodeText"><span style='font-size:10.0pt'>if</span></span>,
5922 <span class="CodeText"><span style=
5923 'font-size:10.0pt'>switch</span></span>, <span class=
5924 "CodeText"><span style='font-size:10.0pt'>while</span></span> or
5925 <span class="CodeText"><span style=
5926 'font-size:10.0pt'>do</span></span> statement, each expression of a
5927 <span class="CodeText"><span style=
5928 'font-size:10.0pt'>for</span></span> statement, and the expression
5929 in a <span class="CodeText"><span style=
5930 'font-size: 10.0pt'>return</span></span> statement), and after the
5931 first operand or a <span class="CodeText"><span style=
5932 'font-size:10.0pt'>&&</span></span>, <span class=
5933 "CodeText"><span style='font-size:10.0pt'>||</span></span>,
5934 <span class="CodeText"><span style=
5935 'font-size:10.0pt'>?</span></span> or <span class=
5936 "CodeText"><span style='font-size:10.0pt'>,</span></span>
5938 <p class="TextFontCX"> </p>
5939 <p class="TextFontCX">All side effects before a sequence point must
5940 be complete before the sequence point, and no evaluations after the
5941 sequence point shall have taken place. Between sequence
5942 points, side effects and evaluations may take place in any
5943 order. Hence, the order in which expressions or arguments are
5944 evaluated is not specified. Compilers are free to evaluate
5945 function arguments and parts of expressions (that do not contain
5946 sequence points) in any order. The behavior of code is
5947 undefined if it uses a value that is modified by another expression
5948 that is not required to be evaluated before or after the other
5950 <p class="TextFontCX"> </p>
5951 <p class="TextFontCX">Splint detects instances where undetermined
5952 order of evaluation produces undefined behavior. If
5953 modifies clauses and globals lists are used, this checking is
5954 enabled in expressions involving function calls. Evaluation order
5955 checking is controlled by the <span class="Flag"><span style=
5956 'font-size:10.0pt'>eval-order</span></span> flag.</p>
5958 <table class="MsoNormalTable" border="0" cellspacing="0"
5959 cellpadding="0" style=
5960 'margin-left:13.05pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
5962 <td valign="top" style=
5963 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
5964 <p class="TextFontCX" align="center" style='text-align:center'>
5965
5966 <span class="Keyword"><b><span style=
5967 'font-size:10.0pt;color:white'>order.c</span></b></span></p></td>
5968 <td valign="top" style=
5969 'width:198.8pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
5970 <p class="TextFontCX" align="center" style='text-align:center'>
5971 <b><span style='color:white'>Running
5972 Splint</span></b></p></td></tr>
5974 <td valign="top" style=
5975 'width:148.95pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
5976 <p class="Verbatim">extern int glob;</p>
5977 <p class="Verbatim"> </p>
5978 <p class="Verbatim">extern int mystery (void);</p>
5979 <p class="Verbatim"> </p>
5980 <p class="Verbatim">extern int modglob (void)</p>
5981 <p class="Verbatim"> /*@globals glob@*/</p>
5982 <p class="Verbatim"> /*@modifies glob@*/;</p>
5983 <p class="Verbatim"> </p>
5984 <p class="Verbatim">int f (int x, int y[])</p>
5985 <p class="Verbatim">{</p>
5986 <p class="Verbatim"><span class="Line"><span style=
5987 'font-size:8.0pt'>11</span></span> int i = x++ * x;</p>
5988 <p class="Verbatim"> </p>
5989 <p class="Verbatim"><span class="Line"><span style=
5990 'font-size:8.0pt'>13</span></span> y[i] = i++;</p>
5991 <p class="Verbatim"><span class="Line"><span style=
5992 'font-size:8.0pt'>14</span></span> i += modglob() * glob;</p>
5993 <p class="Verbatim"><span class="Line"><span style=
5994 'font-size:8.0pt'>15</span></span> i += mystery() * glob;</p>
5995 <p class="Verbatim"><span class="Line"><span style=
5996 'font-size:8.0pt'>16</span></span> return i;</p>
5997 <p class="Verbatim">}</p></td>
5998 <td valign="top" style=
5999 'width:275.4pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
6000 <p class="lclintrun">> splint order.c +evalorderuncon</p>
6001 <p class="lclintrun">order.c:11: Expression has undefined behavior
6003 <p class="lclintrun"> right operand modified by
6004 left operand): x++ * x</p>
6005 <p class="lclintrun">order.c:13: Expression has undefined behavior
6007 <p class="lclintrun"> uses i, modified by right
6008 operand): y[i] = i++</p>
6009 <p class="lclintrun">order.c:14: Expression has undefined behavior
6011 <p class="lclintrun"> right operand modified by
6013 <p class="lclintrun"> modglob() * glob</p>
6014 <p class="lclintrun">order.c:15: Expression has undefined
6016 <p class="lclintrun"> (unconstrained function
6017 mystery used in left operand</p>
6018 <p class="lclintrun"> may set global variable
6019 glob used in right operand):</p>
6020 <p class="lclintrun"> mystery() * glob</p>
6021 <p class="TextFontCX" align="left" style='text-align:left'>
6023 <p class="TextFontCX" align="left" style=
6024 'text-align:left;page-break-after:avoid'><i>The warning for line 14
6025 is reported because the modifies clause of</i> <span class=
6026 "CodeText"><span style='font-size:10.0pt'>modglob</span></span>
6027 <i>indicated that it may modify</i> <span class=
6028 "CodeText"><span style=
6029 'font-size:10.0pt'>glob</span></span><i>. The behavior is
6030 undefined since we don’t know if</i> <span class=
6031 "CodeText"><span style='font-size:10.0pt'>glob</span></span> <i>is
6032 evaluated before, after or during the</i> <i>modification.
6033 The line 15 warning would not be reported without</i>
6034 <span class="Flag"><span style=
6035 'font-size:10.0pt'>+evalorderuncon</span></span><i>.</i></p></td></tr></table>
6036 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
6038 <td valign="top" style=
6039 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
6040 <p class="MsoCaption"><a name="_Toc534824620"></a><a name=
6041 "_Ref534823183">Figure 16</a>. Evaluation
6042 Order</p></td></tr></table></center>
6043 <p class="TextFontCX"> </p>
6044 <p class="TextFontCX">When checking systems without modifies and
6045 globals information (see Section 7), evaluation order checking may
6046 report errors when unconstrained functions are called in procedure
6047 arguments. Since Splint has no annotations to constrain what
6048 these functions may modify, it cannot be guaranteed that the
6049 evaluation order is defined if another argument calls an
6050 unconstrained function or uses a global variable or storage
6051 reachable from a parameter to the unconstrained function. Its
6052 best to add modifies and globals clauses to constrain the
6053 unconstrained functions in ways that eliminate the possibility of
6054 undefined behavior. For large legacy systems, this may
6055 require too much effort. Instead, the <span class=
6057 'font-size:10.0pt'>‑eval-order-uncon</span></span> flag may
6058 be used to prevent reporting of undefined behavior due to the order
6059 of evaluation of unconstrained functions. Figure 16
6060 illustrates detection of undefined behavior.</p>
6062 <table class="MsoNormalTable" border="0" cellspacing="0"
6063 cellpadding="0" style=
6064 'margin-left:18.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
6066 <td valign="top" style=
6067 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
6068 <p class="TextFontCX" align="center" style='text-align:center'>
6069 <span class="Keyword"><b><span style=
6070 'font-size:10.0pt; color:white'>loop.c</span></b></span></p></td>
6071 <td valign="top" style=
6072 'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
6073 <p class="TextFontCX" align="center" style='text-align:center'>
6074 <b><span style='color:white'>Running
6075 Splint</span></b></p></td></tr>
6076 <tr style='height:143.1pt'>
6077 <td valign="top" style=
6078 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>
6079 <p class="Verbatim">extern int glob1, glob2;</p>
6080 <p class="Verbatim">extern int f (void)</p>
6081 <p class="Verbatim"> /*@globals glob1@*/</p>
6082 <p class="Verbatim"> /*@modifies nothing@*/;</p>
6083 <p class="Verbatim">extern void g (void)</p>
6084 <p class="Verbatim"> /*@modifies glob2@*/ ;</p>
6085 <p class="Verbatim">extern void h (void) ;</p>
6086 <p class="Verbatim"> </p>
6087 <p class="Verbatim">void upto (int x)</p>
6088 <p class="Verbatim">{</p>
6089 <p class="Verbatim"><span class="Line"><span style=
6090 'font-size:8.0pt'>14</span></span> while (x > f ())
6092 <p class="Verbatim"><span class="Line"><span style=
6093 'font-size:8.0pt'>15</span></span> while (f () < 3)
6095 <p class="Verbatim">}</p></td>
6096 <td valign="top" style=
6097 'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>
6098 <p class="lclintrun">> splint loop.c +infloopsuncon</p>
6099 <p class="lclintrun">loop.c:14: Suspected infinite loop. No
6101 <p class="lclintrun"> loop test (x, glob1) is
6102 modified by test or loop</p>
6103 <p class="lclintrun"> body.</p>
6104 <p class="lclintrun">loop.c:15: Suspected infinite loop. No
6106 <p class="lclintrun"> values modified.
6107 Modification possible through</p>
6108 <p class="lclintrun"> unconstrained calls: h</p>
6109 <p class="TextFontCX" style='page-break-after: avoid'><i>An error
6110 is reported for line 14 since the only value modified by<br>
6111 the loop test or body if</i> <span class=
6112 "CodeText"><span style='font-size: 10.0pt'>glob2</span></span>
6113 <i>and the value of the loop test<br>
6114 does not depend on</i> <span class="CodeText"><span style=
6115 'font-size:10.0pt'>glob2</span></span><i>. The error for line
6117 reported without</i> <span class="Flag"><span style=
6118 'font-size:10.0pt'>+infloopsuncon</span></span><i>.</i></p></td></tr></table>
6119 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
6121 <td valign="top" style=
6122 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
6123 <p class="MsoCaption"><a name="_Toc534824621"></a><a name=
6124 "_Ref534823256">Figure 17</a>. Infinite
6125 Loops</p></td></tr></table></center>
6126 <h2 style='margin-left:0in;text-indent:0in'><a name=
6127 "_Toc534974989"></a><a name="_Ref344892701"></a><a name=
6128 "_Toc344355430">8.3<span style=
6129 'font:7.0pt "Times New Roman"'> </span>
6130 Problematic Control Structures</a></h2>
6131 <p class="TextFontCX">A number of control structures that are
6132 syntactically legal may indicate likely bugs in programs.
6133 Splint can detect errors involving likely infinite
6134 loops (Section 8.3.1), fall through cases and missing cases in
6135 <span class="CodeText"><span style=
6136 'font-size:10.0pt'>switch</span></span> statements (Section
6137 8.3.2), <span class="CodeText"><span style=
6138 'font-size:10.0pt'>break</span></span> statements within deeply
6139 nested loops or switches (Section 8.3.3), clauses of
6140 <span class="CodeText"><span style=
6141 'font-size:10.0pt'>if</span></span>, <span class=
6142 "CodeText"><span style='font-size:10.0pt'>while</span></span>
6143 or <span class="CodeText"><span style=
6144 'font-size:10.0pt'>for</span></span> statements that are
6145 empty statements or unblocked single statements (Section
6146 8.3.4) and incomplete if-else logic (Section 8.3.5).
6147 Although any of these may appear in a correct program,
6148 depending on the programming style used they may indicate
6149 likely bugs or style violations that should be detected and
6151 <h3 style='margin-left:0in;text-indent:0in'><a name=
6152 "_Toc534974990"></a><a name="_Ref344810086">8.3.1<span style=
6153 'font:7.0pt "Times New Roman"'> </span>
6154 Likely Infinite Loops</a></h3>
6155 <p class="TextFontCX">Splint reports an error if it detects a loop
6156 that appears to be infinite. An error is reported for a loop
6157 that does not modify any value used in its condition test inside
6158 the body of the loop or in the condition test itself. This
6159 checking is enhanced by modifies clauses and globals lists (see
6160 Section 7) since they <a name="_Ref344818734">provide more
6161 information about what global variable may be used in the condition
6162 test and what values may be modified by function calls in the loop
6164 <p class="TextFontCX"> </p>
6165 <p class="TextFontCX">Figure 17 shows examples of infinite
6166 loops detected by Splint. An error is reported for the loop in
6167 line 14, since neither of the values used in the loop condition
6168 (<span class="CodeText"><span style=
6169 'font-size:10.0pt'>x</span></span> directly and <span class=
6170 "CodeText"><span style='font-size:10.0pt'>glob1</span></span>
6171 through the call to <span class="CodeText"><span style=
6172 'font-size:10.0pt'>f</span></span>) is modified by the body of the
6173 loop. If the declaration of <span class=
6174 "CodeText"><span style='font-size:10.0pt'>g</span></span> is
6175 changed to include <span class="CodeText"><span style=
6176 'font-size:10.0pt'>glob1</span></span> in the modifies clause no
6177 error is reported. (In this example, if we assume the
6178 annotations are correct, then the programmer has probably called
6179 the wrong function in the loop body. This isn’t
6180 surprising, given the horrible choices of function and variable
6182 <p class="TextFontCX"> </p>
6183 <p class="TextFontCX">If an unconstrained function is called within
6184 the loop body, Splint will assume that it modifies a value used in
6185 the condition test and not report an infinite loop error, unless
6186 <span class="Flag"><span style=
6187 'font-size:10.0pt'>infloopsuncon</span></span> is on. If
6188 <span class="Flag"><span style=
6189 'font-size:10.0pt'>infloopsuncon</span></span> is on, Splint will
6190 report infinite loop errors for loops where there is no explicit
6191 modification of a value used in the condition test, but where they
6192 may be an undetected modification through a call to an
6193 unconstrained function (e.g., line 12 in Figure 17).</p>
6194 <p class="TextFontCX"> </p>
6195 <p class="TextFontCX"> </p>
6196 <p class="TextFontCX" align="center" style='text-align:center'>
6197 <span style='font-size:10.0pt'> </span></p>
6198 <h3 style='margin-left:0in;text-indent:0in'><a name=
6199 "_Toc534974991"></a><a name="_Ref349899747"></a><a name=
6200 "_Ref345591205">8.3.2<span style=
6201 'font:7.0pt "Times New Roman"'> </span>
6203 <p class="TextFontCX">The automatic fall through of C switch
6204 statements is almost never the intended behavior.<a href="#_ftn10"
6205 name="_ftnref10" title=""><span class=
6206 "MsoFootnoteReference"><span class=
6207 "MsoFootnoteReference"><span style=
6208 'font-size:11.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>
6209 Splint detects <span class="CodeText"><span style=
6210 'font-size:10.0pt'>case</span></span> statements with code that may
6211 fall through to the next <span class="CodeText"><span style=
6212 'font-size:10.0pt'>case</span></span>. The <span class=
6213 "Flag"><span style='font-size:10.0pt'>casebreak</span></span> flag
6214 controls reporting of fall through cases. A single fall
6215 through case may be marked by preceding the <span class=
6216 "CodeText"><span style='font-size:10.0pt'>case</span></span>
6217 keyword with <span class="Annot"><span style=
6218 'font-size:10.0pt'>/*@fallthrough@*/</span></span> to indicate
6219 explicitly that execution falls through to this case. See
6220 Figure 18 for an example.</p>
6221 <p class="TextFontCX"> </p>
6222 <p class="TextFontCX">For switches on <span class=
6223 "CodeText"><span style='font-size:10.0pt'>enum</span></span> types,
6224 Splint reports an error if a member of the enumerator does not
6225 appear as a case in the switch body (and there is no
6226 <span class="CodeText"><span style=
6227 'font-size:10.0pt'>default</span></span> case).
6228 (Controlled by <span class="Flag"><span style=
6229 'font-size:10.0pt'>misscase</span></span>.)</p>
6231 <table class="MsoNormalTable" border="0" cellspacing="0"
6232 cellpadding="0" style=
6233 'margin-left:.2in;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
6235 <td valign="top" style=
6236 'width:3.0in;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
6237 <p class="TextFontCX" align="center" style='text-align:center'>
6238 <span class="Keyword"><b><span style=
6239 'font-size:10.0pt; color:white'>switch.c</span></b></span></p></td>
6240 <td valign="top" style=
6241 'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
6242 <p class="TextFontCX" align="center" style='text-align:center'>
6243 <b><span style='color:white'>Running
6244 Splint</span></b></p></td></tr>
6246 <td valign="top" style=
6247 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
6248 <p class="Verbatim">typedef enum {</p>
6249 <p class="Verbatim"> YES, NO, DEFINITELY,</p>
6250 <p class="Verbatim"> PROBABLY, MAYBE } ynm;</p>
6251 <p class="Verbatim">void decide (ynm y)</p>
6252 <p class="Verbatim">{</p>
6253 <p class="Verbatim"> switch (y)</p>
6254 <p class="Verbatim"> {</p>
6255 <p class="Verbatim"> case PROBABLY:</p>
6256 <p class="Verbatim"> case NO: printf ("No!");</p>
6257 <p class="Verbatim"><span class="Line"><span style=
6258 'font-size:8.0pt'>10</span></span> case MAYBE: printf
6260 <p class="Verbatim">
6261
6262 /*@fallthrough@*/</p>
6263 <p class="Verbatim"> case YES: printf
6265 <p class="Verbatim"><span class="Line"><span style=
6266 'font-size:8.0pt'>13</span></span> }</p>
6267 <p class="Verbatim">}</p></td>
6268 <td valign="top" style=
6269 'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
6270 <p class="lclintrun">> splint switch.c</p>
6271 <p class="lclintrun">switch.c:10: Fall through case (no preceding
6273 <p class="lclintrun">switch.c:13: Missing case in switch:
6275 <p class="TextFontCX"> </p>
6276 <p class="MsoCaption" align="left" style='text-align:left'>
6277 <i><span style='font-weight:normal'>No fall through error is
6278 reported for the</span></i> <span class=
6279 "CodeText"><span style='font-weight:normal'>NO</span></span><i><span style='font-weight:normal'>
6281 since there are no statements associated with the<br>
6282 previous case. </span></i></p>
6283 <p class="TextFontCX" style='page-break-after: avoid'><i>The</i>
6284 <span class="Annot"><span style=
6285 'font-size:10.0pt'>/*@fallthrough@*/</span></span> <i>comment
6287 a message from being produced for the<br></i> <span class=
6288 "Annot"><span style='font-size:10.0pt'>YES</span></span>
6289 <i>case.</i></p></td></tr></table>
6290 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
6292 <td valign="top" style=
6293 'padding-top:0in;padding-right: 9.0pt;padding-bottom:0in;padding-left:9.0pt'>
6294 <p class="MsoCaption"><a name="_Toc344355431"></a><a name=
6295 "_Ref344881581"></a><a name="_Toc534824622"></a><a name=
6296 "_Ref534823308">Figure 18</a>. Switch
6297 Cases</p></td></tr></table></center>
6298 <h3 style='margin-left:0in;text-indent:0in'><a name=
6299 "_Toc534974992"></a><a name="_Ref534971227">8.3.3<span style=
6300 'font:7.0pt "Times New Roman"'> </span>
6301 Deep Breaks</a></h3>
6302 <p class="TextFontCX">There is no syntax provided by C (other than
6303 <span class="CodeText"><span style=
6304 'font-size:10.0pt'>goto</span></span>) for breaking out of a nested
6305 loop. All <span class="CodeText"><span style=
6306 'font-size:10.0pt'>break</span></span> and <span class=
6307 "CodeText"><span style='font-size:10.0pt'>continue</span></span>
6308 statements act only on the innermost surrounding loop or
6309 switch. This can lead to serious problems<a href="#_ftn11"
6310 name="_ftnref11" title=""><span class=
6311 "MsoFootnoteReference"><span class=
6312 "MsoFootnoteReference"><span style=
6313 'font-size:11.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>
6314 when a programmer intends to break the outer loop or switch
6315 instead. Splint optionally reports warnings for
6316 <span class="CodeText"><span style=
6317 'font-size: 10.0pt'>break</span></span> and <span class=
6318 "CodeText"><span style=
6319 'font-size: 10.0pt'>continue</span></span> statements in
6320 nested contexts.</p>
6321 <p class="beforelist"> </p>
6322 <p class="beforelist">Four types of <span class=
6323 "CodeText"><span style='font-size: 10.0pt'>break</span></span>
6324 warnings are reported:</p>
6325 <p class="MsoListBullet"><span style=
6326 'font-family:Symbol'>·<span style=
6327 'font:7.0pt "Times New Roman"'> </span></span>
6328 <span class="CodeText"><span style=
6329 'font-size:10.0pt'>break</span></span> inside a loop
6330 (<span class="CodeText"><span style=
6331 'font-size:10.0pt'>while</span></span> or <span class=
6332 "CodeText"><span style='font-size:10.0pt'>for</span></span>)
6333 that is inside a loop. Controlled by <span class=
6335 'font-size:10.0pt'>looploopbreak</span></span>. To
6336 indicate that a <span class="CodeText"><span style=
6337 'font-size:10.0pt'>break</span></span> is inside an inner
6338 loop, precede the <span class="CodeText"><span style=
6339 'font-size:10.0pt'>break</span></span> by <a href=
6340 "mailto:/*@innerbreak@*/"><span class="Annot"><span style=
6341 'font-size: 10.0pt'>/*@innerbreak@*/</span></span></a>.</p>
6342 <p class="MsoListBullet"><span style=
6343 'font-family:Symbol'>·<span style=
6344 'font:7.0pt "Times New Roman"'> </span></span>
6345 <span class="CodeText"><span style=
6346 'font-size:10.0pt'>break</span></span> inside a loop that is inside
6347 a <span class="CodeText"><span style=
6348 'font-size:10.0pt'>switch</span></span> statement. Controlled
6349 by <span class="Flag"><span style=
6350 'font-size:10.0pt'>switchloopbreak</span></span>. To mark the
6351 <span class="CodeText"><span style=
6352 'font-size:10.0pt'>break</span></span> as a loop break, precede the
6353 <span class="CodeText"><span style=
6354 'font-size:10.0pt'>break</span></span> by <span class=
6355 "Annot"><span style=
6356 'font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>
6357 <p class="MsoListBullet"><span style=
6358 'font-family:Symbol'>·<span style=
6359 'font:7.0pt "Times New Roman"'> </span></span>
6360 <span class="CodeText"><span style=
6361 'font-size:10.0pt'>break</span></span> inside a <span class=
6362 "CodeText"><span style='font-size:10.0pt'>switch</span></span>
6363 statement that is inside a loop. Controlled by
6364 <span class="Flag"><span style=
6365 'font-size:10.0pt'>loopswitchbreak</span></span>. To
6366 mark the <span class="CodeText"><span style=
6367 'font-size:10.0pt'>break</span></span> as a switch break,
6368 precede the <span class="CodeText"><span style=
6369 'font-size:10.0pt'>break</span></span> by <span class=
6370 "Annot"><span style=
6371 'font-size:10.0pt'>/*@switchbreak@*/</span></span>.</p>
6372 <p class="MsoListBullet"><span style=
6373 'font-family:Symbol'>·<span style=
6374 'font:7.0pt "Times New Roman"'> </span></span>
6375 <span class="CodeText"><span style=
6376 'font-size:10.0pt'>break</span></span> inside a <span class=
6377 "CodeText"><span style='font-size:10.0pt'>switch</span></span>
6378 inside another <span class="CodeText"><span style=
6379 'font-size:10.0pt'>switch</span></span>. Controlled by
6380 <span class="Flag"><span style=
6381 'font-size:10.0pt'>switchswitchbreak</span></span>. To
6382 indicate that the <span class="CodeText"><span style=
6383 'font-size:10.0pt'>break</span></span> is for the inner switch, use
6384 <span class="Annot"><span style=
6385 'font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>
6386 <p class="afterlist">Since <span class=
6387 "CodeText"><span style='font-size:10.0pt'>continue</span></span>
6388 only makes sense within loops, a warning (Controlled by <span class=
6390 'font-size: 10.0pt'>looploopcontinue</span></span>.)
6391 is reported only for
6392 <span class="CodeText"><span style=
6393 'font-size:10.0pt'>continue</span></span> statements within
6394 nested loops. A
6395 safe inner <span class="CodeText"><span style=
6396 'font-size:10.0pt'>continue</span></span> may be preceded by
6397 <span class="Annot"><span style=
6398 'font-size:10.0pt'>/*@innercontinue@*/</span></span> to
6399 suppress error messages locally. The <span class=
6400 "Flag"><span style='font-size:10.0pt'>deepbreak</span></span>
6401 flag sets all nested break and continue checking flags.</p>
6402 <p class="TextFontCX"> </p>
6403 <p class="TextFontCX">Splint warns if the marker preceding a
6404 <span class="CodeText"><span style=
6405 'font-size:10.0pt'>break</span></span> is not consistent with its
6406 placement. A warning results if <span class=
6407 "Annot"><span style='font-size:10.0pt'>innerbreak</span></span>
6408 precedes a <span class="CodeText"><span style=
6409 'font-size:10.0pt'>break</span></span> that is not breaking an
6410 inner loop, <span class="Annot"><span style=
6411 'font-size:10.0pt'>switchbreak</span></span> precedes a
6412 <span class="CodeText"><span style=
6413 'font-size:10.0pt'>break</span></span> that is not breaking a
6414 switch, or <span class="Annot"><span style=
6415 'font-size: 10.0pt'>loopbreak</span></span> precedes a
6416 <span class="CodeText"><span style=
6417 'font-size:10.0pt'>break</span></span> that is not breaking a
6419 <h3 style='margin-left:0in;text-indent:0in'><a name=
6420 "_Toc534974993"></a><a name="_Ref347246280">8.3.4<span style=
6421 'font:7.0pt "Times New Roman"'> </span></a>
6422 Loop and If Bodies</h3>
6423 <p class="beforelist">An empty statement after an
6424 <span class="CodeText"><span style=
6425 'font-size:10.0pt'>if</span></span>, <span class=
6426 "CodeText"><span style='font-size:10.0pt'>while</span></span>
6427 or <span class="CodeText"><span style=
6428 'font-size:10.0pt'>for</span></span> often indicates a
6429 potential bug. A single statement (i.e., not a compound
6430 block) after an <span class="CodeText"><span style=
6431 'font-size:10.0pt'>if</span></span>, <span class=
6432 "CodeText"><span style='font-size:10.0pt'>while</span></span>
6433 or <span class="CodeText"><span style=
6434 'font-size:10.0pt'>for</span></span> is not likely to
6435 indicate a bug, but make the code harder to read and
6436 edit. Splint can report errors for if or loop
6437 statements with empty bodies or bodies that are not compound
6438 statements. Separate flags control checking for
6439 statements following an <span class="CodeText"><span style=
6440 'font-size:10.0pt'>if</span></span>, <span class=
6441 "CodeText"><span style='font-size:10.0pt'>while</span></span>
6442 or <span class="CodeText"><span style=
6443 'font-size:10.0pt'>for</span></span>:</p>
6444 <p class="MsoListBullet"><span style=
6445 'font-family:Symbol'>·<span style=
6446 'font:7.0pt "Times New Roman"'> </span></span>
6447 <span class="Flag"><span style=
6448 'font-size:10.0pt'>[if</span></span>,<span class=
6449 "Flag"><span style='font-size:10.0pt'>while</span></span>,<span class="Flag">
6450 <span style='font-size:10.0pt'>for]empty</span></span> —
6451 report errors for empty bodies (e.g., <span class=
6452 "CodeText"><span style='font-size:10.0pt'>if (x > 3)
6453 ;</span></span> )</p>
6454 <p class="MsoListBullet"><span style=
6455 'font-family:Symbol'>·<span style=
6456 'font:7.0pt "Times New Roman"'> </span></span>
6457 <span class="Flag"><span style=
6458 'font-size:10.0pt'>[if</span></span>,<span class=
6459 "Flag"><span style='font-size:10.0pt'>while</span></span>,<span class="Flag">
6460 <span style='font-size:10.0pt'>for]block</span></span> —
6461 report errors for non-block bodies (e.g., <span class=
6462 "CodeText"><span style='font-size:10.0pt'>if (x > 3)
6463 x++;</span></span>)</p>
6464 <p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
6465 <span class="Keyword"><span style=
6466 'font-size:10.0pt'> </span></span></p>
6467 <p class="afterlist">The <span class="CodeText"><span style=
6468 'font-size:10.0pt'>if</span></span> statement checks also apply to
6469 the body of the <span class="CodeText"><span style=
6470 'font-size:10.0pt'>else</span></span> clause. No
6471 <span class="Flag"><span style=
6472 'font-size:10.0pt'>ifblock</span></span> warning is reported
6473 if the body of the <span class="CodeText"><span style=
6474 'font-size:10.0pt'>else</span></span> clause is an
6475 <span class="CodeText"><span style=
6476 'font-size:10.0pt'>if</span></span> statement, to allow
6477 conventional <span class="CodeText"><span style=
6478 'font-size: 10.0pt'>else if</span></span> chains. </p>
6479 <h3 style='margin-left:0in;text-indent:0in'><a name=
6480 "_Toc534974994"></a><a name="_Ref347246283">8.3.5<span style=
6481 'font:7.0pt "Times New Roman"'> </span>
6482 Complete Logic</a></h3>
6483 <p class="beforelist">Although it may be perfectly reasonable in
6484 many contexts, an <span class="CodeText"><span style=
6485 'font-size:10.0pt'>if</span></span>-<span class=
6486 "CodeText"><span style='font-size:10.0pt'>else</span></span> chain
6487 with no final <span class="CodeText"><span style=
6488 'font-size:10.0pt'>else</span></span> may indicate missing logic or
6489 forgetting to check error cases. If <span class=
6490 "Flag"><span style='font-size:10.0pt'>elseif-complete</span></span>
6491 is on, Splint warns when an <span class=
6492 "CodeText"><span style='font-size:10.0pt'>if</span></span>
6493 statement that is the body of an <span class=
6494 "CodeText"><span style='font-size: 10.0pt'>else</span></span>
6495 clause does not have a matching <span class=
6496 "CodeText"><span style='font-size:10.0pt'>else</span></span>
6497 clause. For example, the code,</p>
6498 <p class="Verbatim"> if (x == 0) { return "nil"; }</p>
6499 <p class="Verbatim"> else if (x == 1) { return "many";
6501 <p class="afterlist">results in a warning since the second
6502 <span class="CodeText"><span style=
6503 'font-size:10.0pt'>if</span></span> has no matching
6504 <span class="CodeText"><span style=
6505 'font-size:10.0pt'>else</span></span> branch.</p>
6506 <h2 style='margin-left:0in;text-indent:0in'><a name=
6507 "_Toc534974995"></a><a name="_Ref344892802">8.4<span style=
6508 'font:7.0pt "Times New Roman"'> </span>
6509 Suspicious Statements</a></h2>
6510 <p class="TextFontCX">Splint detects errors involving statements
6511 with no apparent effects (Section 8.4.1) and statements that ignore
6512 the result of a called function (Section 8.4.2).</p>
6513 <h3 style='margin-left:0in;text-indent:0in'><a name=
6514 "_Toc534974996"></a><a name="_Ref347247824">8.4.1<span style=
6515 'font:7.0pt "Times New Roman"'> </span>
6516 Statements with No Effects</a></h3>
6517 <p class="TextFontCX">Splint can report errors for statements that
6518 have no effect. (Controlled by <span class=
6519 "Flag"><span style='font-size:10.0pt'>no-effect</span></span>.)
6520 Because of modifies clauses, Splint can detect more errors
6521 than traditional checkers. Unless the <span class=
6523 'font-size:10.0pt'>no-effect-uncon</span></span> flag is
6524 on, errors are not reported for statements that involve calls
6525 to unconstrained functions since the unconstrained function
6526 may cause a modification. Figure 19 shows examples of
6527 Splint’s no effect checking.</p>
6529 <table class="MsoNormalTable" border="0" cellspacing="0"
6530 cellpadding="0" style=
6531 'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
6533 <td valign="top" style=
6534 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
6535 <p class="TextFontCX" align="center" style='text-align:center'>
6536 <a name="_Ref344893305"></a><a name=
6537 "_Ref344874935"><span class="StyleKeywordBold"><span style=
6538 'font-size:10.0pt'>noeffect.c</span></span></a></p></td>
6539 <td valign="top" style=
6540 'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
6541 <p class="TextFontCX" align="center" style='text-align:center'>
6542 <b><span style='color:white'>Running
6543 Splint</span></b></p></td></tr>
6545 <td valign="top" style=
6546 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
6547 <p class="Verbatim">extern void</p>
6548 <p class="Verbatim"> nomodcall (int *x) /*@*/;</p>
6549 <p class="IndentText"><i>Recall /*@*/ is shorthand for<br>
6550 modifies nothing and use<br>
6552 <p class="Verbatim">extern void mysterycall (int *x);</p>
6553 <p class="Verbatim"> </p>
6554 <p class="Verbatim">int noeffect (int *x, int y)</p>
6555 <p class="Verbatim">{</p>
6556 <p class="Verbatim"> y == *x;</p>
6557 <p class="Verbatim"> nomodcall (x);</p>
6558 <p class="Verbatim"> mysterycall (x);</p>
6559 <p class="Verbatim"> return *x;</p>
6560 <p class="Verbatim">}</p></td>
6561 <td valign="top" style=
6562 'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
6563 <p class="lclintrun">> splint noeffect.c +noeffectuncon</p>
6564 <p class="lclintrun">noeffect.c:6: Statement has no effect: y ==
6566 <p class="lclintrun">noeffect.c:7: Statement has no effect:
6568 <p class="lclintrun">noeffect.c:8: Statement has no effect
6570 <p class="lclintrun"> undetected modification
6572 <p class="lclintrun"> unconstrained function
6574 <p class="lclintrun"> mysterycall(x)</p>
6575 <p class="IndentText"><i> </i></p>
6576 <p class="IndentText" style='page-break-after:avoid'><i>The warning
6577 for line 8 would not be<br>
6578 reported without</i> <span class="Flag"><span style=
6579 'font-size: 10.0pt'>+noeffectuncon</span></span>.</p></td></tr></table>
6580 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
6582 <td valign="top" style=
6583 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
6584 <p class="MsoCaption"><a name="_Ref534813977"></a><a name=
6585 "_Toc534824623"></a><a name="_Ref534823396">Figure 19</a>.
6586 Statements with No Effect</p></td></tr></table></center>
6587 <h3 style='margin-left:0in;text-indent:0in'><a name=
6588 "_Ref534978820"></a><a name="_Toc534974997">8.4.2<span style=
6589 'font:7.0pt "Times New Roman"'> </span>
6590 Ignored Return Values</a></h3>
6591 <p class="TextFontCX">Splint reports an error when a return value
6592 is ignored. Checking may be controlled based on the type of
6593 the return value: <span class="Flag"><span style=
6594 'font-size:10.0pt'>ret-val-int</span></span> controls reporting of
6595 ignored return values of type <span class=
6596 "Keyword"><span style='font-size:10.0pt'>int</span></span>,
6597 and <span class="Flag"><span style=
6598 'font-size:10.0pt'>ret-val-bool</span></span> for return
6599 values of type <span class="Keyword"><span style=
6600 'font-size:10.0pt'>bool</span></span>, and <span class=
6602 'font-size:10.0pt'>ret-val-others</span></span> for all
6603 other types. A function statement may be cast to
6604 <span class="Keyword"><span style=
6605 'font-size:10.0pt'>void</span></span> to prevent this error
6606 from being reported.</p>
6607 <p class="TextFontCX"> </p>
6608 <p class="TextFontCX">Alternate types (Section 4.4) can be
6609 used to declare functions that return values that may safely be
6610 ignored by declaring the result type to alternately be
6611 <span class="Keyword"><span style=
6612 'font-size:10.0pt'>void</span></span>. Several
6613 functions in the standard library are specified to
6614 alternately return <span class="Keyword"><span style=
6615 'font-size:10.0pt'>void</span></span> to prevent ignored
6616 return value errors for standard library functions (e.g.,
6617 <span class="Keyword"><span style=
6618 'font-size:10.0pt'>strcpy</span></span>) where the result may
6619 be safely ignored (see Section 14.1). Figure 20 shows
6620 examples of ignored return value errors reported by
6622 <p class="MsoNormal" align="left" style=
6623 'text-align:left;background:white'><span style=
6624 'font-size:10.0pt'> </span></p>
6626 <table class="MsoNormalTable" border="0" cellspacing="0"
6627 cellpadding="0" style='margin-left:9.9pt;border-collapse:collapse'>
6629 <td valign="top" style=
6630 'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
6631 <p class="TextFontCX" align="center" style='text-align:center'>
6632 <span class="Keyword"><b><span style=
6633 'font-size:10.0pt; color:white'>ignore.c</span></b></span></p></td>
6634 <td valign="top" style=
6635 'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
6636 <p class="TextFontCX" align="center" style='text-align:center'>
6637 <b><span style='color:white'>Running
6638 Splint</span></b></p></td></tr>
6640 <td valign="top" style=
6641 'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
6642 <p class="Verbatim"># include “bool.h”</p>
6643 <p class="Verbatim">extern int fi (void);</p>
6644 <p class="Verbatim">extern bool fb (void);</p>
6645 <p class="Verbatim">extern int /*@alt void@*/</p>
6646 <p class="Verbatim"> fv (void);</p>
6647 <p class="Verbatim"> </p>
6648 <p class="Verbatim">int ignore (void)</p>
6649 <p class="Verbatim">{</p>
6650 <p class="Verbatim"><span class="Line"><span style=
6651 'font-size:8.0pt'> 8</span></span> fi ();</p>
6652 <p class="Verbatim"><span class="Line"><span style=
6653 'font-size:8.0pt'> 9</span></span> (void) fi ();</p>
6654 <p class="Verbatim"><span class="Line"><span style=
6655 'font-size:8.0pt'>10</span></span> fb ();</p>
6656 <p class="Verbatim"><span class="Line"><span style=
6657 'font-size:8.0pt'>11</span></span> fv ();</p>
6658 <p class="Verbatim"><span class="Line"><span style=
6659 'font-size:8.0pt'>12</span></span> return fv ();</p>
6660 <p class="Verbatim">}</p></td>
6661 <td valign="top" style=
6662 'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
6663 <p class="lclintrun">> splint ignore.c</p>
6664 <p class="lclintrun"> </p>
6665 <p class="lclintrun">ignore.c:8: Return value (type int) ignored:
6667 <p class="lclintrun">ignore.c:10: Return value (type bool) ignored:
6669 <p class="lclintrun"> </p>
6670 <p class="MsoNormal" style='background:white'><i><span style=
6671 'font-size:10.0pt'>The message for line 8 would not be reported
6672 if</span></i> <span class="Flag"><span style=
6673 'font-size:10.0pt'>‑retvalint</span></span><i><span style='font-size:10.0pt'>
6675 for line 10, if</span></i> <span class="Flag"><span style=
6676 'font-size:10.0pt'>‑retvalbool</span></span><i><span style='font-size:10.0pt'>
6677 is set.</span></i></p>
6678 <p class="MsoNormal" style='background:white'><i><span style=
6679 'font-size:10.0pt'> </span></i></p>
6680 <p class="MsoNormal" style='background:white'><i><span style=
6681 'font-size:10.0pt'> No message is reported for line 9 because
6682 the result is cast to</span></i> <span class=
6683 "CodeText"><span style='font-size:10.0pt'>void</span></span><i><span style='font-size:10.0pt'>
6685 and no message is reported for line 11 because</span></i>
6686 <span class="CodeText"><span style=
6687 'font-size:10.0pt'>fv</span></span><i><span style=
6688 'font-size:10.0pt'>is declared<br>
6689 to alternately return</span></i> <span class=
6690 "CodeText"><span style=
6691 'font-size:10.0pt'>void</span></span><i><span style=
6692 'font-size:10.0pt'>.</span></i></p>
6693 <p class="TextFontCX" style='page-break-after: avoid'>
6694 </p></td></tr></table>
6696 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
6698 <td valign="top" style=
6699 'padding-top:0in;padding-right: 9.0pt;padding-bottom:0in;padding-left:9.0pt'>
6700 <p class="MsoCaption"><a name="_Toc534824624"></a><a name=
6701 "_Ref534823436">Figure 20</a>. Ignored Return
6702 Values</p></td></tr></table></div></center>
6703 <p class="MsoNormal" align="left" style=
6704 'text-align:left;background:white'><span style=
6705 'font-size:10.0pt'> </span></p>
6707 'font-size:16.0pt;font-family:"Times New Roman"'><br clear="all"
6708 style='page-break-before:always'></span></b>
6709 <h1 style='margin-left:0in;text-indent:0in;page-break-before:auto'>
6710 <a name="_Toc534974998"></a><a name="_Ref534963019"></a><a name=
6711 "_Ref534962975">9<span style=
6712 'font:7.0pt "Times New Roman"'> </span>
6713 <a id="buffer" name="buffer">
6714 Buffer Sizes</a></a></h1>
6715 <p class="TextFontCX">Buffer overflow errors are a particularly
6716 dangerous type of bug in C programs. They are directly
6717 responsible for about half of all security attacks
6718 [Larochelle01]. For performance reasons, C does not perform
6719 run time bounds checking. Referencing storage outside
6720 allocated regions can cause memory corruption and lead to strange
6721 behavior. Moreover, buffer overflow bugs are particularly
6722 insidious because they can go undetected in testing or normal use,
6723 but usually result in security critical bugs. Reads beyond
6724 the end of a buffer can cause the program to leak
6725 information. Writes beyond the end a buffer (buffer
6726 overflows) can usually be exploited make the program run arbitrary
6727 code. Attackers can exploit these programming bugs to replace
6728 the return address on the stack and place arbitrary code in memory
6729 thereby gaining full access to the machine. Splint is able to
6730 detect many memory bounds errors. <a href="#_ftn12" name=
6731 "_ftnref12" title=""><span style=
6732 'font-size:11.0pt; font-family:"Times New Roman"'>[12]</span></a> </p>
6733 <h2 style='margin-left:0in;text-indent:0in'><a name=
6734 "_Toc534974999">9.1<span style=
6735 'font:7.0pt "Times New Roman"'> </span>
6736 Checking Accesses</a></h2>
6737 <p class="TextFontCX">Splint models blocks of contiguous memory
6738 using two properties: <span class="Annot"><span style=
6739 'font-size:10.0pt'>maxSet</span></span> and <span class=
6740 "Annot"><span style='font-size:10.0pt'>maxRead</span></span>.
6741 Given a buffer <span class="CodeText"><i><span style=
6742 'font-size:10.0pt'>b</span></i></span>, <span class=
6743 "Annot"><span style=
6744 'font-size:10.0pt'>maxSet(<i>b</i>)</span></span> denotes the
6745 highest address beyond <span class="CodeText"><i><span style=
6746 'font-size:10.0pt'>b</span></i></span> that can be safely used as
6747 an lvalue. For the declaration <span class=
6748 "CodeText"><span style='font-size:10.0pt'>char
6749 buf[MAXSIZE]</span></span> we have <span class=
6750 "Annot"><span style='font-size: 10.0pt'>maxSet(buf)</span></span>
6751 <span class="CodeText"><span style='font-size: 10.0pt'>=
6752 MAXSIZE - 1</span></span>. Similarly, <span class=
6753 "Annot"><span style='font-size:10.0pt'>maxRead</span></span>
6754 denotes the highest index of a buffer that can be safely used
6755 an rvalue. It is inappropriate to read an uninitialized
6756 element or beyond the <span class="CodeText"><span style=
6757 'font-size:10.0pt'>NUL</span></span> terminator of a null
6758 terminated buffer.</p>
6759 <p class="TextFontCX"> </p>
6760 <p class="TextFontCX">When a buffer is accessed as an lvalue,
6761 Splint generates a precondition constraint involving the
6762 <span class="Annot"><span style=
6763 'font-size:10.0pt'>maxSet</span></span> property. When a
6764 buffer is accessed as an rvalue, Splint generates a precondition
6765 constraint involving the <span class="Annot"><span style=
6766 'font-size:10.0pt'>maxRead</span></span> property. For the
6767 expression <span class="CodeText"><span style=
6768 'font-size:10.0pt'>*<i>ptr</i></span></span>, Splint generates the
6769 constraints <span class="Annot"><span style=
6770 'font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>
6771 <span class="CodeText"><span style='font-size:10.0pt'>>=
6772 0</span></span> or <span class="Annot"><span style=
6773 'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
6774 <span class="CodeText"><span style='font-size:10.0pt'>>=
6775 0</span></span> depending on whether <span class=
6776 "CodeText"><i><span style=
6777 'font-size:10.0pt'>ptr</span></i></span> is used as an lvalue
6778 or rvalue. Similarly, for accesses of the form
6779 <span class="CodeText"><span style=
6780 'font-size:10.0pt'>ptr[i]</span></span>, splint generates the
6781 constraints <span class="Annot"><span style=
6782 'font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>
6783 <span class="CodeText"><span style='font-size:10.0pt'>>=
6784 i</span></span> or <span class="Annot"><span style=
6785 'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
6786 <span class="CodeText"><span style='font-size:10.0pt'>>=
6787 i</span></span>. If <span class="Flag"><span style=
6788 'font-size:10.0pt'>+boundswrite</span></span> is set, Splint
6789 warns if it is unable to resolve a constraint involving
6790 <span class="Annot"><span style=
6791 'font-size:10.0pt'>maxSet</span></span>. If <span class=
6793 'font-size:10.0pt'>+boundsread</span></span> is set, Splint
6794 warns about unresolved <span class="Annot"><span style=
6795 'font-size:10.0pt'>maxRead</span></span> constraints
6797 <p class="TextFontCX"> </p>
6798 <p class="TextFontCX">Splint generates postconditions for
6799 statements to help resolve precondition constraints. When a
6800 buffer is written to we know that an element of a buffer is
6801 initialized and is safe to read. We generate the
6802 postcondition <span class="Annot"><span style=
6803 'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
6804 <span class="CodeText"><span style='font-size:10.0pt'>>=
6805 0</span></span> if the buffer is accessed using <span class=
6806 "CodeText"><span style='font-size:10.0pt'>*ptr</span></span>
6807 or <span class="Annot"><span style=
6808 'font-size:10.0pt'>maxRead(ptr)</span></span> <span class=
6809 "CodeText"><span style='font-size:10.0pt'>>=
6810 i</span></span> if the buffer is accessed using <span class=
6811 "CodeText"><i><span style=
6812 'font-size:10.0pt'>ptr</span></i></span><span class=
6813 "CodeText"><span style=
6814 'font-size:10.0pt'>[<i>i</i>]</span></span>. Splint
6815 generates additional postconditions for a variety of C
6816 constructs. For assignment statements, Splint generates
6817 a postcondition equating the two operands. Splint also
6818 generates post condition constraints for the <span class=
6819 "Annot"><span style='font-size:10.0pt'>maxSet</span></span>
6820 value of fixed sized arrays.</p>
6821 <h2 style='margin-left:0in;text-indent:0in'><a name=
6822 "_Toc534975000">9.2<span style=
6823 'font:7.0pt "Times New Roman"'> </span>
6824 Annotating Buffer Sizes</a></h2>
6825 <p class="TextFontCX">Function declarations may include
6826 <span class="Annot"><span style=
6827 'font-size:10.0pt'>requires</span></span> and <span class=
6828 "Annot"><span style='font-size:10.0pt'>ensures</span></span>
6829 clauses that specify assumptions about buffer sizes for
6830 function preconditions. They are interpreted like
6831 <span class="Annot"><span style=
6832 'font-size:10.0pt'>requires</span></span> and <span class=
6833 "Annot"><span style='font-size:10.0pt'>ensures</span></span>
6834 clauses for simple memory states (see Section 7.5) but can be
6835 more expressive. When a function with a <span class=
6836 "Annot"><span style='font-size:10.0pt'>requires</span></span>
6837 clause is called, the call site must be checked to satisfy
6838 the constraints implied by the <span class=
6839 "Annot"><span style='font-size:10.0pt'>requires</span></span>
6840 clause. Similarly, an <span class="Annot"><span style=
6841 'font-size:10.0pt'>ensures</span></span> clause can be used
6842 to specify function post conditions. If the
6843 <span class="Flag"><span style=
6844 'font-size:10.0pt'>+checkpost</span></span> flag is set,
6845 Splint warns if it cannot verify that a function
6846 implementation satisfies its declared postconditions.</p>
6847 <p class="TextFontCX"> </p>
6848 <p class="TextFontCX">Constraints can contain function parameters
6849 as well as global variables and integer constants. The unary
6850 operators, <span class="Annot"><span style=
6851 'font-size:10.0pt'>maxSet</span></span> and <span class=
6852 "Annot"><span style='font-size:10.0pt'>maxRead</span></span> which
6853 correspond to the properties described above are also supported.
6854 Multiple predicates may be conjoined using <span class=
6855 "CodeText"><span style=
6856 'font-size: 10.0pt'>/\</span></span>. </p>
6857 <p class="TextFontCX"> </p>
6858 <p class="TextFontCX">For example, the standard library annotates
6859 <span class="CodeText"><span style=
6860 'font-size:10.0pt'>strcpy</span></span>:</p>
6861 <p class="MsoPlainText" style='line-height:normal'> </p>
6862 <p class="Verbatim" style='margin-left:22.5pt'>void /*@alt char *
6864 <p class="Verbatim" style='margin-left:22.5pt;text-indent:13.5pt'>
6865 (/*@unique@*/ /*@out@*/ /*@returned@*/ char *s1, char *s2)</p>
6866 <p class="Verbatim" style='margin-left:.5in'>/*@modifies *s1@*/</p>
6867 <p class="Verbatim" style='margin-left:.5in'>/*@requires maxSet(s1)
6868 >= maxRead(s2) @*/</p>
6869 <p class="Verbatim"> /*@ensures
6870 maxRead(s1) == maxRead (s2) @*/; </p>
6871 <p class="MsoPlainText" style=
6872 'margin-left:.5in;line-height:normal'><b> </b></p>
6873 <p class="MsoPlainText" style=
6874 'text-align:justify;line-height:normal'>The <span class=
6875 "Annot"><span style='font-size:10.0pt'>requires</span></span>
6876 clause indicates that the buffer passed as <span class=
6877 "CodeText"><span style='font-size:10.0pt'>s1</span></span> must be
6878 large enough to hold the string passed as <span class=
6879 "CodeText"><span style='font-size:10.0pt'>s2</span></span>.
6880 The <span class="Annot"><span style=
6881 'font-size:10.0pt'>ensures</span></span> clause specifies that
6882 <span class="Annot"><span style=
6883 'font-size:10.0pt'>maxRead</span></span> of <span class=
6884 "CodeText"><span style='font-size:10.0pt'>s1</span></span> after
6885 the call is equal to <span class="Annot"><span style=
6886 'font-size:10.0pt'>maxRead</span></span> of <span class=
6887 "CodeText"><span style='font-size:10.0pt'>s2</span></span>.
6888 In cases where the size of <span class=
6889 "CodeText"><span style='font-size:10.0pt'>s2</span></span> is
6890 unknown, programs should use <span class=
6891 "CodeText"><span style=
6892 'font-size: 10.0pt'>strncpy</span></span>, annotated as:</p>
6893 <p class="Verbatim"> </p>
6894 <p class="Verbatim" style='margin-left:22.5pt'>void /*@alt char *
6896 <p class="Verbatim" style='margin-left:22.5pt'>
6897 (/*@unique@*/ /*@out@*/ /*@returned@*/ char *s1, char *s2,</p>
6898 <p class="Verbatim" style='margin-left:22.5pt;text-indent:13.5pt'>
6899 size_t n)</p>
6900 <p class="Verbatim" style='margin-left:22.5pt'>
6901 /*@modifies *s1@*/ </p>
6902 <p class="Verbatim" style='margin-left:22.5pt'> /*@requires
6903 maxSet(s1) >= ( n - 1 ); @*/</p>
6904 <p class="Verbatim" style='margin-left:22.5pt'> /*@ensures
6905 maxRead (s2) >= maxRead(s1) /\ maxRead (s1) <= n;@*/;</p>
6906 <p class="TextFontCX"> </p>
6907 <p class="TextFontCX">The syntax for buffer size constraint clauses
6909 <p class="TextFontCX"> </p>
6910 <p class="TextFontCX" align="left" style=
6911 'margin-left: 22.5pt;text-align:left'><i><span lang=
6912 "FR">constraint</span></i> <span lang="FR"> </span>
6913 <span style='font-family:Symbol'>Þ</span> <span lang=
6914 "FR">(</span><span class="Annot"><span style=
6915 'font-size:10.0pt'>requires</span></span> <span lang="FR">|</span>
6916 <span class="Annot"><span style=
6917 'font-size:10.0pt'>ensures</span></span><span lang="FR">)
6918 <i>consExpr relOp consExpr</i></span></p>
6919 <p class="TextFontCX" align="left" style=
6920 'margin-left: 22.5pt;text-align:left'><i><span lang=
6921 "FR">relOp</span></i> <span lang=
6922 "FR"> </span> <span style=
6923 'font-family:Symbol'>Þ</span> <span class=
6924 "Annot"><span style='font-size: 10.0pt'>==</span></span>
6925 <span lang="FR">|</span> <span class="Annot"><span style=
6926 'font-size:10.0pt'>></span></span> <span lang=
6927 "FR">|</span> <span class="Annot"><span style=
6928 'font-size:10.0pt'>>=</span></span> <span lang=
6929 "FR">|</span> <span class="Annot"><span style=
6930 'font-size:10.0pt'><</span></span> <span lang=
6931 "FR">|</span> <span class="Annot"><span style=
6932 'font-size:10.0pt'><=</span></span></p>
6933 <p class="TextFontCX" align="left" style=
6934 'margin-left: 22.5pt;text-align:left'><i><span lang=
6935 "FR">consExpr </span></i> <span style=
6936 'font-family:Symbol'>Þ</span> <i><span lang=
6937 "FR">consExpression binOp consExpr</span></i> | <i>unaryOp</i>
6938 <span class="Annot"><span style=
6939 'font-size:10.0pt'>(</span></span><i>consExpr</i>
6940 <span class="Annot"><span style=
6941 'font-size:10.0pt'>)</span></span> | <i>term</i></p>
6942 <p class="TextFontCX" align="left" style=
6943 'margin-left: 22.5pt;text-align:left'><i>binOp</i>
6944 <span style=
6945 'font-family:Symbol'>Þ</span> <span class=
6946 "Annot"><span style='font-size:10.0pt'>+</span></span> |
6947 <span class="Annot"><span style=
6948 'font-size:10.0pt'>-</span></span></p>
6949 <p class="TextFontCX" align="left" style=
6950 'margin-left: 22.5pt;text-align:left'><i>unaryOp</i>
6951 <span style='font-family:Symbol'>Þ</span> <span class=
6952 "Annot"><span style='font-size:10.0pt'>maxSet</span></span> |
6953 <span class="Annot"><span style=
6954 'font-size:10.0pt'>maxRead</span></span></p>
6955 <p class="TextFontCX" align="left" style=
6956 'margin-left: 22.5pt;text-align:left'><i>term</i>
6957 <span style=
6958 'font-family:Symbol'>Þ</span> <i>identifier</i> |
6959 <i>literal</i> | <span class="Annot"><span style=
6960 'font-size: 10.0pt'>result</span></span></p>
6961 <h2 style='margin-left:0in;text-indent:0in'><a name=
6962 "_Toc534975001">9.3<span style=
6963 'font:7.0pt "Times New Roman"'> </span>
6964 Less Stringent Checking</a></h2>
6965 For some programs, Splint's standard bounds checking produces an
6966 unacceptably high number of warnings. Because of this, Splint now
6967 prioritizes warnings using a simple heuristic. The flags
6968 <span class="Flag"><span style=
6969 'font-size:10.0pt'>likely-bounds</span></span>, <span class=
6971 'font-size:10.0pt'>likely-bounds-writes</span></span>, and
6972 <span class="Flag"><span style=
6973 'font-size:10.0pt'>likely-bounds-read</span></span> are similar to
6974 <span class="Flag"><span style=
6975 'font-size:10.0pt'>bounds</span></span>,<span class=
6976 "Flag"><span style='font-size:10.0pt'>bounds-write</span></span>,
6977 and <span class="Flag"><span style=
6978 'font-size:10.0pt'>bounds-read</span></span>, but they only cause
6979 Splint to produce warnings for what it determines are likely bounds
6980 errors. Splint classifies an unresolved constraint as a likely
6981 bounds error if it can reduce the constraint to a numerical
6982 inconsistency such as <span class="Verbatim">5 >= 10</span>.
6983 Warnings for these constraints are more likely to be legitimate --
6984 indicating real bugs or the lack of annotations. Additionally, when
6985 these warnings are false positives, it is easier for humans to
6986 recognize them as spurious. These flags generate significantly
6987 fewer errors (an order of magnitude in some cases), and the errors
6988 generated are easier to understand. However, this does not come
6989 without cost. The checking is significantly less precise and is
6990 likely to miss real errors.
6991 <h2 style='margin-left:0in;text-indent:0in'><a name=
6992 "_Toc534975001">9.4<span style=
6993 'font:7.0pt "Times New Roman"'> </span>
6995 <p class="TextFontCX">Since bounds checking is more complex than
6996 other checks done by Splint, memory bounds warnings contain
6997 extensive information about the unresolved constraint.
6998 Warning messages for unresolved constraints contain both the
6999 original constraints and the simplified form of the constraint
7000 which cannot be resolved. If the constraint was derived from
7001 a function precondition, the original precondition is included in
7002 the error message. If the <span class=
7003 "Flag"><span style='font-size:10.0pt'>+showconstraintlocation</span></span>
7004 flag is set, the message includes the expression that the
7005 constraint is derived from. The <span class=
7007 'font-size:10.0pt'>+showconstraintparens</span></span> flag
7008 directs Splint to display fully parenthesized constraints in
7009 warnings to remove ambiguity.</p>
7010 <p class="TextFontCX"> </p>
7011 <p class="TextFontCX">Consider the code excerpt below containing a
7012 trivial out-of-bounds write:</p>
7013 <p class="Verbatim"> </p>
7014 <p class="Verbatim" style='text-indent:.5in'>int buf[10];</p>
7015 <p class="Verbatim" style='text-indent:.5in'>buf[10] = 3;</p>
7016 <p class="TextFontCX"> </p>
7017 <p class="TextFontCX" style='margin-bottom:6.0pt'>Splint warns:</p>
7018 <p align="left" class="lclintrun" style='margin-left:.5in'>
7019 setChar.c:5:4: Likely out-of-bounds store:<br>
7020 buf[10] = 3</p>
7021 <p class="lclintrun" align="left" style='margin-left:.5in'>
7022 Unable to resolve constraint: requires 9 >=
7024 <p class="lclintrun" align="left" style=
7025 'margin-top:0in;margin-right:0in;margin-bottom:6.0pt; margin-left:.5in'>
7026 needed to satisfy precondition: requires
7027 maxSet(buf @ setChar.c:5:4) >= 10</p>
7028 <p class="TextFontCX">Splint has simplified the constraint from the
7029 <span class="Annot"><span style=
7030 'font-size:10.0pt'>requires</span></span> clause to
7031 <span class="CodeText"><span style='font-size:10.0pt'>9 >=
7032 10</span></span> by substituting for the known value of
7033 <span class="Annot"><span style=
7034 'font-size:10.0pt'>maxSet(buf)</span></span> and generated a
7035 warning because 9(the highest index of <span class=
7036 "CodeText"><span style='font-size:10.0pt'>buf</span></span>
7037 that may be safely written to) is not greater than or equal
7039 <p class="TextFontCX"> </p>
7040 <p class="TextFontCX">A more realistic example is shown Figure
7041 21. The function <span class="CodeText"><span style=
7042 'font-size:10.0pt'>updateEnv</span></span> is a naïve
7043 implementation of a function to copy an environmental
7044 variable. There is no standard restriction on the length of
7045 the return value of <span class="CodeText"><span style=
7046 'font-size:10.0pt'>getenv</span></span> so this can cause a buffer
7047 overflow. A safe version of <span class=
7048 "CodeText"><span style='font-size:10.0pt'>updateEnv</span></span>
7049 (such as <span class="CodeText"><span style=
7050 'font-size:10.0pt'>updateEnvSafe</span></span> in Figure 21) would
7051 ensure that the buffer is large enough to hold the environment
7052 variable string before copying.</p>
7053 <p class="TextFontCX"> </p>
7054 <p class="TextFontCX"> </p>
7055 <p class="TextFontCX">The <span class="Annot"><span style=
7056 'font-size:10.0pt'>requires</span></span> clause means Splint will
7057 report a warning if a call to <span class=
7058 "CodeText"><span style='font-size:10.0pt'>updateEnvSafe</span></span>
7059 passed in a buffer as <span class="CodeText"><span style=
7060 'font-size:10.0pt'>str</span></span> that is not big enough
7061 to hold the value passed as <span class=
7062 "CodeText"><span style=
7063 'font-size:10.0pt'>strSize</span></span> characters.</p>
7064 <p class="TextFontCX"> </p>
7065 <p class="TextFontCX">In many cases, functions will have multiple
7066 unresolved constraints which are similar. For example, if a
7067 subsequence statement writes to the next element of a buffer.
7068 Usually all these constraints represent all real problems or are
7069 all spurious. If the <span class="Flag"><span style=
7070 'font-size:10.0pt'>+redundantconstraints</span></span> flag is set,
7071 Splint reports even apparently redundant warning messages.
7072 Otherwise, if satisfying one unresolved constraint would imply
7073 satisfying another, Splint only prints a warning message for the
7074 stronger constraint.</p>
7075 <p class="TextFontCX"> </p>
7077 <table class="MsoNormalTable" border="0" cellspacing="0"
7078 cellpadding="0" style='margin-left:9.9pt;border-collapse:collapse'>
7080 <td valign="top" style=
7081 'width:202.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>
7082 <p class="TextFontCX" align="center" style='text-align:center'>
7083 <span class="Keyword"><b><span style=
7084 'font-size:10.0pt; color:white'>bounds.c</span></b></span></p></td>
7085 <td valign="top" style=
7086 'width:3.0in;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>
7087 <p class="TextFontCX" align="center" style='text-align:center'>
7088 <b><span style='color:white'>Running
7089 Splint</span></b></p></td></tr>
7091 <td valign="top" style=
7092 'width:202.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
7093 <p class="Verbatim"><span style=
7094 'font-family:Courier'> </span></p>
7095 <p class="Verbatim"><span style='font-family:Courier'>void
7096 updateEnv(char * str)</span></p>
7097 <p class="Verbatim"><span style='font-family:Courier'>{</span></p>
7098 <p class="Verbatim"><span style='font-family:Courier'>
7099 char * tmp;</span></p>
7100 <p class="Verbatim"><i><span style=
7101 'font-size:9.0pt;font-family:Courier'>7</span></i><span style='font-family:Courier'>
7102 tmp = getenv(“MYENV”);</span></p>
7103 <p class="Verbatim"><span style='font-family:Courier'>
7104 if (tmp != NULL)</span></p>
7105 <p class="Verbatim"><i><span style=
7106 'font-size:9.0pt;font-family:Courier'>9</span></i><span style='font-family:Courier'>
7107 strcpy (str, tmp);</span></p>
7108 <p class="Verbatim"><span style='font-family:Courier'>}</span></p>
7109 <p class="Verbatim"><span style=
7110 'font-family:Courier'> </span></p>
7111 <p class="Verbatim"><span style='font-family:Courier'>void
7112 updateEnvSafe (char * str,</span></p>
7113 <p class="Verbatim"><span style=
7114 'font-family:Courier'>
7115 size_t strSize)</span></p>
7116 <p class="Verbatim"><span style='font-family:Courier'> </span>
7117 <a href="mailto:/*@requires"><span style=
7118 'font-family:Courier'>/*@requires</span></a> <span style=
7119 'font-family:Courier'>maxSet(str)</span></p>
7120 <p class="Verbatim"><span style=
7121 'font-family:Courier'>
7122 >= strSize –1@*/</span></p>
7123 <p class="Verbatim"><span style='font-family:Courier'>{</span></p>
7124 <p class="Verbatim"><span style='font-family:Courier'>
7125 char * tmp;</span></p>
7126 <p class="Verbatim"><span style='font-family:Courier'>
7127 tmp = getenv(“MYENV”);</span></p>
7128 <p class="Verbatim"><span style='font-family:Courier'>
7129 if (tmp != NULL)</span></p>
7130 <p class="Verbatim"><span style='font-family:Courier'>
7132 <p class="Verbatim"><span style=
7133 'font-family:Courier'> strncpy (str,
7135 <p class="Verbatim"><span style=
7136 'font-family:Courier'>
7137 strSize -1);</span></p>
7138 <p class="Verbatim"><span style=
7139 'font-family:Courier'> str[strSize
7140 -1] = ‘/0’;</span></p>
7141 <p class="Verbatim"><span style='font-family:Courier'>
7143 <p class="Verbatim"><span style=
7144 'font-family:Courier'>}</span></p></td>
7145 <td valign="top" style=
7146 'width:3.0in;border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
7147 <p class="lclintrun">> splint bounds.c +bounds
7148 +showconstraintlocation</p>
7149 <p class="lclintrun"> </p>
7150 <p class="lclintrun">bounds.c:9: Possible out-of-bounds store:</p>
7151 <p class="lclintrun"> strcpy(str, tmp)</p>
7152 <p class="lclintrun"> Unable to resolve
7154 <p class="lclintrun"> requires maxSet(str @
7155 bounds.c:9) >=</p>
7156 <p class="lclintrun"> maxRead(getenv("MYENV") @
7158 <p class="lclintrun"> needed to satisfy
7160 <p class="lclintrun"> requires maxSet(str @
7161 bounds.c:9) >=</p>
7162 <p class="lclintrun"> maxRead(tmp @
7164 <p class="lclintrun"> derived from strcpy
7165 precondition: requires</p>
7166 <p class="lclintrun"> maxSet(<parameter 1>)
7168 <p class="lclintrun"> maxRead(<parameter
7169 2>)</p></td></tr></table>
7170 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
7172 <td valign="top" style=
7173 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
7174 <p class="MsoCaption"><a name="_Ref534909813"></a><a name=
7175 "_Ref534909817">Figure 21</a>. Memory
7176 Bounds</p></td></tr></table></center>
7179 <p class="TextFontCX">The <span class="Flag"><span style=
7180 'font-size:10.0pt'>+functionpost</span></span> flag is useful for
7181 determining if array bounds warnings are spurious. If this
7182 flag is set, Splint will print the constraints that it established
7183 at the end of the function. If the warnings are spurious,
7184 localized control comments can be used to suppress them.</p>
7185 <p class="TextFontCX"> </p>
7186 <p class="TextFontCX"> </p>
7187 <p class="TextFontCX"> </p>
7188 <h1 style='margin-left:0in;text-indent:0in'><a name=
7189 "_Toc534975002"></a><a name="_Ref534642928"></a><a name=
7190 "_Ref534642285">10<span style=
7191 'font:7.0pt "Times New Roman"'> </span>
7192 <a id="extensible" name="extensible">
7193 Extensible Checking</a></a></h1>
7194 <p class="TextFontCX">Splint provides mechanisms for defining new
7195 checks and annotations using metastate definitions.
7196 User-defined checks can be used to check and document properties
7197 not supported by the provided checks.<a href="#_ftn13" name=
7198 "_ftnref13" title=""><span class=
7199 "MsoFootnoteReference"><span class="MsoFootnoteReference"><span style='font-size:11.0pt;font-family:"Times New Roman"'>
7200 [13]</span></span></span></a></p>
7201 <p class="TextFontCX"> </p>
7202 <p class="TextFontCX">A large class of useful checks can be
7203 described as constraints on attributes associated with program
7204 objects or the global execution state. Unlike types, however, the
7205 values of these attributes can change along an execution
7206 path. Splint provides a general language that lets users
7207 define attributes associated with different kinds of program
7208 objects as well as rules that both constrain attributes’
7209 values at interface points and specify how attributes
7211 <p class="TextFontCX"> </p>
7212 <p class="TextFontCX">Because user-defined attribute checking is
7213 integrated with normal checking, Splint’s analysis of
7214 user-defined attributes can take advantage of other analyses, such
7215 as alias and nullness analysis.</p>
7216 <h2 style='margin-left:0in;text-indent:0in'><a name=
7217 "_Toc534975003">10.1<span style=
7218 'font:7.0pt "Times New Roman"'> </span>
7219 Defining Attributes</a></h2>
7220 <p class="TextFontCX">To define an attribute, create a metastate
7221 file (<span class="ProgramNameChar"><span style=
7222 'font-size: 10.0pt'>.mts</span></span>) that defined the possible
7223 values and transfer rules of the attribute. Attributes can
7224 either be associated with a particular kind of program object (for
7225 example, all <span class="CodeText"><span style=
7226 'font-size:10.0pt'>char *</span></span>’s) or with the global
7227 state (whether or not the network has been initialized). The
7228 <span class="Flag"><span style='font-size:10.0pt'>–mts
7229 <i><file></i></span></span> flag is used to direct Splint to
7230 read a metastate file (which will be found on the
7231 <span class="CodeText"><span style=
7232 'font-size:10.0pt'>LARCH_PATH</span></span> with default
7233 extension <span class="ProgramNameChar"><span style=
7234 'font-size:10.0pt'>.mts</span></span>).</p>
7235 <p class="TextFontCX"> </p>
7236 <p class="TextFontCX">An example attribute definition is shown in
7237 Figure 22. It defines the <span class=
7238 "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
7239 attribute for recording whether or not a <span class=
7240 "CodeText"><span style='font-size: 10.0pt'>char
7241 *</span></span> came from a possibly untrustworthy
7242 source. Knowing whether a value is possibly hostile is
7243 useful for preventing several security vulnerabilities
7244 including format string bugs.<a href="#_ftn14" name=
7245 "_ftnref14" title=""><span class=
7246 "MsoFootnoteReference"><span class=
7247 "MsoFootnoteReference"><span style=
7248 'font-size:11.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>
7249 (A simpler way to detect format vulnerabilities is to warn
7250 for any format string that is unknown at compile time. Splint
7251 provides this checking, issuing a warning if the <span class=
7253 'font-size:10.0pt'>+formatconst</span></span> flag is set and
7254 finds any unknown format strings at compile time. This can
7255 produce spurious messages, however, because there might be
7256 unknown format strings that are not vulnerable to hostile
7258 <p class="TextFontCX"> </p>
7259 <p class="TextFontCX">The first three lines of the attribute
7260 definition define the <span class="Annot"><span style=
7261 'font-size:10.0pt'>taintedness</span></span> attribute associated
7262 with <span class="CodeText"><span style='font-size:10.0pt'>char
7263 *</span></span> objects, which can be in one of two states:
7264 <span class="Annot"><span style=
7265 'font-size:10.0pt'>untainted</span></span> or <span class=
7266 "Annot"><span style='font-size:10.0pt'>tainted</span></span>.
7267 The <span class="Annot"><span style=
7268 'font-size:10.0pt'>context</span></span> clause gives a context
7269 selector for which objects have the attribute. In this
7270 case, <span class="Annot"><span style='font-size:10.0pt'>reference
7271 char *</span></span> means that every reference that is a
7272 <span class="CodeText"><span style='font-size:10.0pt'>char
7273 *</span></span> has an associated <span class=
7274 "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
7275 attribute. Other contexts include <span class=
7276 "Annot"><span style=
7277 'font-size: 10.0pt'>parameter</span></span> (only parameter
7278 declarations), <span class="Annot"><span style=
7279 'font-size:10.0pt'>literal</span></span> (only string or
7280 number literals), and <span class="Annot"><span style=
7281 'font-size:10.0pt'>null</span></span> (only known
7282 <span class="CodeText"><span style=
7283 'font-size:10.0pt'>NULL</span></span> values).
7284 Attribute can also be defined that are not associated with
7285 any particular object, but instead are associated with the
7286 global state of a program execution. The <span class=
7287 "Annot"><span style='font-size:10.0pt'>global</span></span>
7288 keyword is used before <span class="Annot"><span style=
7289 'font-size:10.0pt'>attribute</span></span> to define a global
7291 <p class="TextFontCX"> </p>
7292 <p class="TextFontCX">The <span class="Annot"><span style=
7293 'font-size:10.0pt'>oneof</span></span> clause introduces two
7294 identifiers for representing the <span class=
7295 "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
7296 value: <span class="Annot"><span style=
7297 'font-size:10.0pt'>untainted</span></span> for references
7298 that are not derived from untrustworthy input, and
7299 <span class="Annot"><span style=
7300 'font-size:10.0pt'>tainted</span></span> for references that
7301 may contain hostile data. </p>
7302 <p class="TextFontCX"> </p>
7303 <p class="TextFontCX">The <span class="Annot"><span style=
7304 'font-size:10.0pt'>annotations</span></span> clause defines two new
7305 annotations that may be used to describe <span class=
7306 "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
7307 assumptions. In this case, the annotations match the names of
7308 the value choices, but they may be any identifier. The clause
7309 <span class="Annot"><span style='font-size:10.0pt'>tainted
7310 <b>reference ==></b> tainted</span></span> defines the
7311 <span class="Annot"><span style=
7312 'font-size:10.0pt'>tainted</span></span> annotation that may be
7313 used on a reference to indicate that it has <span class=
7314 "Annot"><span style='font-size: 10.0pt'>tainted</span></span>
7317 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
7319 <td valign="top" align="left" height="264" style=
7320 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
7321 <p class="Verbatim"><span class="Annot"><b>attribute</b></span>
7322 <span class="Annot">taintedness</span></p>
7323 <p class="Verbatim"><span class="Annot"> <b>context</b>
7324 <b>reference</b> char *</span></p>
7325 <p class="Verbatim"><span class="Annot"> <b>oneof</b>
7326 untainted, tainted</span></p>
7327 <p class="Verbatim"><span class="Annot">
7328 <b>annotations</b></span></p>
7329 <p class="Verbatim"><span class="Annot">
7330 tainted <b>reference ==></b> tainted</span></p>
7331 <p class="Verbatim"><span class="Annot">
7332 untainted <b>reference ==></b> untainted</span></p>
7333 <p class="Verbatim"><span class="Annot">
7334 <b>transfers</b></span></p>
7335 <p class="Verbatim"><span class="Annot">
7336 tainted <b>as</b> untainted <b>==> error</b> "Possibly tainted
7337 storage used where untainted required."</span></p>
7338 <p class="Verbatim"><span class="Annot">
7339 <b>merge</b></span></p>
7340 <p class="Verbatim"><span class=
7341 "Annot"> tainted <b>+</b> untainted
7342 <b>==></b> tainted</span></p>
7343 <p class="Verbatim"><span class="Annot">
7344 <b>defaults</b></span></p>
7345 <p class="Verbatim"><span class=
7346 "Annot"> reference <b>==></b>
7348 <p class="Verbatim"><span class="Annot">
7349 literal <b>==></b> untainted</span></p>
7350 <p class="Verbatim"><span class=
7351 "Annot"> null <b>==></b>
7352 untainted</span></p>
7353 <p class="Verbatim"><span class="Annot"><b>end</b></span></p>
7354 <p class="MsoCaption"><a name="_Ref534921559">Figure 22</a>.
7355 Taintedness Attribute</p></td></tr></table></center>
7358 <p class="TextFontCX"> </p>
7359 <p class="TextFontCX">The <span class="Annot"><span style=
7360 'font-size:10.0pt'>transfers</span></span> clause defines rules for
7361 state changes and warning when objects are passed as parameters,
7362 returned, or assigned to externally visible references. The
7363 rule, <span class="Annot"><span style='font-size:10.0pt'>tainted
7364 <b>as</b> untainted <b>==> error</b> "Possibly tainted storage
7365 used where untainted required."</span></span>, means it is an error
7366 to pass a <span class="Annot"><span style=
7367 'font-size:10.0pt'>tainted</span></span> value as a parameter that
7368 has <span class="Annot"><span style=
7369 'font-size:10.0pt'>untainted</span></span> taintedness. All
7370 other transfers are implicitly permitted, and leave the passed
7371 storage in the same state as before the transfer. We may also
7372 use a <span class="Annot"><span style=
7373 'font-size:10.0pt'>transfers</span></span> clause to indicate that
7374 the reference changes state after a transfer. A
7375 <span class="Annot"><span style=
7376 'font-size:10.0pt'>losereference</span></span> clause (not
7377 used in taintedness) is similar to a <span class=
7378 "Annot"><span style=
7379 'font-size:10.0pt'>transfers</span></span> clause, except it
7380 is used to provide rules for when a reference to storage is
7381 lost, either by leaving the scope in which it was declared,
7382 returning from a function, or assigning it to a new
7384 <p class="TextFontCX"> </p>
7385 <p class="TextFontCX">The <span class="Annot"><span style=
7386 'font-size:10.0pt'>merge</span></span> clause defined rules for
7387 combining state along paths. The clause<span class=
7388 "Annot"><span style='font-size:10.0pt'>merge tainted + untainted
7389 ==> tainted</span></span> indicates that combining
7390 <span class="Annot"><span style=
7391 'font-size:10.0pt'>tainted</span></span> and <span class=
7392 "Annot"><span style=
7393 'font-size:10.0pt'>untainted</span></span> objects produces a
7394 <span class="Annot"><span style=
7395 'font-size:10.0pt'>tainted</span></span> object. Thus, if a
7396 reference is <span class="Annot"><span style=
7397 'font-size:10.0pt'>tainted</span></span> along one control
7398 path and <span class="Annot"><span style=
7399 'font-size:10.0pt'>untainted</span></span> along another
7400 control path, checking assumes that it is <span class=
7401 "Annot"><span style=
7402 'font-size:10.0pt'>tainted</span></span>after the two
7403 branches merge. It is also used to merge taintedness states
7404 in function specifications (see the <span class=
7405 "CodeText"><span style=
7406 'font-size:10.0pt'>strcat</span></span> example in the next
7407 section). We can also define error combinations so that
7408 a warning is reported if the states on different paths are
7410 <p class="TextFontCX"> </p>
7411 <p class="TextFontCX">The <span class="Annot"><span style=
7412 'font-size:10.0pt'>defaults</span></span> clause specifies default
7413 values used for declarators without explicit attribute annotations.
7414 We choose default values to make it easy to start checking an
7415 unannotated program. Here we assume unannotated references are
7416 <span class="Annot"><span style=
7417 'font-size:10.0pt'>tainted</span></span> and Splint will report a
7418 warning where unannotated references are passed to functions that
7419 require untainted parameters. The warnings indicate either a format
7420 bug in the code or a place where an <span class=
7421 "Annot"><span style='font-size:10.0pt'>untainted</span></span>
7422 annotation should be added. Running Splint again after adding
7423 the annotation will propagate the newly documented assumption
7424 through the program.</p>
7425 <p class="TextFontCX"> </p>
7426 <p class="TextFontCX" style='margin-bottom:6.0pt'>The full grammar
7427 for metastate definitions is given in Appendix C.</p>
7428 <h2 style='margin-left:0in;text-indent:0in'><a name=
7429 "_Toc534975004">10.2<span style=
7430 'font:7.0pt "Times New Roman"'> </span>
7431 Annotations</a></h2>
7432 <p class="TextFontCX">The annotations defined by metastate
7433 definitions can be used like normal annotations. The context
7434 specifier for an annotation indicates where it may be used.
7435 For the taintedness example, we can use <span class=
7436 "Annot"><span style='font-size:10.0pt'>tainted</span></span> and
7437 <span class="Annot"><span style=
7438 'font-size:10.0pt'>untainted</span></span> as annotations wherever
7439 <span class="Annot"><span style=
7440 'font-size:10.0pt'>only</span></span> could be used. This
7441 includes <span class="Annot"><span style=
7442 'font-size:10.0pt'>ensures</span></span> and <span class=
7443 "Annot"><span style='font-size:10.0pt'>requires</span></span>
7444 clauses, which allows us to specify functions that modify state
7445 associated with metastate definitions. The syntax
7446 <span class="Annot"><i><span style=
7447 'font-size: 10.0pt'><expr></span></i></span><span class="Annot">
7449 'font-size: 10.0pt'>:<i><attribute></i></span></span> is used
7450 to refer to the value of the user-defined attribute for expression
7451 <span class="Annot"><i><span style=
7452 'font-size:10.0pt'><expr></span></i></span>. </p>
7453 <p class="TextFontCX"> </p>
7454 <p class="TextFontCX">It is often necessary to extend the library
7455 specifications with metastate annotations. We don’t
7456 want to have different versions of the library for different
7457 metastate annotations, so instead Splint provides a mechanism for
7458 adding annotations separately using an <span class=
7459 "ProgramNameChar"><span style='font-size:10.0pt'>.xh</span></span>
7460 file. For the taintedness example, we do this by providing
7461 annotated declarations in the <span class=
7462 "ProgramNameChar"><span style=
7463 'font-size:10.0pt'>tainted.xh</span></span> file. Example
7464 specifications in this file include:</p>
7465 <p class="TextFontCX"> </p>
7466 <p class="Verbatim">int printf (/*@untainted@*/ char *fmt,
7468 <p class="Verbatim"> </p>
7469 <p class="Verbatim">char *fgets (char *s, int n, FILE *stream)
7470 /*@ensures tainted s@*/ ;</p>
7471 <p class="Verbatim"> </p>
7472 <p class="Verbatim">char *strcat (/*@returned@*/ char *s1,
7474 <p class="Verbatim"> /*@ensures s1:taintedness =
7475 s1:taintedness | s2:taintedness @*/</p>
7476 <p class="TextFontCX"> </p>
7477 <p class="TextFontCX">The <span class="CodeText"><span style=
7478 'font-size:10.0pt'>strcat</span></span> specification uses
7479 <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
7480 s1:taintedness = s1:taintedness | s2:taintedness @*/</span></span>
7481 to indicate that the taintedness of <span class=
7482 "CodeText"><span style='font-size:10.0pt'>s1</span></span> after
7483 <span class="CodeText"><span style=
7484 'font-size:10.0pt'>strcat</span></span> returns is the result of
7485 merging the taintedness of <span class=
7486 "CodeText"><span style='font-size:10.0pt'>s1</span></span>
7487 and <span class="CodeText"><span style=
7488 'font-size:10.0pt'>s2</span></span> before the call.
7489 Because the parameters lack annotations, they are implicitly
7490 tainted according to the default rules and either untainted
7491 or tainted references can be passed as parameters to
7492 <span class="CodeText"><span style=
7493 'font-size:10.0pt'>strcat</span></span>. The <span class=
7494 "Annot"><span style='font-size:10.0pt'>ensures</span></span>
7495 clause means that after <span class="CodeText"><span style=
7496 'font-size:10.0pt'>strcat</span></span> returns the first
7497 parameter (and the result, because of the returned annotation
7498 on <span class="CodeText"><span style=
7499 'font-size:10.0pt'>s1</span></span>) will be tainted if
7500 either passed object was tainted. Splint merges the two
7501 taintedness states using the attribute definition
7502 rules—hence, if the <span class="CodeText"><span style=
7503 'font-size:10.0pt'>s1</span></span> parameter is untainted
7504 and the <span class="CodeText"><span style=
7505 'font-size:10.0pt'>s2</span></span> parameter is tainted, the
7506 result and first parameter will be tainted after <span class=
7507 "CodeText"><span style=
7508 'font-size:10.0pt'>strcat</span></span> returns.</p>
7509 <p class="TextFontCX"> </p>
7510 <h1 style='margin-left:0in;text-indent:0in'><a name=
7511 "_Toc534975006"></a><a name="_Ref534642895"></a><a name=
7512 "_Ref534642215">11<span style=
7513 'font:7.0pt "Times New Roman"'> </span>
7514 <a id="macros" name="macros">
7516 <p class="TextFontCX">Macros are commonly used in C programs to
7517 implement constants or to mimic functions without the overhead of a
7518 function call. Macros that are used to implement functions
7519 are a persistent source of bugs in C programs, since they may not
7520 behave like the intended function when they are invoked with
7521 certain parameters or used in certain syntactic contexts. </p>
7522 <p class="TextFontCX"> </p>
7523 <p class="TextFontCX">Splint eliminates most of the potential
7524 problems by detecting macros with dangerous implementations and
7525 dangerous macro invocations. Whether or not a macro
7526 definition is checked or expanded normally depends on flag settings
7527 and control comments (see Section 11.3). Stylized macros can
7528 also be used to define control structures for iterating through
7529 many values (see Section 11.4).</p>
7530 <h2 style='margin-left:0in;text-indent:0in'><a name=
7531 "_Toc534975007"></a><a name="_Ref361651263"></a><a name=
7532 "_Ref344916524"></a><a name="_Ref344908437"></a><a name=
7533 "_Toc344355419">11.1<span style=
7534 'font:7.0pt "Times New Roman"'> </span>
7535 Constant Macros</a></h2>
7536 <p class="TextFontCX">Macros may be used to implement
7537 constants. To get type-checking for constant macros, use the
7538 <span class="Annot"><span style=
7539 'font-size:10.0pt'>constant</span></span> annotation. For
7541 <p class="example">/*@constant null char *mstring_undefined@*/</p>
7542 <p class="TextFontCX">Declared constants are not expanded and are
7543 checked according to the declaration. A constant with a
7544 <span class="Annot"><span style=
7545 'font-size:10.0pt'>null</span></span> annotation may be used as
7546 <span class="Annot"><span style=
7547 'font-size:10.0pt'>only</span></span> storage.</p>
7548 <h2 style='margin-left:0in;text-indent:0in'><a name=
7549 "_Toc534975008"></a><a name="_Toc344355420"></a><a name=
7550 "_Ref343363760">11.2<span style=
7551 'font:7.0pt "Times New Roman"'> </span>
7552 Function-like Macros</a></h2>
7553 <p class="TextFontCX">Using macros to imitate functions is
7554 notoriously dangerous. Consider this broken macro for
7555 squaring a number:</p>
7556 <p class="example"># define square(x) x * x</p>
7557 <p class="TextFontCX">This works fine for a simple invocation like
7558 <span class="CodeText"><span style=
7559 'font-size:10.0pt'>square(i)</span></span>. It behaves
7560 unexpectedly, though, if it is instantiated with a parameter that
7561 has a side effect. For example, <span class=
7562 "CodeText"><span style=
7563 'font-size: 10.0pt'>square(i++)</span></span> expands to
7564 <span class="CodeText"><span style='font-size:10.0pt'>i++ *
7565 i++</span></span>. Not only does this give the incorrect
7566 result, it has undefined behavior since the order in which the
7567 operands are evaluated is not defined. (See Section 8.2 for
7568 more information on how expressions exhibiting undefined evaluation
7569 order behavior are detected by Splint.) To correct the
7570 problem we either need to rewrite the macro so that its parameter
7571 is evaluated exactly once, or prevent clients from invoking the
7572 macro with a parameter that has a side effect. </p>
7573 <p class="TextFontCX"> </p>
7574 <p class="TextFontCX">Another possible problem with macros is that
7575 they may produce unexpected results because of operator precedence
7576 rules. The instantiation, <span class=
7577 "CodeText"><span style='font-size:10.0pt'>square(i+1)</span></span>
7578 expands to <span class="CodeText"><span style=
7579 'font-size:10.0pt'>i+1*i+1</span></span>, which evaluates to
7580 <span class="CodeText"><span style=
7581 'font-size:10.0pt'>i+i+1</span></span> instead of the square
7582 of <span class="CodeText"><span style=
7583 'font-size:10.0pt'>i+1</span></span>. To ensure the
7584 expected behavior, the macro parameter should be enclosed in
7585 parentheses where it is used in the macro body.</p>
7586 <p class="TextFontCX"> </p>
7587 <p class="TextFontCX">Macros may also behave unexpectedly if they
7588 are not syntactically equivalent to an expression. Consider
7589 the macro definition,</p>
7590 <p class="example"># define incCounts() ntotal++;
7592 <p class="TextFontCX">This works fine, unless it is used as a
7593 statement. For example,</p>
7594 <p class="example">if (x < 3) incCounts();</p>
7595 <p class="TextFontCX">increments <span class=
7596 "CodeText"><span style='font-size:10.0pt'>ntotal</span></span>
7597 if <span class="CodeText"><span style='font-size:10.0pt'>x
7598 < 3</span></span> but always increments <span class=
7599 "CodeText"><span style=
7600 'font-size:10.0pt'>ncurrent</span></span>.</p>
7601 <p class="TextFontCX"> </p>
7602 <p class="TextFontCX">One solution is to use the comma operator to
7603 define the macro:</p>
7604 <p class="example"># define incCounts() (ntotal++,
7606 <p class="beforelist">More complicated macros can be written using
7607 a <span class="CodeText"><span style='font-size:10.0pt'>do …
7608 while</span></span> construction:</p>
7609 <p class="Verbatim"> # define incCounts() \</p>
7610 <p class="Verbatim"> do { ntotal++;
7611 ncurrent++; } while (FALSE)</p>
7612 <p class="afterlist">Splint detects these pitfalls in macro
7613 definitions, and checks that a macro behaves as much like a
7614 function as possible. A client should only be able to tell
7615 that a function was implemented by a macro if it attempts to use
7616 the macro as a pointer to a function.</p>
7617 <p class="MsoListBullet"> </p>
7618 <p class="beforelist">Splint does these checks on a macro
7619 definition corresponding to a function:</p>
7620 <p class="MsoListBullet"><span style=
7621 'font-family:Symbol'>·<span style=
7622 'font:7.0pt "Times New Roman"'> </span></span>
7623 Each parameter to a macro (except those declared to be side effect
7624 free, see Section 11.2.1) must be used exactly once in all possible
7625 executions of the macro, so side effecting arguments behave as
7626 expected.<a href="#_ftn15" name="_ftnref15" title=
7627 ""><span class="MsoFootnoteReference"><span class=
7628 "MsoFootnoteReference"><span style=
7629 'font-size:11.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>
7630 (Controlled by <span class="Flag"><span style=
7631 'font-size:10.0pt'>macroparams</span></span>.)</p>
7632 <p class="MsoListBullet"><span style=
7633 'font-family:Symbol'>·<span style=
7634 'font:7.0pt "Times New Roman"'> </span></span>
7635 A parameter to a macro may not be used as the left-hand side of an
7636 assignment expression or as the operand of an increment or
7637 decrement operator in the macro text, since this produces
7638 non-functional behavior. (Controlled by <span class=
7640 'font-size:10.0pt'>macroassign</span></span>.)</p>
7641 <p class="MsoListBullet"><span style=
7642 'font-family:Symbol'>·<span style=
7643 'font:7.0pt "Times New Roman"'> </span></span>
7644 Macro parameters must be enclosed in parentheses when they are used
7645 in potentially dangerous contexts. (Controlled by
7646 <span class="Flag"><span style=
7647 'font-size: 10.0pt'>macroparens</span></span>.)</p>
7648 <p class="MsoListBullet"><span style=
7649 'font-family:Symbol'>·<span style=
7650 'font:7.0pt "Times New Roman"'> </span></span>
7651 A macro definition must be syntactically equivalent to a statement
7652 when it is invoked followed by a semicolon. (Controlled by
7653 <span class="Flag"><span style=
7654 'font-size:10.0pt'>macrostmt</span></span>.)</p>
7655 <p class="MsoListBullet"><span style=
7656 'font-family:Symbol'>·<span style=
7657 'font:7.0pt "Times New Roman"'> </span></span>
7658 The type of the macro body must match the return type of the
7659 corresponding function. If the macro is declared with type
7660 <span class="CodeText"><span style=
7661 'font-size:10.0pt'>void</span></span>, its body may have any type
7662 but the macro value may not be used.</p>
7663 <p class="MsoListBullet"><span style=
7664 'font-family:Symbol'>·<span style=
7665 'font:7.0pt "Times New Roman"'> </span></span>
7666 All variables declared in the body of a macro definition must be in
7667 the macro variable namespace, so they do not conflict with
7668 variables in the scope where the macro is invoked (which may be
7669 used in the macro parameters). By default, the macro
7670 namespace is all names prefixed by <span class=
7671 "CodeText"><span style='font-size:10.0pt'>m_</span></span>.
7672 (See Section 12.2 for information on controlling namespaces.)</p>
7673 <p class="afterlist">At the call site, a macro is checked like any
7674 other function call.</p>
7675 <h3 style='margin-left:0in;text-indent:0in'><a name=
7676 "_Toc534975009"></a><a name="_Toc344355421"></a><a name=
7677 "_Ref343109609">11.2.1<span style=
7678 'font:7.0pt "Times New Roman"'> </span> Side
7679 Effect Free Parameters</a></h3>
7680 <p class="beforelist">Suppose we really do want to implement
7681 <span class="CodeText"><span style=
7682 'font-size:10.0pt'>square</span></span> as a macro, but want do so
7683 in a safe way. One way to do this is to require that it is
7684 never invoked with a parameter that has a side effect. Splint
7685 will check that this constraint holds, if the parameter is
7686 annotated to be side effect free. That is, the expression
7687 corresponding to this parameter must not modify any state, so it
7688 does not matter how many times it is evaluated. The
7689 <span class="Annot"><span style=
7690 'font-size:10.0pt'>sef</span></span> annotation is used to denote a
7691 parameter that may not have any side effects:</p>
7692 <p class="Verbatim"><span style='font-size:9.5pt'>
7693 extern int square (/*@sef@*/ int x);</span></p>
7694 <p class="Verbatim"><span style='font-size:9.5pt'> #
7695 define square(x) ((x) *(x))</span></p>
7696 <p class="afterlist">Now, Splint will not report an error checking
7697 the definition of <span class="CodeText"><span style=
7698 'font-size:10.0pt'>square</span></span> even though
7699 <span class="CodeText"><span style=
7700 'font-size:10.0pt'>x</span></span> is used more than
7702 <p class="TextFontCX"> </p>
7703 <p class="TextFontCX">A message will be reported, however, if
7704 <span class="CodeText"><span style=
7705 'font-size:10.0pt'>square</span></span> is invoked with a parameter
7706 that has a side effect. For the code fragment,</p>
7707 <p class="example">square (i++)</p>
7708 <p class="beforelist">Splint produces the message:</p>
7709 <p class="Verbatim"> <span style=
7710 'font-family:Arial'>Parameter 1 to square is declared sef,</span>
7711 <span style='font-family:Arial'>but the argument may modify:
7713 <p class="betweenlists">It is also an error to pass a macro
7714 parameter that is not annotated with <span class=
7715 "Annot"><span style='font-size:10.0pt'>sef</span></span> as a
7716 <span class="Annot"><span style=
7717 'font-size:10.0pt'>sef</span></span> macro parameter in the body of
7718 a macro definition. For example,</p>
7719 <p class="Verbatim"><span style='font-size:9.5pt'>
7720 extern int sumsquares (int x, int y);</span></p>
7721 <p class="Verbatim"><span style='font-size:9.5pt'> #
7722 define sumsquares(x,y) (square(x) + square(y))</span></p>
7723 <p class="afterlist">Although <span class=
7724 "CodeText"><span style='font-size:10.0pt'>x</span></span>
7725 only appears once in the definition of <span class=
7726 "CodeText"><span style=
7727 'font-size:10.0pt'>sumsquares</span></span> it will be
7728 evaluated twice since <span class="CodeText"><span style=
7729 'font-size:10.0pt'>square</span></span> is expanded.</p>
7730 <p class="TextFontCX"> </p>
7731 <p class="TextFontCX">A parameter may be passed as a
7732 <span class="Annot"><span style=
7733 'font-size:10.0pt'>sef</span></span> parameter without an
7734 error being reported, if Splint can determine that evaluating
7735 the parameter has no side effects. For function calls,
7736 the modifies clause is used to determine if a side effect is
7737 possible.<a href="#_ftn16" name="_ftnref16" title=
7738 ""><span class="MsoFootnoteReference"><span class=
7739 "MsoFootnoteReference"><span style=
7740 'font-size:11.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>
7741 To prevent many spurious errors, if the called function has
7742 no modifies clause, Splint will report an error only if
7743 <span class="Flag"><span style=
7744 'font-size: 10.0pt'>sef-uncon</span></span> is on.
7745 Justifiably paranoid programmers will insist on setting
7746 <span class="Flag"><span style=
7747 'font-size:10.0pt'>sef-uncon</span></span> on, and will add
7748 modifies clauses to unconstrained functions that are used in
7749 <span class="Annot"><span style=
7750 'font-size:10.0pt'>sef</span></span> macro arguments.</p>
7751 <p class="TextFontCX"> </p>
7752 <p class="beforelist">One common application of macros is to get
7753 around the lack of polymorphism in C. We can use the
7754 <span class="Annot"><span style='font-size: 10.0pt'>/*@alt
7755 <type>,<sup>+</sup>@></span></span> syntax (see
7756 Section 4.4) to indicate that an alternate type may be used.
7758 <p class="Verbatim"><span style='font-size:9.5pt'> extern int
7759 /*@alt float@*/ square (/*@sef@*/ int /*@alt float@*/
7761 <p class="Verbatim"><span style='font-size:9.5pt'> # define
7762 square(x) ((x) *(x))</span></p>
7763 <p class="afterlist">declares <span class=
7764 "CodeText"><span style='font-size:10.0pt'>square</span></span>
7765 for both <span class="CodeText"><span style=
7766 'font-size:10.0pt'>int</span></span>s and <span class=
7767 "CodeText"><span style=
7768 'font-size:10.0pt'>float</span></span>s. Note however,
7769 that the return type is either <span class=
7770 "CodeText"><span style='font-size:10.0pt'>int</span></span>
7771 or <span class="CodeText"><span style=
7772 'font-size:10.0pt'>float</span></span>, regardless of the
7773 actual parameter type. This is weaker than what is
7774 actually known about the return type.</p>
7775 <h2 style='margin-left:0in;text-indent:0in'><a name=
7776 "_Toc534975010"></a><a name="_Ref347227227">11.3<span style=
7777 'font:7.0pt "Times New Roman"'> </span>
7778 Controlling Macro Checking</a></h2>
7779 <p class="TextFontCX">By default, Splint expands macros normally
7780 and checks the resulting code after macros have been
7781 expanded. Flags and control comments may be used to control
7782 which macros are expanded and which are checked as functions or
7784 <p class="TextFontCX"> </p>
7785 <p class="TextFontCX">If the <span class="Flag"><span style=
7786 'font-size:10.0pt'>fcn-macros</span></span> flag is on, Splint
7787 assumes all macros defined with parameter lists implement functions
7788 and checks them accordingly. Parameterized macros are not
7789 expanded and are checked as functions with unknown result and
7790 parameter types (or using the types in the prototype, if one is
7791 given). The analogous flag for macros that define constants
7792 is <span class="Flag"><span style=
7793 'font-size:10.0pt'>const-macros</span></span>. If it is on,
7794 macros with no parameter lists are assumed to be constants, and
7795 checked accordingly. The <span class=
7796 "Flag"><span style='font-size:10.0pt'>all-macros</span></span>
7797 flag sets both <span class="Flag"><span style=
7798 'font-size:10.0pt'>fcn-macros</span></span> and <span class=
7800 'font-size:10.0pt'>const-macros</span></span>. If the
7801 <span class="Flag"><span style=
7802 'font-size:10.0pt'>macro-fcn-decl</span></span> flag is
7803 set, a message reports parameterized macros with no
7804 corresponding function prototype. If the <span class=
7806 'font-size:10.0pt'>macro-const-decl</span></span> flag
7807 is set, a similar message reports macros with no parameters
7808 that have no corresponding constant declaration.</p>
7809 <p class="TextFontCX"> </p>
7810 <p class="beforelist">The macro checks described in the previous
7811 sections make sense only for macros that are intended to replace
7812 functions or constants. When <span class=
7813 "Flag"><span style='font-size:10.0pt'>fcnmacros</span></span>
7814 or <span class="Flag"><span style=
7815 'font-size:10.0pt'>constmacros</span></span> is on, more
7816 general macros need to be marked so they will not be checked
7817 as functions or constants, and will be expanded
7818 normally. Macros that are not meant to behave like
7819 functions should be preceded by the /<span class=
7820 "Annot"><span style=
7821 'font-size:10.0pt'>*@notfunction@*/</span></span>comment.
7823 <p class="Verbatim"><span style='font-size:9.5pt'>
7824 /*@notfunction@*/</span></p>
7825 <p class="Verbatim"><span style='font-size:9.5pt'> #
7826 define forever for(;;)</span></p>
7827 <p class="afterlist">Macros preceded by <span class=
7828 "Annot"><span style='font-size: 10.0pt'>notfunction</span></span>
7829 are expanded normally before regular checking is done. If a
7830 macro that is not syntactically equivalent to a statement without a
7831 semi-colon (e.g., a macro which enters a new scope) is not preceded
7832 by <span class="Annot"><span style=
7833 'font-size:10.0pt'>notfunction</span></span>, parse errors may
7834 result when <span class="Flag"><span style=
7835 'font-size:10.0pt'>fcn-macros</span></span> or
7836 <span class="Flag"><span style=
7837 'font-size:10.0pt'>const-macros</span></span> is on.</p>
7838 <h2 style='margin-left:0in;text-indent:0in'><a name=
7839 "_Ref345771875"></a><a name="_Ref345489124"></a><a name=
7840 "_Toc344355423"></a><a name="_Toc534975011"></a><a name=
7841 "_Ref361651257"></a><a name="_Ref349897909"></a><a name=
7842 "_Ref344916532"></a><a name="_Ref344908410"></a><a name=
7843 "_Toc344355424">11.4<span style=
7844 'font:7.0pt "Times New Roman"'> </span>
7846 <p class="TextFontCX">It is often useful to be able to execute the
7847 same code for many different values. For example, we may want
7848 to sum all elements in an <span class="CodeText"><span style=
7849 'font-size:10.0pt'>intSet</span></span> that represents a set of
7850 integers. If <span class="CodeText"><span style=
7851 'font-size:10.0pt'>intSet</span></span> is an abstract type, there
7852 is no easy way of doing this in a client module without depending
7853 on the concrete representation of the type. Instead, we could
7854 provide such a mechanism as part of the type’s
7855 implementation. We call a mechanism for looping through many
7856 values an <i>iterator</i>.</p>
7857 <p class="TextFontCX"> </p>
7858 <p class="TextFontCX">The C language provides no mechanism for
7859 creating user-defined iterators. Splint supports a stylized
7860 form of iterators declared using syntactic comments and defined
7862 <p class="TextFontCX"> </p>
7863 <p class="TextFontCX">Iterator declarations are similar to function
7864 declarations except instead of returning a value, they assign
7865 values to their <span class="Annot"><span style=
7866 'font-size:10.0pt'>yield</span></span> parameters in each
7867 iteration. For example, we could add this iterator
7868 declaration to <span class="Keyword"><span style=
7869 'font-size:10.0pt;font-family: Arial;color:windowtext'>intSet.h</span></span>:</p>
7870 <p class="example">/*@iter intSet_elements (intSet s, yield int
7872 <p class="TextFontCX">The <span class="Annot"><span style=
7873 'font-size:10.0pt'>yield</span></span> annotation means that the
7874 variable passed as the second actual argument is declared as a
7875 local variable of type <span class="CodeText"><span style=
7876 'font-size:10.0pt'>int</span></span> and assigned a value in each
7878 <h3 style='margin-left:0in;text-indent:0in'><a name=
7879 "_Toc534975012">11.4.1<span style=
7880 'font:7.0pt "Times New Roman"'> </span> Defining
7882 <p class="beforelist">An iterator is defined using a macro.
7883 Here’s one (not particularly efficient) way of defining
7884 <span class="CodeText"><span style=
7885 'font-size:10.0pt'>intSet_elements</span></span>:</p>
7886 <p class="Verbatim"> typedef /*@abstract@*/ struct
7888 <p class="Verbatim"> int
7890 <p class="Verbatim"> int
7892 <p class="Verbatim"> } intSet;</p>
7893 <p class="Verbatim"> …</p>
7894 <p class="Verbatim"> # define intSet_elements(s,m_el)
7896 <p class="Verbatim"> { int m_i; \</p>
7897 <p class="Verbatim"> for (m_i =
7898 (0); m_i <= ((s)->nelements); m_i++) { \</p>
7899 <p class="Verbatim">
7900 int
7901 m_el = (s)->elements[(m_i)];</p>
7902 <p class="Verbatim"> </p>
7903 <p class="Verbatim"> # define end_intSet_elements
7905 <p class="afterlist">Each time through the loop, the yield
7906 parameter <span class="CodeText"><span style=
7907 'font-size:10.0pt'>m_el</span></span> is assigned to the next
7908 value. After each value has been assigned to
7909 <span class="CodeText"><span style=
7910 'font-size:10.0pt'>m_el</span></span> for one iteration, the
7911 loop terminates. Variables declared by the iterator
7912 macro (including the <span class="Annot"><span style=
7913 'font-size:10.0pt'>yield</span></span> parameter) are
7914 preceded by the macro variable namespace prefix <span class=
7915 "CodeText"><span style='font-size:10.0pt'>m_</span></span>
7916 (see Section 11.2) to avoid conflicts with variables defined
7917 in the scope where the iterator is used.</p>
7918 <h3 style='margin-left:0in;text-indent:0in'><a name=
7919 "_Toc534975013">11.4.2<span style=
7920 'font:7.0pt "Times New Roman"'> </span> Using
7922 <p class="TextFontCX">The general structure for using an iterator
7924 <p class="example"><i>iter</i> (<i><params></i>) stmt;
7926 <p class="beforelist">For example, a client could use
7927 <span class="CodeText"><span style=
7928 'font-size:10.0pt'>intSet_elements</span></span> to sum the
7929 elements of an <span class="CodeText"><span style=
7930 'font-size:10.0pt'>intSet</span></span>:</p>
7931 <p class="Verbatim"> intSet s;</p>
7932 <p class="Verbatim"> int sum = 0;</p>
7933 <p class="Verbatim"> ...</p>
7934 <p class="Verbatim"> intSet_elements (s, el) {</p>
7935 <p class="Verbatim" style='text-indent:.5in'>sum += el;</p>
7936 <p class="Verbatim"> } end_intSet_elements;</p>
7937 <p class="afterlist">The actual parameter corresponding to a yield
7938 parameter, <span class="CodeText"><span style=
7939 'font-size:10.0pt'>el</span></span>, is not declared in the
7940 function scope. Instead, it is declared by the iterator and
7941 assigned to an appropriate value for each iteration.</p>
7942 <p class="TextFontCX"> </p>
7943 <p class="beforelist">Splint will do the following checks for uses
7944 of stylized iterators:</p>
7945 <p class="MsoListBullet"><span style=
7946 'font-family:Symbol'>·<span style=
7947 'font:7.0pt "Times New Roman"'> </span></span>
7948 An invocation of the iterator <span class=
7949 "CodeText"><i><span style='font-size:10.0pt'>iter</span></i></span>
7950 must be balanced by a corresponding end, named <span class=
7951 "CodeText"><span style=
7952 'font-size:10.0pt'>end_<i>iter</i></span></span>.</p>
7953 <p class="MsoListBullet"><span style=
7954 'font-family:Symbol'>·<span style=
7955 'font:7.0pt "Times New Roman"'> </span></span>
7956 All actual parameters must be defined, except those corresponding
7957 to yield parameters.</p>
7958 <p class="MsoListBullet"><span style=
7959 'font-family:Symbol'>·<span style=
7960 'font:7.0pt "Times New Roman"'> </span></span>
7961 Yield parameters must be new identifiers, not declared in the
7962 current scope or any enclosing scope.</p>
7963 <p class="afterlist">Iterators are a bit awkward to implement, but
7964 they enable compact, easily understood client code. For
7965 abstract collection types, an iterator can be used to enable
7966 clients to operate on elements of the collection without breaking
7967 data abstraction.<a name="_Ref348845281"></a><a name=
7968 "_Toc344355425"></a><a name="_Ref343247905"></a></p>
7969 <h1 style='margin-left:0in;text-indent:0in'><a name=
7970 "_Toc534975014"></a><a name="_Ref483663681"></a><a name=
7971 "_Ref350065611">12<span style=
7972 'font:7.0pt "Times New Roman"'> </span>
7973 <a id="naming" name="naming">
7974 Naming Conventions</a></a></h1>
7975 <p class="TextFontCX">Naming conventions tend to be a religious
7976 issue. Generally, it doesn't matter too much what naming convention
7977 is followed as long as one is chosen and followed
7978 religiously. There are two kinds of naming conventions
7979 supported by Splint. Type-based naming conventions (Section
7980 12.1) constrain identifier names according to the abstract
7981 types that are accessible where the identifier is
7982 defined. Prefix naming conventions (Section 12.2) constrain
7983 the initial characters of identifier names according to what is
7984 being declared and its scope. Naming conventions may be
7985 combined or different conventions may be selected for different
7986 kinds of identifiers. In addition, Splint supports checking
7987 that names do not conflict with names reserved for the standard
7988 library or implementation (Section 12.3) and are sufficiently
7989 distinguishable from other names.</p>
7990 <h2 style='margin-left:0in;text-indent:0in'><a name=
7991 "_Toc534975015"></a><a name="_Ref348079373"></a><a name=
7992 "_Ref347240654"></a><a name="_Toc344355426">12.1<span style=
7993 'font:7.0pt "Times New Roman"'> </span>
7994 Type-Based Naming Conventions</a></h2>
7995 <p class="TextFontCX">Generic naming conventions constrain valid
7996 names of identifiers. By limiting valid names, namespaces may
7997 be preserved and programs may be more easily understood since the
7998 name gives clues as to how and where the name is defined and how it
8000 <p class="TextFontCX"> </p>
8001 <p class="TextFontCX">Names may be constrained by the scope of the
8002 name (external, file static, internal), the file in which the
8003 identifier is defined, the type of the identifier, and global
8005 <h3 style='margin-left:0in;text-indent:0in'><a name=
8006 "_Toc534975016"></a><a name=
8007 "_Ref347994687">12.1.1<span style='font:7.0pt "Times New Roman"'> </span>
8008 Czech Names</a></h3>
8009 <p class="TextFontCX">Czech<a href="#_ftn17" name="_ftnref17"
8010 title=""><span class="MsoFootnoteReference"><span class=
8011 "MsoFootnoteReference"><span style=
8012 'font-size:11.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>
8013 names denote operations and variables of abstract types by
8014 preceding the names by <span class="CodeText"><i><span style=
8015 'font-size:10.0pt'><type></span></i></span><span class=
8016 "CodeText"><span style='font-size:10.0pt'>_</span></span>.
8017 The remainder of the name should begin with a lowercase
8018 character, but may use any other character besides the
8019 underscore. Types may be named using any non-underscore
8021 <p class="TextFontCX"> </p>
8022 <p class="TextFontCX" style='margin-bottom:6.0pt'>The Czech naming
8023 convention is selected by the <span class="Flag"><span style=
8024 'font-size:10.0pt'>czech</span></span> flag. If
8025 <span class="Flag"><span style=
8026 'font-size:10.0pt'>access-czech</span></span> is on, a function,
8027 variable, constant or iterator named <span class=
8028 "CodeText"><i><span style=
8029 'font-size:10.0pt'><type></span></i></span><span class=
8030 "CodeText"><span style=
8031 'font-size:10.0pt'>_<i><name></i></span></span> has access to
8032 the abstract type <span class="CodeText"><i><span style=
8033 'font-size:10.0pt'><type></span></i></span>. Reporting
8034 of violations of the Czech naming convention is controlled by
8035 different flags depending on what is being declared:</p>
8036 <p class="TextFontCX"><span class="Flag"><span style=
8037 'font-size:10.0pt'>czech-fcns</span></span></p>
8038 <p class="TextFontCX" style='margin-left:13.5pt'>Functions and
8039 iterators. An error is reported for a function name of the
8040 form <span class="CodeText"><i><span style=
8041 'font-size:10.0pt'><prefix></span></i></span><span class="CodeText">
8042 <span style='font-size:10.0pt'>_<i><name></i></span></span>
8043 where <span class="CodeText"><i><span style=
8044 'font-size:10.0pt'><prefix></span></i></span> is not the name
8045 of an accessible type. Note that if <span class=
8046 "Flag"><span style='font-size:10.0pt'>accessczech</span></span> is
8047 on, a type named <span class="CodeText"><i><span style=
8048 'font-size:10.0pt'><prefix></span></i></span> would be
8049 accessible in a function beginning with <span class=
8050 "CodeText"><i><span style=
8051 'font-size:10.0pt'><prefix></span></i></span><span class="CodeText">
8052 <span style='font-size:10.0pt'>_</span></span>. If
8053 <span class="Flag"><span style=
8054 'font-size:10.0pt'>access-czech</span></span> is off, an error is
8055 reported instead. An error is reported for a function name
8056 that does not have an underscore if any abstract types are
8057 accessible where the function is defined.</p>
8058 <p class="TextFontCX"><span class="Flag"><span style=
8059 'font-size:10.0pt'>czech-vars</span></span></p>
8060 <p class="TextFontCX"><span class="Flag"><span style=
8061 'font-size:10.0pt'>czech-constants</span></span></p>
8062 <p class="TextFontCX"><span class="Flag"><span style=
8063 'font-size:10.0pt'>czech-macros</span></span></p>
8064 <p class="IndentText">Variables, constants and expanded macros.
8065 An error is reported if the identifier name starts with
8066 <span class="CodeText"><i><span style=
8067 'font-size:10.0pt'><prefix></span></i></span><span class="CodeText">
8068 <span style='font-size:10.0pt'>_</span></span>and
8069 <span class="CodeText"><i><span style=
8070 'font-size:10.0pt'>prefix</span></i></span> is not the name
8071 of an accessible abstract type, or if an abstract type is
8072 accessible and the identifier name does not begin with
8073 <span class="CodeText"><i><span style=
8074 'font-size:10.0pt'><type></span></i></span><span class=
8075 "CodeText"><span style='font-size:10.0pt'>_</span></span>
8076 where <span class="CodeText"><i><span style=
8077 'font-size:10.0pt'>type</span></i></span> is the name of an
8078 accessible abstract type. If <span class=
8080 'font-size:10.0pt'>access-czech</span></span> is on, the
8081 representation of the type is visible in the constant or
8082 variable definition.</p>
8083 <p class="TextFontCX"><span class="Flag"><span style=
8084 'font-size:10.0pt'>czech-types</span></span></p>
8085 <p class="TextFontCX" style='margin-left:13.5pt'>User-defined
8086 types. An error is reported if a type name includes an
8087 underscore character.</p>
8088 <p class="Sidebar" align="right">Of course, this is a complete
8089 jumble to the uninitiated, and that’s the joke.</p>
8090 <p class="Sidebar" align="right" style='text-align:right'>
8091 <i>Charles Simonyi, on the Hungarian naming convention</i></p>
8092 <h3 style='margin-left:0in;text-indent:0in'><a name=
8093 "_Toc534975017"></a><a name=
8094 "_Ref344878566">12.1.2<span style='font:7.0pt "Times New Roman"'> </span>
8095 Slovak Names</a></h3>
8096 <p class="TextFontCX">Slovak names are similar to Czech names,
8097 except they are spelled differently. A Slovak name is of the
8098 form <span class="CodeText"><i><span style=
8099 'font-size:10.0pt'><type><Name></span></i></span>.
8100 The type prefix may not use uppercase characters. The
8101 remainder of the name starts with the first uppercase
8103 <p class="TextFontCX"> </p>
8104 <p class="TextFontCX">The <span class="Flag"><span style=
8105 'font-size:10.0pt'>slovak</span></span> flag selects the
8106 Slovak naming convention. Like Czech names, it may be used
8107 with <span class="Flag"><span style=
8108 'font-size:10.0pt'>access-slovak</span></span> to control
8109 access to abstract representations. The <span class=
8110 "Flag"><span style='font-size:10.0pt'>slovak-fcns</span></span>,
8111 <span class="Flag"><span style=
8112 'font-size:10.0pt'>slovak-vars</span></span>, <span class=
8114 'font-size:10.0pt'>slovak-constants</span></span>, and
8115 <span class="Flag"><span style=
8116 'font-size:10.0pt'>slovak-macros</span></span> flags are
8117 analogous to the similar Czech flags. If <span class=
8119 'font-size:10.0pt'>slovak-type</span></span> is on, an error
8120 is reported if a type name includes an uppercase letter.</p>
8121 <h3 style='margin-left:0in;text-indent:0in'><a name=
8122 "_Toc534975018"></a><a name=
8123 "_Ref347994743">12.1.3<span style='font:7.0pt "Times New Roman"'> </span>
8124 Czechoslovak Names</a></h3>
8125 <p class="TextFontCX">Czechoslovak names are a combination of Czech
8126 names and Slovak names. Operations may be named either
8127 <span class="CodeText"><i><span style=
8128 'font-size:10.0pt'><type></span></i></span><span class=
8129 "CodeText"><span style='font-size:10.0pt'>_</span></span> followed
8130 by any sequence of non-underscore characters, or <span class=
8131 "CodeText"><i><span style=
8132 'font-size:10.0pt'><type></span></i></span> followed by an
8133 uppercase letter and any sequence of characters. Czechoslovak
8134 names have been out of favor since 1993, but may be necessary for
8135 checking legacy code. The <span class="Flag"><span style=
8136 'font-size:10.0pt'>czechoslovak-fcns</span></span>,
8137 <span class="Flag"><span style=
8138 'font-size:10.0pt'>czechoslovak-vars</span></span>,
8139 <span class="Flag"><span style=
8140 'font-size:10.0pt'>czechoslovak-macros</span></span>, and
8141 <span class="Flag"><span style=
8142 'font-size:10.0pt'>czechoslovak-constants</span></span>
8143 flags are analogous to the similar Czech flags. If
8144 <span class="Flag"><span style=
8145 'font-size:10.0pt'>czechoslovak-type</span></span> is
8146 on, an error is reported if a type name contains either an
8147 uppercase letter or an underscore character.</p>
8148 <h2 style='margin-left:0in;text-indent:0in'><a name=
8149 "_Toc534975019"></a><a name="_Ref347240687"></a><a name=
8150 "_Ref347222192">12.2<span style=
8151 'font:7.0pt "Times New Roman"'> </span>
8152 Namespace Prefixes</a></h2>
8153 <p class="TextFontCX">Another way to restrict names is to constrain
8154 the leading character sequences of various kinds of
8155 identifiers. For example, the names of all user-defined types
8156 might begin with <span class="CodeText"><span style=
8157 'font-size:10.0pt'>T</span></span> followed by an uppercase letter
8158 and all file static names begin with an uppercase letter.
8159 This may be useful for enforcing a namespace (e.g., all names
8160 exported by the X-windows library should begin with
8161 <span class="CodeText"><span style=
8162 'font-size:10.0pt'>X</span></span>) or just making programs
8163 easier to understand by establishing an enforced
8164 convention. Splint can be used to constrain identifiers
8165 in this way to detect identifiers inconsistent with
8167 <p class="TextFontCX"> </p>
8168 <p class="TextFontCX">All namespace flags are of the form,
8169 <span class="Flag"><span style=
8170 'font-size:10.0pt'>-<i><context></i>prefix
8171 <i><string></i></span></span>. For example, the macro
8172 variable namespace restricting identifiers declared in macro bodies
8173 to be preceded by <span class="CodeText"><span style=
8174 'font-size:10.0pt'>m_</span></span> would be selected by
8175 <span class="Flag"><span style=
8176 'font-size:10.0pt'>-macrovarprefix</span></span> <span class=
8177 "Flag"><span style='font-size:10.0pt'>"m_"</span></span>. The
8178 string may contain regular characters that may appear in a C
8179 identifier. These must match the initial characters of the
8180 identifier name. In addition, special characters (shown in
8181 Figure 23) can be used to denote a class of characters.<a href=
8182 "#_ftn18" name="_ftnref18" title=""><span class=
8183 "MsoFootnoteReference"><span class=
8184 "MsoFootnoteReference"><span style=
8185 'font-size:11.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>
8186 The <span class="CodeText"><span style=
8187 'font-size:10.0pt'>*</span></span> character may be used at the end
8188 of a prefix string to specify the rest of the identifier is zero or
8189 more characters matching the character immediately before the
8190 <span class="CodeText"><span style=
8191 'font-size:10.0pt'>*</span></span>. For example, the prefix
8192 string <span class="CodeText"><span style=
8193 'font-size:10.0pt'>T&*</span></span> matches <span class=
8194 "CodeText"><span style='font-size:10.0pt'>T</span></span> or
8195 <span class="CodeText"><span style=
8196 'font-size:10.0pt'>TWINDOW</span></span> but not <span class=
8197 "CodeText"><span style='font-size:10.0pt'>Twin</span></span>.</p>
8198 <p class="beforelist"> </p>
8199 <p class="beforelist">Different prefixes can be selected for the
8200 following identifier contexts:</p>
8201 <table class="MsoNormalTable" border="0" cellspacing="0"
8202 cellpadding="0" style='margin-left:.45in;border-collapse:collapse'>
8204 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8205 <p class="TextFontCX"><span class="Flag"><span style=
8206 'font-size:10.0pt'>macro-var-prefix</span></span></p></td>
8207 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8208 <p class="TextFontCX">Any variable declared inside a macro
8211 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8212 <p class="TextFontCX"><span class="Flag"><span style=
8213 'font-size:10.0pt'>unchecked-macro-prefix</span></span></p></td>
8214 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8215 <p class="TextFontCX">Any macro that is not checked as a function
8216 or constant (see Section 11.4)</p></td></tr>
8218 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8219 <p class="TextFontCX"><span class="Flag"><span style=
8220 'font-size:10.0pt'>tag-prefix</span></span></p></td>
8221 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8222 <p class="TextFontCX">Tags for <span class=
8223 "CodeText"><span style='font-size:10.0pt'>struct</span></span>,
8224 <span class="CodeText"><span style=
8225 'font-size:10.0pt'>union</span></span> and <span class=
8226 "CodeText"><span style='font-size:10.0pt'>enum</span></span>
8227 declarations</p></td></tr>
8229 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8230 <p class="TextFontCX"><span class="Flag"><span style=
8231 'font-size:10.0pt'>enum-prefix</span></span></p></td>
8232 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8233 <p class="TextFontCX">Members of <span class=
8234 "CodeText"><span style='font-size:10.0pt'>enum</span></span>
8237 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8238 <p class="TextFontCX"><span class="Flag"><span style=
8239 'font-size:10.0pt'>type-prefix</span></span></p></td>
8240 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8241 <p class="TextFontCX">Name of a user-defined type</p></td></tr>
8243 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8244 <p class="TextFontCX"><span class="Flag"><span style=
8245 'font-size:10.0pt'>file-static-prefix</span></span></p></td>
8246 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8247 <p class="TextFontCX">Any identifier with file static
8250 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8251 <p class="TextFontCX"><span class="Flag"><span style=
8252 'font-size:10.0pt'>glob-var-prefix</span></span></p></td>
8253 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8254 <p class="TextFontCX">Any variable (not of function type) with
8255 global scope</p></td></tr>
8257 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8258 <p class="TextFontCX"><span class="Flag"><span style=
8259 'font-size:10.0pt'>const-prefix</span></span></p></td>
8260 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8261 <p class="TextFontCX">Any constant (see Section 11.1)</p></td></tr>
8263 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8264 <p class="TextFontCX"><span class="Flag"><span style=
8265 'font-size:10.0pt'>iter-prefix</span></span></p></td>
8266 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8267 <p class="TextFontCX">An iterator (see Section 11.4)</p></td></tr>
8269 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8270 <p class="TextFontCX"><span class="Flag"><span style=
8271 'font-size:10.0pt'>proto-param-prefix</span></span></p></td>
8272 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8273 <p class="TextFontCX">A parameter in a function declaration
8274 prototype</p></td></tr>
8276 <td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
8277 <p class="TextFontCX"><span class="Flag"><span style=
8278 'font-size:10.0pt'>external-prefix</span></span></p></td>
8279 <td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
8280 <p class="TextFontCX">Any exported identifier</p></td></tr></table>
8281 <p class="afterlist">If an identifier is in more than one of the
8282 namespace contexts, the most specific defined namespace prefix is
8283 used (e.g., a global variable is also an exported identifier,
8284 so if <span class="Flag"><span style=
8285 'font-size:10.0pt'>global-var-prefix</span></span> is set, it is
8286 checked against the variable name; if not, the identifier is
8287 checked against the <span class="Flag"><span style=
8288 'font-size:10.0pt'>external-prefix</span></span>.)</p>
8289 <p class="TextFontCX"> </p>
8290 <p class="TextFontCX">For each prefix flag, a corresponding flag
8291 named <span class="Flag"><i><span style=
8292 'font-size:10.0pt'><prefixname></span></i></span><span class="Flag">
8293 <span style='font-size:10.0pt'>exclude</span></span> controls
8294 whether errors are reported if identifiers in a different namespace
8295 match the namespace prefix. For example, if
8296 <span class="Flag"><span style=
8297 'font-size: 10.0pt'>macro-var-prefix-exclude</span></span> is
8298 on, Splint checks that no identifier that is not a variable
8299 declared inside a macro body uses the macro variable
8301 <p class="TextFontCX"> </p>
8302 <p class="beforelist">Here is a (somewhat draconian) sample naming
8304 <table class="MsoNormalTable" border="0" cellspacing="0"
8305 cellpadding="0" style='margin-left:5.4pt;border-collapse:collapse'>
8307 <td valign="top" style=
8308 'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
8309 <p class="TextFontCX"><span class="Flag"><span style=
8310 'font-size:10.0pt'>-unchecked-macro-prefix</span></span>
8311 <span class="Flag"><span style=
8312 'font-size:10.0pt'>"~*"</span></span></p></td>
8313 <td valign="top" style=
8314 'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
8315 <p class="TextFontCX">Unchecked macros have no lowercase
8316 letters.</p></td></tr>
8318 <td valign="top" style=
8319 'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
8320 <p class="TextFontCX"><span class="Flag"><span style=
8321 'font-size:10.0pt'>-type-prefix</span></span> <span class=
8323 'font-size:10.0pt'>"T^&*"</span></span></p></td>
8324 <td valign="top" style=
8325 'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
8326 <p class="TextFontCX">All type names begin with <span class=
8327 "CodeText"><span style='font-size:10.0pt'>T</span></span> followed
8328 by an uppercase letter. The rest of the name is all lowercase
8329 letters.</p></td></tr>
8331 <td valign="top" style=
8332 'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
8333 <p class="TextFontCX"><span class="Flag"><span style=
8334 'font-size:10.0pt'>+type-prefix-exclude</span></span></p></td>
8335 <td valign="top" style=
8336 'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
8337 <p class="TextFontCX">No identifier that does not name a
8338 user-defined type name begins with the type name
8339 prefix.</p></td></tr>
8341 <td valign="top" style=
8342 'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
8343 <p class="TextFontCX"><span class="Flag"><span style=
8344 'font-size:10.0pt'>-file-static-prefix</span></span>
8345 <span class="Flag"><span style=
8346 'font-size:10.0pt'>"^&&&"</span></span></p></td>
8347 <td valign="top" style=
8348 'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
8349 <p class="TextFontCX">File static scope variables begin with an
8350 uppercase letter and three lowercase letters.</p></td></tr>
8352 <td valign="top" style=
8353 'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
8354 <p class="TextFontCX"><span class="Flag"><span style=
8355 'font-size:10.0pt'>-proto-param-prefix "p_"</span></span></p></td>
8356 <td valign="top" style=
8357 'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
8358 <p class="TextFontCX">All parameters in prototypes must begin with
8359 <span class="CodeText"><span style=
8360 'font-size:10.0pt'>p_</span></span>.</p></td></tr>
8362 <td valign="top" style=
8363 'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
8364 <p class="TextFontCX"><span class="Flag"><span style=
8365 'font-size:10.0pt'>-glob-var-prefix "G"</span></span></p></td>
8366 <td valign="top" style=
8367 'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
8368 <p class="TextFontCX">All global variables start with
8369 <span class="CodeText"><span style=
8370 'font-size:10.0pt'>G</span></span>.</p></td></tr>
8372 <td valign="top" style=
8373 'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
8374 <p class="TextFontCX"><span class="Flag"><span style=
8375 'font-size:10.0pt'>+glob-var-prefix-exclude</span></span></p></td>
8376 <td valign="top" style=
8377 'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
8378 <p class="TextFontCX">No identifier that is not a
8379 global variable starts with <span class=
8380 "CodeText"><span style='font-size:10.0pt'>G</span></span>.</p></td></tr></table>
8381 <p class="beforelist"> </p>
8382 <p class="beforelist">The prefix for parameters in function
8383 prototypes is useful for making sure parameter names are not in
8384 conflict with macros defined before the function prototype.
8385 In most cases, it may be preferable to not name prototype
8386 parameters. If the <span class="Flag"><span style=
8387 'font-size:10.0pt'>proto-param-name</span></span> flag is set,
8388 an error is reported for any named parameter in a prototype
8389 declaration. If a <span class="Flag"><span style=
8390 'font-size:10.0pt'>proto-param-prefix</span></span> is set, no
8391 error is reported for unnamed parameters.</p>
8392 <p class="TextFontCX">It may also be useful to check the names of
8393 prototype parameters correspond to the names in definitions.
8394 While using header files as documentation is not generally
8395 recommended, it is common enough practice that it makes sense to
8396 check that parameter names are consistent. A discrepancy may
8397 indicate an error in the parameter order in the function
8398 prototype. If <span class="Flag"><span style=
8399 'font-size:10.0pt'>proto-param-match</span></span> is set,
8400 Splint will report an error if the name of a definition parameter
8401 does not match the corresponding prototype parameter (after
8402 removing the <span class="Flag"><span style=
8403 'font-size:10.0pt'>protoparamprefix</span></span>).</p>
8405 <table class="MsoNormalTable" border="0" cellspacing="0"
8406 cellpadding="0" style=
8407 'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
8409 <td valign="top" style=
8410 'width:22.0pt;border-top:solid black 1.5pt; border-left:solid black 1.5pt;border-bottom:none;border-right:none; padding:0in 5.4pt 0in 5.4pt'>
8411 <p class="TextFontCX"><span class="CodeText"><span style=
8412 'font-size:10.0pt'>^</span></span></p></td>
8413 <td valign="top" style=
8414 'width:401.55pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8415 <p class="TextFontCX">Any uppercase letter, <span class=
8416 "CodeText"><span style=
8417 'font-size:10.0pt'>A</span></span>-<span class=
8418 "CodeText"><span style=
8419 'font-size:10.0pt'>Z</span></span></p></td></tr>
8421 <td valign="top" style=
8422 'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8423 <p class="TextFontCX"><span class="CodeText"><span style=
8424 'font-size:10.0pt'>&</span></span></p></td>
8425 <td valign="top" style=
8426 'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8427 <p class="TextFontCX">Any lowercase letter, <span class=
8428 "CodeText"><span style=
8429 'font-size:10.0pt'>a</span></span>-<span class=
8430 "CodeText"><span style=
8431 'font-size:10.0pt'>z</span></span></p></td></tr>
8433 <td valign="top" style=
8434 'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8435 <p class="TextFontCX"><span class="CodeText"><span style=
8436 'font-size:10.0pt'>%</span></span></p></td>
8437 <td valign="top" style=
8438 'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8439 <p class="TextFontCX">Any character that is not an uppercase letter
8440 (allows lowercase letters, digits and underscore)</p></td></tr>
8442 <td valign="top" style=
8443 'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8444 <p class="TextFontCX"><span class="CodeText"><span style=
8445 'font-size:10.0pt'>~</span></span></p></td>
8446 <td valign="top" style=
8447 'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8448 <p class="TextFontCX">Any character that is not a lowercase letter
8449 (allows uppercase letters, digits and underscore)</p></td></tr>
8451 <td valign="top" style=
8452 'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8453 <p class="TextFontCX"><span class="CodeText"><span style=
8454 'font-size:10.0pt'>$</span></span></p></td>
8455 <td valign="top" style=
8456 'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8457 <p class="TextFontCX">Any letter (<span class=
8458 "CodeText"><span style=
8459 'font-size:10.0pt'>a</span></span>-<span class=
8460 "CodeText"><span style='font-size:10.0pt'>z</span></span>,
8461 <span class="CodeText"><span style=
8462 'font-size:10.0pt'>A</span></span>-<span class=
8463 "CodeText"><span style=
8464 'font-size:10.0pt'>Z</span></span>)</p></td></tr>
8466 <td valign="top" style=
8467 'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8468 <p class="TextFontCX"><span class="CodeText"><span style=
8469 'font-size:10.0pt'>/</span></span></p></td>
8470 <td valign="top" style=
8471 'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8472 <p class="TextFontCX">Any letter or digit (<span class=
8473 "CodeText"><span style=
8474 'font-size:10.0pt'>A</span></span>-<span class=
8475 "CodeText"><span style='font-size:10.0pt'>Z</span></span>,
8476 <span class="CodeText"><span style=
8477 'font-size:10.0pt'>a</span></span>-<span class=
8478 "CodeText"><span style='font-size:10.0pt'>z</span></span>,
8479 <span class="CodeText"><span style=
8480 'font-size:10.0pt'>0</span></span>-<span class=
8481 "CodeText"><span style=
8482 'font-size:10.0pt'>9</span></span>)</p></td></tr>
8484 <td valign="top" style=
8485 'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8486 <p class="TextFontCX"><span class="CodeText"><span style=
8487 'font-size:10.0pt'>?</span></span></p></td>
8488 <td valign="top" style=
8489 'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8490 <p class="TextFontCX">Any character valid in a C
8491 identifier</p></td></tr>
8493 <td valign="top" style=
8494 'width:22.0pt;border-top:none;border-left:solid black 1.5pt; border-bottom:solid black 1.5pt;border-right:none;padding:0in 5.4pt 0in 5.4pt'>
8495 <p class="TextFontCX"><span class="CodeText"><span style=
8496 'font-size:10.0pt'>#</span></span></p></td>
8497 <td valign="top" style=
8498 'width:401.55pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8499 <p class="TextFontCX" style='page-break-after: avoid'>Any digit,
8500 <span class="CodeText"><span style=
8501 'font-size:10.0pt'>0</span></span>-<span class=
8502 "CodeText"><span style=
8503 'font-size:10.0pt'>9</span></span></p></td></tr></table>
8504 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
8506 <td valign="top" style=
8507 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
8508 <p class="MsoCaption"><a name="_Toc534824625"></a><a name=
8509 "_Ref347220245"></a><a name="_Ref347220226"></a><a name=
8510 "_Toc347255399"></a><a name="_Ref347222037"></a><a name=
8511 "_Ref347222045"></a><a name="_Ref534824531">Figure 23</a>.
8512 Prefix Character Codes</p></td></tr></table></center>
8513 <h2 style='margin-left:0in;text-indent:0in'><a name=
8514 "_Toc534975020"></a><a name="_Ref348079479"></a><a name=
8515 "_Ref347240790"></a><a name="_Toc344355427">12.3<span style=
8516 'font:7.0pt "Times New Roman"'> </span>
8517 Naming Restrictions</a></h2>
8518 <p class="TextFontCX">Additional naming restrictions can be used to
8519 check that names do no conflict with names reserved for the
8520 standard library, and that identifier are sufficiently distinct
8521 (either for the compiler and linker, or for the programmer.)
8522 Restrictions may be different for names that are needed by the
8523 linker (<i>external</i> names) and names that are only needed
8524 during compilations (<i>internal</i> names). Names of
8525 non-<span class="CodeText"><span style=
8526 'font-size:10.0pt'>static</span></span> functions and global
8527 variables are external; all other names are internal.</p>
8528 <p class="Sidebar" align="right"><a name=
8529 "_Ref350062822"></a><a name="_Ref348845288"></a><a name=
8530 "_Toc344355429"></a><a name="_Ref343248602"> </a></p>
8531 <p class="Sidebar" align="right">The decision to retain the old
8532 six-character case-insensitive restriction on significance was most
8534 <p class="Sidebar" align="right" style='text-align:right'><i>ANSI C
8536 <h3 style='margin-left:0in;text-indent:0in'><a name=
8537 "_Toc534975021">12.3.1<span style=
8538 'font:7.0pt "Times New Roman"'> </span> Reserved
8540 <p class="TextFontCX">Many names are reserved for the
8541 implementation and standard library. A complete list of
8542 reserved names can be found in [vdL, p. 126-128]. Some name
8543 prefixes such as <span class="CodeText"><span style=
8544 'font-size:10.0pt'>str</span></span> followed by a lowercase
8545 character are reserved for future library extensions. Most C
8546 compilers do not detect naming conflicts, and they can lead to
8547 unpredictable program behavior. If <span class=
8548 "Flag"><span style='font-size:10.0pt'>ansi-reserved</span></span>
8549 is on, Splint warns about external names that conflict with
8550 reserved names. If <span class="Flag"><span style=
8551 'font-size:10.0pt'>ansi-reserved-internal</span></span> is on,
8552 warnings are also produced for internal names.</p>
8553 <p class="TextFontCX"> </p>
8554 <p class="TextFontCX">If <span class="Flag"><span style=
8555 'font-size:10.0pt'>+cpp-names</span></span> is set, Splint warns
8556 about identifier names that are keywords or reserved words in
8557 C++. This is useful if the code may later be compiled with a
8558 C++ compiler (of course, this is not enough to ensure the meaning
8559 of the code is not changed when it is compiled as C++.)</p>
8560 <h3 style='margin-left:0in;text-indent:0in'><a name=
8561 "_Toc534975022">12.3.2<span style=
8562 'font:7.0pt "Times New Roman"'> </span> Distinct
8564 <p class="TextFontCX">Splint can check that names differ within a
8565 given number of characters, optionally ignoring alphabetic case and
8566 differences between characters that look similar. The number
8567 of significant characters may be different for external and
8568 internal names. </p>
8569 <p class="TextFontCX"> </p>
8570 <p class="TextFontCX">Using <span class="Flag"><span style=
8571 'font-size:10.0pt'>+distinct-external-names</span></span> sets
8572 the number of significant characters for external names to six and
8573 makes alphabetical case insignificant for external names.
8574 This is the minimum significance acceptable in an ANSI-conforming
8575 compiler. Most modern compilers exceed these minimums (which
8576 are particularly hard to follow if one uses the Czech or Slovak
8577 naming convention). The number of significant characters can
8578 be changed using the <span class="Flag"><span style=
8579 'font-size:10.0pt'>external-name-length
8580 <i><number></i></span></span> flag. If
8581 <span class="Flag"><span style=
8582 'font-size:10.0pt'>external-name-case-insensitive</span></span>
8583 is on, alphabetical case is ignored in comparing external
8584 names. Splint reports identifiers that differ only in
8585 alphabetic case.</p>
8586 <p class="TextFontCX">For internal identifiers, a conforming
8587 compiler must recognize at least 31 characters and treat
8588 alphabetical cases distinctly. Nevertheless, it may still be
8589 useful to check that internal names are more distinct then required
8590 by the compiler to minimize the likelihood that identifiers are
8591 confused in the program. Analogously to external names, the
8592 <span class="Flag"><span style=
8593 'font-size:10.0pt'>internal-name-length</span></span><span class="Flag">
8595 'font-size:10.0pt'> <i><number></i></span></span> flag
8596 sets the number of significant characters in an internal name and
8597 <span class="Flag"><span style=
8598 'font-size:10.0pt'>internal-name-case-insensitive</span></span>
8599 sets the case sensitivity. The <span class=
8600 "Flag"><span style='font-size:10.0pt'>internal-name-look-alike</span></span>
8601 flag further restricts distinctions between
8602 identifiers. When set, similar-looking characters match
8603 — the lowercase letter <span class=
8604 "CodeText"><span style='font-size:10.0pt'>l</span></span>
8605 matches the uppercase letter <span class=
8606 "CodeText"><span style='font-size:10.0pt'>I</span></span> and
8607 the number <span class="CodeText"><span style=
8608 'font-size:10.0pt'>1</span></span>; the letter <span class=
8609 "CodeText"><span style='font-size:10.0pt'>O</span></span> or
8610 <span class="CodeText"><span style=
8611 'font-size:10.0pt'>o</span></span> matches the number
8612 <span class="CodeText"><span style=
8613 'font-size:10.0pt'>0</span></span>; <span class=
8614 "CodeText"><span style='font-size:10.0pt'>5</span></span>
8615 matches <span class="CodeText"><span style=
8616 'font-size:10.0pt'>S</span></span>; and <span class=
8617 "CodeText"><span style='font-size:10.0pt'>2</span></span>
8618 matches <span class="CodeText"><span style=
8619 'font-size:10.0pt'>Z</span></span>. Identifiers that
8620 are not distinct except for look-alike characters will
8621 produce an error message. External names are also
8622 internal names, so they must satisfy both the external and
8623 internal distinct identifier checks. Figure 24 provides
8624 some examples of distinct name checking.</p>
8626 <table class="MsoNormalTable" border="0" cellspacing="0"
8627 cellpadding="0" style=
8628 'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
8630 <td valign="top" style=
8631 'width:166.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
8632 <p class="TextFontCX" align="center" style='text-align:center'>
8633 <span class="Keyword"><b><span style=
8634 'font-size:10.0pt; color:white'>names.c</span></b></span></p></td>
8635 <td valign="top" style=
8636 'width:256.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
8637 <p class="TextFontCX" align="center" style='text-align:center'>
8638 <b><span style='color:white'>Running
8639 Splint</span></b></p></td></tr>
8641 <td valign="top" style=
8642 'width:166.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
8643 <p class="Verbatim"><span class="Line"><span style=
8644 'font-size:8.0pt'> </span></span>char *stringrev (char
8646 <p class="Verbatim"> </p>
8647 <p class="Verbatim"><span class="Line"><span style=
8648 'font-size:8.0pt'>3</span></span> int f (int x)</p>
8649 <p class="Verbatim"><span class="Line"><span style=
8650 'font-size:8.0pt'> </span></span> {</p>
8651 <p class="Verbatim"><span class="Line"><span style=
8652 'font-size:8.0pt'>5</span></span> int lookalike = 1;</p>
8653 <p class="Verbatim"><span class="Line"><span style=
8654 'font-size:8.0pt'>6</span></span> int looka1ike = 2;</p>
8655 <p class="Verbatim"> </p>
8656 <p class="Verbatim"> if (x > 3)</p>
8657 <p class="Verbatim"> {</p>
8658 <p class="Verbatim"><span class="Line"><span style=
8659 'font-size:8.0pt'>10</span></span> int x =
8661 <p class="Verbatim"> x +=
8663 <p class="Verbatim"> }</p>
8664 <p class="Verbatim"> </p>
8665 <p class="Verbatim"> return x;</p>
8666 <p class="Verbatim">}
8667 </p></td>
8668 <td valign="top" style=
8669 'width:256.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
8670 <p class="lclintrun">> splint names.c
8671 +distinctinternalnames </p>
8672 <p class="lclintrun">
8673
8674 +internalnamelookalike +isoreserved</p>
8675 <p class="lclintrun"> </p>
8676 <p class="lclintrun">names.c:1: Name stringreverse is reserved for
8678 <p class="lclintrun"> library extensions.
8679 Functions that begin with</p>
8680 <p class="lclintrun"> "str" and a lowercase
8681 letter may be added to</p>
8682 <p class="lclintrun"> <stdlib.h> or
8683 <string.h>. (ISO99:7.26.9)</p>
8684 <p class="lclintrun">names.c:6: Internal identifier looka1ike is
8686 <p class="lclintrun"> distinguishable from
8687 lookalike except by lookalike</p>
8688 <p class="lclintrun"> characters</p>
8689 <p class="lclintrun"> names.c:5: Declaration of
8691 <p class="lclintrun">names.c:10: Variable x shadows outer
8693 <p class="lclintrun" style='page-break-after:avoid'>
8694 names.c:3: Previous declaration of x: int</p></td></tr></table>
8695 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
8697 <td valign="top" style=
8698 'padding-top:5.05pt;padding-right: 9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>
8699 <p class="MsoCaption"><a name="_Ref343085825"></a><a name=
8700 "_Ref343085797"></a><a name="_Ref343065542"></a><a name=
8701 "_Ref349992283"></a><a name="_Ref534642902"></a><a name=
8702 "_Ref534642319"></a><a name="_Toc534824626"></a><a name=
8703 "_Ref534823650">Figure 24</a>. Distinct
8704 Names</p></td></tr></table></center>
8705 <h1 style='margin-left:0in;text-indent:0in'><a name=
8706 "_Ref534981356"></a><a name="_Ref534978939"></a><a name=
8707 "_Toc534975023">13<span style=
8708 'font:7.0pt "Times New Roman"'> </span>
8709 <a id="completeness" name="completeness">
8710 Completeness</a></a></h1>
8711 <p class="TextFontCX">Splint can report warnings for unused
8712 declarations and exported declarations that are not used
8714 <h2 style='margin-left:0in;text-indent:0in'><a name=
8715 "_Toc534975024"></a><a name="_Ref534744216">13.1<span style=
8716 'font:7.0pt "Times New Roman"'> </span>
8717 Unused Declarations</a></h2>
8718 <p class="TextFontCX">Splint detects constants, functions,
8719 parameters, variables, types, enumerator members, and structure or
8720 union fields that are declared but never used. The flags
8721 <span class="Flag"><span style=
8722 'font-size:10.0pt'>constuse</span></span>, <span class=
8723 "Flag"><span style='font-size:10.0pt'>fcnuse</span></span>,
8724 <span class="Flag"><span style=
8725 'font-size:10.0pt'>paramuse</span></span>, <span class=
8726 "Flag"><span style='font-size:10.0pt'>varuse</span></span>,
8727 <span class="Flag"><span style=
8728 'font-size:10.0pt'>typeuse</span></span>, <span class=
8729 "Flag"><span style='font-size:10.0pt'>enummemuse</span></span> and
8730 <span class="Flag"><span style=
8731 'font-size:10.0pt'>fielduse</span></span> control whether unused
8732 declaration errors are reported for each kind of declaration.
8733 Errors for exported declarations are reported only if
8734 <span class="Flag"><span style=
8735 'font-size:10.0pt'>topuse</span></span> is on (see Section
8737 <p class="TextFontCX"><a name="_Ref349900444"></a><a name=
8738 "_Ref349850608"></a><a name="_Ref349850429"> </a></p>
8739 <p class="TextFontCX">The <span class="Annot"><span style=
8740 'font-size:10.0pt'>/*@unused@*/</span></span> annotation can
8741 be used before a declaration to indicate that the item declared
8742 need not be used. Unused declaration errors are not reported
8743 for identifiers declared with <span class=
8744 "Annot"><span style='font-size:10.0pt'>unused</span></span><a name="_Toc344355432">
8745 </a><a name="_Ref343110935">.</a></p>
8746 <h2 style='margin-left:0in;text-indent:0in'><a name=
8747 "_Toc534975025"></a><a name="_Toc344355433"></a><a name=
8748 "_Ref343110504">13.2<span style=
8749 'font:7.0pt "Times New Roman"'> </span>
8750 Complete</a> Programs</h2>
8751 <p class="TextFontCX">Splint can be used on both complete and
8752 partial programs. When checking complete programs,
8753 additional checks can be done to ensure that every identifier
8754 declared by the program is defined and used, and that functions
8755 that do not need to be exported are declared <span class=
8756 "CodeText"><span style='font-size:10.0pt'>static</span></span>.</p>
8757 <p class="TextFontCX"> </p>
8758 <p class="TextFontCX">Splint checks that all declared variables and
8759 functions are defined (controlled by <span class=
8760 "Flag"><span style='font-size:10.0pt'>compdef</span></span><span class="Flag">
8761 <span style='font-size:10.0pt'>)</span></span>. Declarations
8762 of functions and variables that are defined in an external library,
8763 may be preceded by <span class="Annot"><span style=
8764 'font-size:10.0pt'>/*@external@*/</span></span> to suppress
8765 undefined declaration errors.</p>
8766 <p class="TextFontCX"> </p>
8767 <p class="TextFontCX">Splint reports external declarations that are
8768 unused (controlled by <span class="Flag"><span style=
8769 'font-size:10.0pt'>topuse</span></span>). Which declarations
8770 are reported also depends on the declaration use flags (Section
8771 13.1). The <span class="Flag"><span style=
8772 'font-size:10.0pt'>+partial</span></span> flag sets flags for
8773 checking a partial system. Top-level unused declarations,
8774 undefined declarations, and unnecessary external names are not
8775 reported if <span class="Flag"><span style=
8776 'font-size:10.0pt'>+partial</span></span> is set.</p>
8777 <h3 style='margin-left:0in;text-indent:0in'><a name=
8778 "_Toc534975026">13.2.1<span style=
8779 'font:7.0pt "Times New Roman"'> </span>
8780 Unnecessarily External Names</a></h3>
8781 <p class="TextFontCX">Splint can report variables and functions
8782 that are declared with global scope (i.e., without using
8783 <span class="CodeText"><span style=
8784 'font-size:10.0pt'>static</span></span>), that are not used outside
8785 the file in which they are defined. In a stand-alone system,
8786 these identifiers should usually be declared using
8787 <span class="CodeText"><span style=
8788 'font-size:10.0pt'>static</span></span> to limit their
8789 scope. If the <span class="Flag"><span style=
8790 'font-size:10.0pt'>export-static</span></span> flag is on,
8791 Splint will report declarations that could have file
8792 scope. It should only be used when all relevant source
8793 files are listed on the Splint command line; otherwise,
8794 variables and functions may be incorrectly identified as only
8795 used in the file scope since Splint did not process the other
8796 file in which they are used.</p>
8797 <h3 style='margin-left:0in;text-indent:0in'><a name=
8798 "_Toc534975027">13.2.2<span style=
8799 'font:7.0pt "Times New Roman"'> </span>
8800 Declarations Missing from Headers</a></h3>
8801 <p class="TextFontCX">A common practice in C programming styles, is
8802 that every function or variable exported by <span class=
8803 "Keyword"><i><span style=
8804 'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
8806 'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
8807 is declared in <span class="Keyword"><i><span style=
8808 'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
8810 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.
8811 If the <span class="Flag"><span style=
8812 'font-size:10.0pt'>export-header</span></span> flag is on, Splint
8813 will report exported declarations in <span class=
8814 "Keyword"><i><span style=
8815 'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
8817 'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
8818 that are not declared in <span class=
8819 "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
8820 M</span></i></span><span class="Keyword"><span style=
8821 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.</p>
8822 <h1 style='margin-left:0in;text-indent:0in'><a name=
8823 "_Toc534975028"></a><a name="_Ref534642392"></a><a name=
8824 "_Ref349900301">14<span style=
8825 'font:7.0pt "Times New Roman"'> </span>
8826 <a id="libraries" name="libraries">
8827 Libraries</a> and Header File Inclusion</a></h1>
8828 <p class="TextFontCX">Libraries can be used to record interface
8829 information. A library containing information about the
8830 standard C Library is used to enable checking of library
8831 calls. Program libraries can be created to enable fast
8832 checking of single modules in a large program.</p>
8833 <h2 style='margin-left:0in;text-indent:0in'><a name=
8834 "_Toc534975029"></a><a name="_Ref534035506"></a><a name=
8835 "_Ref348801560"></a><a name="_Ref347465531"></a><a name=
8836 "_Ref344887939"></a><a name="_Toc344355445">14.1<span style=
8837 'font:7.0pt "Times New Roman"'> </span>
8838 Standard Librar</a>ies</h2>
8839 <p class="TextFontCX">In order to check calls to library functions,
8840 Splint uses an annotated standard library. This contains more
8841 information about function interfaces then is available in the
8842 system header files since it uses annotations. Further, it
8843 contains only those functions documented in the ISO C99
8844 standard. Many systems include extra functions in their
8845 system libraries; programs that use these functions cannot be
8846 compiled on other systems that do not provide them. Certain
8847 types defined by the library are treated as abstract types
8848 (e.g., a program should not rely on how the <span class=
8849 "CodeText"><span style='font-size:10.0pt'>FILE</span></span> type
8850 is implemented). When checking source code, Splint does
8851 include system headers corresponding to files in the library, but
8852 instead uses the library description of the standard library.</p>
8853 <p class="TextFontCX"> </p>
8854 <p class="TextFontCX">The Splint distribution includes several
8855 different standard libraries: the ANSI standard library, the POSIX
8856 standard library<a href="#_ftn19" name="_ftnref19" title=
8857 ""><span class="MsoFootnoteReference"><span class=
8858 "MsoFootnoteReference"><span style=
8859 'font-size:11.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>,
8860 and a UNIX library based on the Open Group’s Single Unix
8861 Specification. Each library comes in two versions: the
8862 standard version and the strict version.</p>
8863 <h3 style='margin-left:0in;text-indent:0in'><a name=
8864 "_Toc534975030">14.1.1<span style=
8865 'font:7.0pt "Times New Roman"'> </span> ISO
8866 Standard Library</a></h3>
8867 <p class="TextFontCX">The default behavior of Splint is to use the
8868 ISO standard library (loaded from <span class=
8869 "CodeText"><span style=
8870 'font-size:10.0pt'>standard.lcd</span></span>). This library
8871 is based on the standard library described in the ISO C99
8873 <h3 style='margin-left:0in;text-indent:0in'><a name=
8874 "_Toc534975031">14.1.2<span style=
8875 'font:7.0pt "Times New Roman"'> </span> POSIX
8877 <p class="TextFontCX">The POSIX library is selected by the
8878 <span class="Flag"><span style=
8879 'font-size:10.0pt'>+posixlib</span></span> flag. The
8880 POSIX library is based on the IEEE Std 1003.1-1990. </p>
8881 <h3 style='margin-left:0in;text-indent:0in'><a name=
8882 "_Toc534975032">14.1.3<span style=
8883 'font:7.0pt "Times New Roman"'> </span> UNIX
8885 <p class="afterlist">The UNIX library is selected by the
8886 <span class="Flag"><span style=
8887 'font-size:10.0pt'>+unixlib</span></span> flag. This library
8888 is based on the Open Group’s Single Unix Specification,
8889 Version 2. In the UNIX library, <span class=
8890 "CodeText"><span style='font-size:10.0pt'>free</span></span> is
8891 declared with a non-null parameter. ISO specifies that
8892 <span class="CodeText"><span style=
8893 'font-size:10.0pt'>free</span></span> should handle the argument
8894 <span class="CodeText"><span style=
8895 'font-size:10.0pt'>NULL</span></span>, but several UNIX platforms
8896 crash if <span class="CodeText"><span style=
8897 'font-size:10.0pt'>NULL</span></span> is passed to
8898 <span class="CodeText"><span style=
8899 'font-size:10.0pt'>free</span></span>.</p>
8900 <h3 style='margin-left:0in;text-indent:0in'><a name=
8901 "_Toc534975033">14.1.4<span style=
8902 'font:7.0pt "Times New Roman"'> </span> Strict
8904 <p class="TextFontCX">Stricter versions of the libraries are used
8905 is the <span class="Flag"><span style=
8906 'font-size:10.0pt'>-ansi-strict</span></span>, <span class=
8908 'font-size:10.0pt'>posix-strict-lib</span></span> or
8909 <span class="Flag"><span style=
8910 'font-size:10.0pt'>unix-strict-lib</span></span> flag is used.
8911 These libraries use a stricter interpretation of the library.
8912 They will detect more errors in some programs, but may to produce
8913 many spurious errors for typical code.</p>
8914 <p class="TextFontCX"> </p>
8915 <p class="beforelist">The differences between the standard
8916 libraries and the strict libraries are:</p>
8917 <p class="MsoListBullet"><span style=
8918 'font-family:Symbol'>·<span style=
8919 'font:7.0pt "Times New Roman"'> </span></span>
8920 The standard libraries declare the printing functions
8921 (<span class="CodeText"><span style=
8922 'font-size:10.0pt'>fprintf</span></span>, <span class=
8923 "CodeText"><span style=
8924 'font-size:10.0pt'>printf</span></span>, and <span class=
8925 "CodeText"><span style=
8926 'font-size:10.0pt'>sprintf</span></span>) that may return
8927 error codes to return <span class="CodeText"><span style=
8928 'font-size:10.0pt'>int</span></span> or <span class=
8929 "CodeText"><span style=
8930 'font-size:10.0pt'>void</span></span>. This prevents
8931 typical programs from leading to deluge of ignored return
8932 value errors, but may mean some relevant errors are not
8933 detected. In the strict library, they are declared to
8934 return <span class="CodeText"><span style=
8935 'font-size:10.0pt'>int</span></span>, so ignored return value
8936 errors will be reported (depending on other flag
8937 settings). Programs should check that this return value
8938 is non-negative.</p>
8939 <p class="MsoListBullet"><span style=
8940 'font-family:Symbol'>·<span style=
8941 'font:7.0pt "Times New Roman"'> </span></span>
8942 The standard libraries declare some parameters and return values to
8943 be alternate types (<span class="CodeText"><span style=
8944 'font-size:10.0pt'>int</span></span> or <span class=
8945 "CodeText"><span style='font-size:10.0pt'>bool</span></span>, or
8946 <span class="CodeText"><span style=
8947 'font-size:10.0pt'>int</span></span> or <span class=
8948 "CodeText"><span style=
8949 'font-size:10.0pt'>char</span></span>). The ISO C99 standard
8950 specifies these types as <span class="CodeText"><span style=
8951 'font-size: 10.0pt'>int</span></span> to be compatible with older
8952 versions of the library, but logically they make more sense as
8953 <span class="CodeText"><span style=
8954 'font-size:10.0pt'>bool</span></span> or <span class=
8955 "CodeText"><span style='font-size:10.0pt'>char</span></span>.
8956 In the strict library, the stronger type is used. The
8957 parameter to <span class="CodeText"><span style=
8958 'font-size:10.0pt'>assert</span></span> is <span class=
8959 "CodeText"><span style='font-size:10.0pt'>int</span></span> or
8960 <span class="CodeText"><span style=
8961 'font-size:10.0pt'>bool</span></span> in the standard library, and
8962 <span class="CodeText"><span style=
8963 'font-size:10.0pt'>bool</span></span> in the strict library.
8964 The parameter to the character functions <span class=
8965 "CodeText"><span style='font-size:10.0pt'>isalnum</span></span>,
8966 <span class="CodeText"><span style=
8967 'font-size:10.0pt'>isalpha</span></span>, <span class=
8968 "CodeText"><span style='font-size:10.0pt'>iscntrl</span></span>,
8969 <span class="CodeText"><span style=
8970 'font-size:10.0pt'>isdigit</span></span>, <span class=
8971 "CodeText"><span style='font-size:10.0pt'>isgraph</span></span>,
8972 <span class="CodeText"><span style=
8973 'font-size:10.0pt'>islower</span></span>, <span class=
8974 "CodeText"><span style='font-size:10.0pt'>isprint</span></span>,
8975 <span class="CodeText"><span style=
8976 'font-size:10.0pt'>ispunct</span></span>, <span class=
8977 "CodeText"><span style='font-size:10.0pt'>isspace</span></span>,
8978 <span class="CodeText"><span style=
8979 'font-size:10.0pt'>isupper</span></span>, <span class=
8980 "CodeText"><span style='font-size:10.0pt'>isxdigit</span></span>,
8981 <span class="CodeText"><span style=
8982 'font-size:10.0pt'>tolower</span></span> and
8983 <span class="CodeText"><span style=
8984 'font-size:10.0pt'>toupper</span></span> is <span class=
8985 "CodeText"><span style='font-size:10.0pt'>char</span></span>
8986 or <span class="CodeText"><span style=
8987 'font-size:10.0pt'>unsigned char</span></span> or
8988 <span class="CodeText"><span style=
8989 'font-size:10.0pt'>int</span></span> in the standard library
8990 and <span class="CodeText"><span style=
8991 'font-size:10.0pt'>char</span></span> in the strict
8992 library. The type of the return value of the character
8993 classification functions (all of the previous character
8994 functions except <span class="CodeText"><span style=
8995 'font-size:10.0pt'>tolower</span></span> and <span class=
8996 "CodeText"><span style=
8997 'font-size:10.0pt'>toupper</span></span>) is <span class=
8998 "CodeText"><span style='font-size:10.0pt'>bool</span></span>
8999 or <span class="CodeText"><span style=
9000 'font-size:10.0pt'>int</span></span> in the standard library
9001 and <span class="CodeText"><span style=
9002 'font-size:10.0pt'>bool</span></span> in the strict
9003 library. The type of the first parameter to
9004 <span class="CodeText"><span style=
9005 'font-size:10.0pt'>ungetc</span></span> is <span class=
9006 "CodeText"><span style='font-size:10.0pt'>char</span></span>
9007 or <span class="CodeText"><span style=
9008 'font-size:10.0pt'>int</span></span> in the standard library
9009 and <span class="CodeText"><span style=
9010 'font-size:10.0pt'>char</span></span> in the strict library
9011 (<span class="CodeText"><span style=
9012 'font-size:10.0pt'>EOF</span></span> should not be passed to
9013 <span class="CodeText"><span style=
9014 'font-size:10.0pt'>ungetc</span></span>). The second
9015 parameter to <span class="CodeText"><span style=
9016 'font-size:10.0pt'>strchr</span></span> and <span class=
9017 "CodeText"><span style=
9018 'font-size:10.0pt'>strrchr</span></span> is <span class=
9019 "CodeText"><span style='font-size:10.0pt'>char</span></span>
9020 or <span class="CodeText"><span style=
9021 'font-size:10.0pt'>int</span></span> in the standard library
9022 and <span class="CodeText"><span style=
9023 'font-size:10.0pt'>char</span></span> in the strict
9025 <p class="MsoListBullet"><span style=
9026 'font-family:Symbol'>·<span style=
9027 'font:7.0pt "Times New Roman"'> </span></span>
9028 The global variables <span class="CodeText"><span style=
9029 'font-size:10.0pt'>stdin</span></span>, <span class=
9030 "CodeText"><span style=
9031 'font-size:10.0pt'>stdout</span></span> and <span class=
9032 "CodeText"><span style=
9033 'font-size:10.0pt'>stderr</span></span> are declared as
9034 <span class="CodeText"><span style=
9035 'font-size:10.0pt'>unchecked</span></span> variables (see Section
9036 7.2) in the standard libraries. In the strict libraries, they
9037 are<span class="CodeText"><span style=
9038 'font-size:10.0pt'>checked</span></span>.</p>
9039 <p class="MsoListBullet"><span style=
9040 'font-family:Symbol'>·<span style=
9041 'font:7.0pt "Times New Roman"'> </span></span>
9042 The global variable <span class="CodeText"><span style=
9043 'font-size:10.0pt'>errno</span></span> is declared
9044 <span class="CodeText"><span style=
9045 'font-size:10.0pt'>unchecked</span></span> in the
9046 standard libraries, but declared <span class=
9047 "CodeText"><span style=
9048 'font-size:10.0pt'>checkedstrict</span></span> in the
9049 strict libraries.</p>
9050 <p class="TextFontCX"> </p>
9051 <p class="TextFontCX">If no library flag is used, Splint will load
9052 the standard library, <span class="Keyword"><span style=
9053 'font-size:10.0pt;font-family:Arial;color:windowtext'>standard.lcd</span></span>.
9054 If <span class="Flag"><span style=
9055 'font-size:10.0pt'>+nolib</span></span> is set, no library is
9056 loaded. The library source files can easily be modified, and
9057 new libraries created to better suit a particular application.</p>
9058 <h2 style='margin-left:0in;text-indent:0in'><a name=
9059 "_Toc534975034"></a><a name="_Toc344355447">14.2<span style=
9060 'font:7.0pt "Times New Roman"'> </span>
9061 Generating Libraries</a></h2>
9062 <p class="TextFontCX">To enable running Splint on large systems,
9063 mechanisms are provided for creating libraries containing necessary
9064 information. This means source files can be checked
9065 independently, after a library has been created. The command line
9066 option <span class="Flag"><span style=
9067 'font-size:10.0pt'>-dump</span></span> <span class=
9068 "Flag"><span style='font-size:10.0pt'><i>library</i></span></span>
9069 stores information in the file <span class=
9070 "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
9071 library</span></i></span> (the default extension <span class=
9072 "Keyword"><span style=
9073 'font-size:10.0pt;font-family:Arial; color:windowtext'>.lcd</span></span>
9074 is added). Then, <span class="Flag"><span style=
9075 'font-size:10.0pt'>-load</span></span> <span class=
9076 "Flag"><span style='font-size:10.0pt'><i>library</i></span></span>
9077 loads the library. The library contains interface information
9078 from the files checked when the library was created.</p>
9079 <h3 style='margin-left:0in;text-indent:0in'><a name=
9080 "_Toc534975035">14.2.1<span style=
9081 'font:7.0pt "Times New Roman"'> </span> Generating
9082 the Standard Libraries</a></h3>
9083 <p class="TextFontCX">The standard libraries are generated from
9084 header files included in the Splint distribution. Some
9085 libraries are generated from more than one header file. Since
9086 the POSIX library subsumes the standard library, the headers for
9087 the standard and POSIX libraries are combined to produce the POSIX
9088 library. Similarly, the UNIX library is composed of the
9089 standard, POSIX and UNIX headers. The header files include
9090 some sections that are conditionally selected by defining
9091 <span class="CodeText"><span style=
9092 'font-size:10.0pt'>STRICT</span></span>. The commands to
9093 generate the standard libraries are:</p>
9094 <p class="example" style=
9095 'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
9096 splint -nolib ansi.h -dump ansi</p>
9097 <p class="example" style=
9098 'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
9099 splint -nolib -DSTRICT ansi.h -dump ansistrict</p>
9100 <p class="example" style=
9101 'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
9102 splint -nolib ansi.h posix.h -dump posix</p>
9103 <p class="example" style=
9104 'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
9105 splint -nolib -DSTRICT ansi.h posix.h -dump posixstrict</p>
9106 <p class="example" style=
9107 'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
9108 splint -nolib ansi.h posix.h unix.h -dump unix</p>
9109 <p class="example" style=
9110 'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
9111 splint -nolib -DSTRICT ansi.h posix.h unix.h -dump unixstrict</p>
9112 <h2 style='margin-left:0in;text-indent:0in'><a name=
9113 "_Ref534979539"></a><a name="_Toc534975036"></a><a name=
9114 "_Ref348080056"></a><a name="_Toc344355448">14.3<span style=
9115 'font:7.0pt "Times New Roman"'> </span>
9116 Header File Inclusion</a></h2>
9117 <p class="TextFontCX">The standard behavior of Splint on
9119 <p class="example"><span class="Keyword"><span style=
9120 'font-size:10.0pt'>#include <<i>X</i>.h></span></span></p>
9121 <p class="TextFontCX">is to search for a file named
9122 <span class="Keyword"><i><span style=
9123 'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
9125 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
9126 on the include search path (set using <span class=
9127 "Flag"><span style='font-size: 10.0pt'>–I</span></span>) and
9128 then the system base include path (read from the <span class=
9129 "CodeText"><span style='font-size:10.0pt'>include</span></span>
9130 environment variable if set or using a default value, usually
9131 <span class="Keyword"><span style=
9132 'font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>).
9133 If <span class="Keyword"><i><span style=
9134 'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
9136 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
9137 is the name of a header file in a loaded standard library and
9138 <span class="Keyword"><i><span style=
9139 'font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span class="Keyword">
9141 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
9142 is found in a directory that is a system directory (as set by the
9143 <span class="Flag"><span style=
9144 'font-size:10.0pt'>-sysdirs</span></span> flag; the default is
9145 <span class="Keyword"><span style=
9146 'font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>),
9147 <span class="Keyword"><i><span style=
9148 'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
9150 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
9151 will not be included if <span class="Flag"><span style=
9152 'font-size:10.0pt'>+skip-iso-headers</span></span> or
9153 <span class="Flag"><span style=
9154 'font-size:10.0pt'>+skip-posix-headers</span></span> (depending
9155 on whether <span class="Keyword"><i><span style=
9156 'font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span class="Keyword">
9158 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
9159 is an ISO or POSIX header file) is on (both are on by
9160 default). To force all headers to be included normally, use
9161 <span class="Flag"><span style=
9162 'font-size: 10.0pt'>‑skip-iso-headers</span></span>. </p>
9163 <p class="TextFontCX"> </p>
9164 <p class="TextFontCX">Sometimes headers in system directories
9165 contain non-standard syntax that Splint is unable to parse.
9166 The <span class="Flag"><span style=
9167 'font-size:10.0pt'>+skip-sys-headers</span></span> flag may be
9168 used to prevent any include file in a system directory from being
9170 <p class="TextFontCX"> </p>
9171 <p class="TextFontCX">Splint is fast enough that it can be run on
9172 medium-size (10,000 line) programs without performance
9173 concerns. Libraries can be used to enable efficient checking
9174 of small modules in large programs. To further improve
9175 performance, header file inclusion can be optimized.</p>
9176 <p class="TextFontCX"> </p>
9177 <p class="TextFontCX">When processing a complete system in which
9178 many files include the same headers, a large fraction of processing
9179 time is wasted re-reading header files unnecessarily. If you
9180 are checking a 100-file program, and every file includes
9181 <span class="Flag"><span style=
9182 'font-size:10.0pt;font-family:Arial;color:windowtext'>utils.h</span></span>,
9183 Splint will have to process <span class=
9184 "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
9185 utils.h</span></span> 100 times (as would most C compilers).
9186 If the <span class="Flag"><span style=
9187 'font-size:10.0pt'>+single-include</span></span> flag is used, each
9188 header file is processed only once. Single header file
9189 processing produces a significant efficiency improvement when
9190 checking large programs split into many files, but is only safe if
9191 the same header file included in different contexts always has the
9192 same meaning (i.e., it does not depend on preprocessor variable
9193 defined differently at different inclusion sites).</p>
9194 <p class="TextFontCX"> </p>
9195 <p class="TextFontCX">When processing a single file in a large
9196 system, a large fraction of the time is spent processing included
9197 header files. This can be avoided if the information in the
9198 header files is stored in a library instead. If
9199 <span class="Flag"><span style=
9200 'font-size:10.0pt'>+never-include</span></span> is set,
9201 inclusion of files ending in <span class="Flag"><span style=
9202 'font-size: 10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
9203 is prevented. Files with different suffixes are
9204 included normally. To do this the header files must not
9205 include any expanded macros. That is, the header file must be
9206 processed with <span class="Flag"><span style=
9207 'font-size:10.0pt'>+all-macros</span></span>, and there must
9208 be no <span class="Annot"><span style=
9209 'font-size:10.0pt'>/*@notfunction@*/</span></span> control
9210 comments in the header. Then, the <span class=
9212 'font-size:10.0pt'>+never-include</span></span> flag may be
9213 used to prevent inclusion of header files. Alternately,
9214 non-function macros can be moved to a different file with a
9215 name that does not end in <span class="Keyword"><span style=
9216 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.
9217 Remember, that this file must be included directly from the
9218 <span class="Keyword"><span style=
9219 'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
9220 file, since if it is included from an <span class=
9221 "Keyword"><span style=
9222 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
9223 file indirectly, that <span class="Keyword"><span style=
9224 'font-size:10.0pt; font-family:Arial;color:windowtext'>.h</span></span>
9225 file is ignored so the other file is never included.</p>
9226 <p class="TextFontCX"> </p>
9227 <p class="TextFontCX">These options can be used for significant
9228 performance improvements on large systems. The performance
9229 depends on how the code is structured, but checking a single module
9230 in a large program is several times faster if libraries and
9231 <span class="Flag"><span style=
9232 'font-size:10.0pt'>+noinclude</span></span> are used.</p>
9233 <h3 style='margin-left:0in;text-indent:0in'><a name=
9234 "_Toc534975037">14.3.1<span style=
9235 'font:7.0pt "Times New Roman"'> </span>
9236 Preprocessing Constants</a></h3>
9237 <p class="TextFontCX">Splint defines the preprocessor constant
9238 <span class="CodeText"><span style=
9239 'font-size:10.0pt'>S_SPLINT_S</span></span> when preprocessing
9240 source files. If you want to include code that is processed
9241 only when Splint is used, surround the code with</p>
9242 <p class="TextFontCX" align="left" style='text-align: left'>
9243 <span class="Keyword"><span style=
9244 'font-size:10.0pt'> </span></span></p>
9245 <p class="TextFontCX" align="left" style='text-align: left'>
9246 <span class="Keyword"><span style='font-size:10.0pt'># ifdef
9247 S_SPLINT_S</span></span></p>
9248 <p class="TextFontCX" align="left" style='text-align: left'>
9249 …</p>
9250 <p class="TextFontCX"><span class="Keyword"><span style=
9251 'font-size:10.0pt'># endif</span></span></p>
9252 <p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
9253 <a name="_Toc534975038"></a><a name="_Toc344355451"></a><a name=
9254 "_Ref343065611">Appendix A<span style=
9255 'font:7.0pt "Times New Roman"'> </span>
9256 <a id="availability" name="availability">
9257 Availability</a></a></p>
9258 <p class="afterlist">The web home page for Splint is
9259 <span class="Keyword"><span style=
9260 'font-size:10.0pt;font-family:Arial;color:windowtext'><a href=
9261 "http://www.splint.org/">http://www.splint.org</a></span></span>.
9262 It includes this guide in HTML format, samples demonstrating
9263 Splint, and links to related web sites. Splint is
9264 available as source code and binary executables for several
9265 platforms. Splint may be freely distributed and
9266 modified under the GNU General Public License. The
9267 latest development code is available through SourceForge.</p>
9268 <p class="TextFontCX"> </p>
9269 <p class="TextFontCX">Splint development is largely driven by
9270 suggestions and comments from users. We are also very
9271 interested in hearing about your experiences using Splint in
9272 developing or maintaining programs, enforcing coding standards, or
9273 teaching courses. For general information, suggestions, and
9274 questions on Splint send mail to <span class=
9275 "Keyword"><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>
9276 splint@cs.virginia.edu</span></span>.</p>
9277 <p class="TextFontCX"> </p>
9278 <p class="TextFontCX">To report a bug in Splint send a message to
9279 <span class="Keyword"><span style=
9280 'font-size:10.0pt;font-family: Arial;color:windowtext'>splint-bug@cs.virginia.edu</span></span>.</p>
9281 <p class="TextFontCX"> </p>
9282 <p class="beforelist">There are two mailing lists associated with
9284 <p class="URL"><span class="Keyword"><span style=
9285 'font-family:Arial;color:windowtext'>splint-announce@virginia.edu</span></span></p>
9286 <p class="IndentText">Reserved for announcements of new releases
9287 and bug fixes. All users should add themselves to this
9289 <p class="URL"><span class="Keyword"><span style=
9290 'font-family:Arial;color:windowtext'>splint-interest@virginia.edu</span></span></p>
9291 <p class="IndentText">Informal discussions on the use and
9292 development of Splint. </p>
9293 <p class="TextFontCX"> </p>
9294 <p class="TextFontCX"><a name="_Ref344882161"></a><a name=
9295 "_Ref344871249"></a><a name="_Ref344870532"></a><a name=
9296 "_Ref344870294">To subscribe to a mailing list, send a message
9297 to</a> <span class="PlainText"><span style=
9298 'font-size:10.0pt;font-family:Arial'>majordomo@virginia.edu</span></span>
9299 containing the body</p>
9300 <p class="URL"><span class="Keyword"><span style=
9301 'font-family:Arial;color:windowtext'>subscribe
9302 splint-announce</span></span><span style=
9303 'font-size:11.0pt;font-family:"Times New Roman"'>or</span>
9304 <span class="Keyword"><span style=
9305 'font-family:Arial;color:windowtext'>subscribe
9306 splint-interest</span></span><a name=
9307 "_Ref348343340"></a><a name="_Ref348330382">.</a></p>
9308 <p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
9309 <a name="_Toc534975039"></a><a name="_Ref397875360">Appendix
9311 'font:7.0pt "Times New Roman"'> </span>
9312 <a id="flags" name="flags">
9314 </a><a name="_Toc344355437"></a></p>
9315 <p class="beforelist">There are four different types of flags:</p>
9316 <p class="MsoListBullet"><span style=
9317 'font-family:Symbol'>·<span style=
9318 'font:7.0pt "Times New Roman"'> </span></span>
9319 Global flags for controlling initializations and global
9321 <p class="MsoListBullet"><span style=
9322 'font-family:Symbol'>·<span style=
9323 'font:7.0pt "Times New Roman"'> </span></span>
9324 Message format flags for controlling how messages are displayed</p>
9325 <p class="MsoListBullet"><span style=
9326 'font-family:Symbol'>·<span style=
9327 'font:7.0pt "Times New Roman"'> </span></span>
9328 Mode selectors for coarse control of Splint checking</p>
9329 <p class="MsoListBullet"><span style=
9330 'font-family:Symbol'>·<span style=
9331 'font:7.0pt "Times New Roman"'> </span></span>
9332 Checking flags that control checking and what classes of messages
9334 <p class="afterlist">Global flags can be used in initialization
9335 files and at the command line; all other flags may also be used in
9336 control comments.</p>
9337 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
9338 <a name="_Toc534975050">Key</a></p>
9339 <p class="beforelist">To the left of each flag name is a flag
9340 descriptor encoding what kind of flag it is and its default
9341 value. The descriptions are:</p>
9343 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9344 height="14" align="left">
9346 <td valign="top" align="left" height="14" style=
9347 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9348 <p class="TextFontCX" align="center" style=
9349 'text-align:center;background:#CCCCCC'><span style=
9350 'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
9351 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
9352 <p class="TextFontCX">A <i>plain</i> flag. The value after
9353 the colon gives the default setting (e.g., this flag is
9355 <p class="TextFontCX"> </p>
9357 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9358 height="14" align="left">
9360 <td valign="top" align="left" height="14" style=
9361 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9362 <p class="TextFontCX" align="center" style=
9363 'text-align:center;background:#CCCCCC'><span style=
9364 'font-size:10.0pt'>m:</span><span class="Flag"><span style=
9365 'font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
9366 <p class="TextFontCX">A <i>mode checking flag</i>. The value
9367 of the flag is set by the mode selector. The four signs give
9368 the setting in the weak, standard, checks and strict modes. (e.g.,
9369 this flag is off in the weak and standard modes, and on in the
9370 checks and strict modes.)</p>
9371 <p class="TextFontCX"> </p>
9373 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9374 height="14" align="left">
9376 <td valign="top" align="left" height="14" style=
9377 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9378 <p class="TextFontCX" align="center" style=
9379 'text-align:center;background:#CCCCCC'><span style=
9380 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
9381 <p class="TextFontCX">A <i>shortcut</i> flag. This flag sets
9382 other flags, so it has no default value.</p>
9383 <p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
9384 <a name="_Toc534975061">Flag Name Abbreviations</a></p>
9385 <p class="beforelist">Within a flag name, abbreviations may be
9386 used. Figure 25 shows the flag name abbreviations. The
9387 expanded and short forms are interchangeable in flag names.</p>
9389 <table class="MsoNormalTable" border="0" cellspacing="0"
9390 cellpadding="0" style=
9391 'margin-left:99.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
9393 <td valign="top" style=
9394 'width:171.0pt;border:none;border-bottom:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
9395 <p class="TextFontCX" align="center" style='text-align:center'>
9396 Expanded Form</p></td>
9397 <td valign="top" style=
9398 'width:67.5pt;border:none;border-bottom:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
9399 <p class="TextFontCX" align="center" style='text-align:center'>
9400 Short Form</p></td></tr>
9402 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9403 <p class="TextFontCX"><span class="Flag"><span style=
9404 'font-size:10.0pt'>constant</span></span></p></td>
9405 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9406 <p class="TextFontCX"><span class="Flag"><span style=
9407 'font-size:10.0pt'>const</span></span></p></td></tr>
9409 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9410 <p class="TextFontCX"><span class="Flag"><span style=
9411 'font-size:10.0pt'>declaration</span></span></p></td>
9412 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9413 <p class="TextFontCX"><span class="Flag"><span style=
9414 'font-size:10.0pt'>decl</span></span></p></td></tr>
9416 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9417 <p class="TextFontCX"><span class="Flag"><span style=
9418 'font-size:10.0pt'>function</span></span></p></td>
9419 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9420 <p class="TextFontCX"><span class="Flag"><span style=
9421 'font-size:10.0pt'>fcn</span></span></p></td></tr>
9423 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9424 <p class="TextFontCX"><span class="Flag"><span style=
9425 'font-size:10.0pt'>global</span></span></p></td>
9426 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9427 <p class="TextFontCX"><span class="Flag"><span style=
9428 'font-size:10.0pt'>glob</span></span></p></td></tr>
9430 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9431 <p class="TextFontCX"><span class="Flag"><span style=
9432 'font-size:10.0pt'>implicit</span></span><span class=
9434 'font-size:10.0pt;font-family:"Times New Roman"'>,</span></span>
9435 <span class="Flag"><span style=
9436 'font-size:10.0pt'>implied</span></span></p></td>
9437 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9438 <p class="TextFontCX"><span class="Flag"><span style=
9439 'font-size:10.0pt'>imp</span></span></p></td></tr>
9441 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9442 <p class="TextFontCX"><span class="Flag"><span style=
9443 'font-size:10.0pt'>iterator</span></span></p></td>
9444 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9445 <p class="TextFontCX"><span class="Flag"><span style=
9446 'font-size:10.0pt'>iter</span></span></p></td></tr>
9448 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9449 <p class="TextFontCX"><span class="Flag"><span style=
9450 'font-size:10.0pt'>length</span></span></p></td>
9451 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9452 <p class="TextFontCX"><span class="Flag"><span style=
9453 'font-size:10.0pt'>len</span></span></p></td></tr>
9455 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9456 <p class="TextFontCX"><span class="Flag"><span style=
9457 'font-size:10.0pt'>modifies</span></span></p></td>
9458 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9459 <p class="TextFontCX"><span class="Flag"><span style=
9460 'font-size:10.0pt'>mods</span></span></p></td></tr>
9462 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9463 <p class="TextFontCX"><span class="Flag"><span style=
9464 'font-size:10.0pt'>modify</span></span></p></td>
9465 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9466 <p class="TextFontCX"><span class="Flag"><span style=
9467 'font-size:10.0pt'>mod</span></span></p></td></tr>
9469 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9470 <p class="TextFontCX"><span class="Flag"><span style=
9471 'font-size:10.0pt'>memory</span></span></p></td>
9472 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9473 <p class="TextFontCX"><span class="Flag"><span style=
9474 'font-size:10.0pt'>mem</span></span></p></td></tr>
9476 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9477 <p class="TextFontCX"><span class="Flag"><span style=
9478 'font-size:10.0pt'>parameter</span></span></p></td>
9479 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9480 <p class="TextFontCX"><span class="Flag"><span style=
9481 'font-size:10.0pt'>param</span></span></p></td></tr>
9483 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9484 <p class="TextFontCX"><span class="Flag"><span style=
9485 'font-size:10.0pt'>pointer</span></span></p></td>
9486 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9487 <p class="TextFontCX" style='page-break-after: avoid'>
9488 <span class="Flag"><span style=
9489 'font-size:10.0pt'>ptr</span></span></p></td></tr>
9491 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9492 <p class="TextFontCX"><span class="Flag"><span style=
9493 'font-size:10.0pt'>return</span></span></p></td>
9494 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9495 <p class="TextFontCX"><span class="Flag"><span style=
9496 'font-size:10.0pt'>ret</span></span></p></td></tr>
9498 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9499 <p class="TextFontCX"><span class="Flag"><span style=
9500 'font-size:10.0pt'>variable</span></span></p></td>
9501 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9502 <p class="TextFontCX"><span class="Flag"><span style=
9503 'font-size:10.0pt'>var</span></span></p></td></tr>
9505 <td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
9506 <p class="TextFontCX"><span class="Flag"><span style=
9507 'font-size:10.0pt'>unconstrained, unconst</span></span></p></td>
9508 <td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
9509 <p class="TextFontCX" style='page-break-after: avoid'>
9510 <span class="Flag"><span style=
9511 'font-size:10.0pt'>uncon</span></span></p></td></tr></table>
9512 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
9514 <td valign="top" style=
9515 'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
9516 <p class="MsoCaption"><a name="_Toc534824627"></a><a name=
9517 "_Ref534824456">Figure 25</a>. Flag Name
9518 Abbreviations</p></td></tr></table></center>
9519 <p class="beforelist">The expanded and short forms are
9520 interchangeable in flag names.</p>
9521 <p class="beforelist">For example, <span class=
9522 "Flag"><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>
9523 and <span class="Flag"><span style=
9524 'font-size:10.0pt'>globalsimpliesmodifiesnothing</span></span>
9525 denote the same flag. Abbreviations in flag names allow
9526 pronounceable, descriptive names to be used without making
9527 flag names excessively long (although one must admit even
9528 <span class="Flag"><span style=
9529 'font-size:10.0pt'>globsimpmodsnothing</span></span> is a bit
9531 <p class="TextFontCX">To make flag names more readable, the space,
9532 dash (<span class="Flag"><span style=
9533 'font-size:10.0pt'>-</span></span>), and underscore
9534 (<span class="Flag"><span style=
9535 'font-size:10.0pt'>_</span></span>) characters may be used
9536 inside a flag name. Hence, <span class=
9538 'font-size:10.0pt'>globals-implies-modifies-nothing</span></span>,
9539 <span class="Flag"><span style=
9540 'font-size:10.0pt'>glob_imps_­mods­nothing</span></span>
9541 and <span class="Flag"><span style=
9542 'font-size:10.0pt'>globsimpmodsnothing</span></span> are
9544 <p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
9545 <a name="_Toc534975040">Global Flags</a></p>
9546 <p class="TextFontCX">Global flags can be set at the command line
9547 or in an options file, but cannot be set locally using stylized
9548 comments. These flags control on-line help, initialization
9549 files, pre-processor flags, libraries and output.</p>
9550 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
9551 <a name="_Toc534975041">Help</a></p>
9552 <p class="beforelist">On-line help provides documentation on Splint
9553 operation and flags. When a help flag is used, no checking is
9554 done by Splint. Help flags may be preceded by
9555 <span class="Flag"><span style=
9556 'font-size:10.0pt'>-</span></span> or <span class=
9557 "Flag"><span style='font-size:10.0pt'>+</span></span>.</p>
9558 <p class="TextFontCX"><span class="Flag"><span style=
9559 'font-size:10.0pt'>help</span></span></p>
9560 <p class="IndentText">Display general help overview, including list
9561 of additional help topics.</p>
9562 <p class="TextFontCX"><span class="Flag"><span style=
9563 'font-size:10.0pt'>help</span></span> <span class=
9565 'font-size:10.0pt'><topic></span></span></p>
9566 <p class="indentbefore">Display help on <i><topic></i>.
9567 Available topics:</p>
9568 <table class="MsoNormalTable" border="0" cellspacing="0"
9569 cellpadding="0" style=
9570 'width:400.5pt;margin-left:27.9pt;border-collapse:collapse'>
9572 <td valign="top" style=
9573 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9574 <p class="TextFontCX" style='text-indent:5.4pt'><span class=
9576 'font-size:10.0pt'>annotations</span></span></p></td>
9577 <td valign="top" style=
9578 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9579 <p class="TextFontCX" align="left" style='text-align:left'>describe
9580 annotations</p></td></tr>
9582 <td valign="top" style=
9583 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9584 <p class="TextFontCX"><span class="Flag"><span style=
9585 'font-size:10.0pt'>comments</span></span></p></td>
9586 <td valign="top" style=
9587 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9588 <p class="TextFontCX" align="left" style='text-align:left'>describe
9589 control comments</p></td></tr>
9591 <td valign="top" style=
9592 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9593 <p class="TextFontCX"><span class="Flag"><span style=
9594 'font-size:10.0pt'>flags</span></span></p></td>
9595 <td valign="top" style=
9596 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9597 <p class="TextFontCX" align="left" style='text-align:left'>describe
9598 flag categories</p></td></tr>
9600 <td valign="top" style=
9601 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9602 <p class="TextFontCX"><span class="Flag"><span style=
9603 'font-size:10.0pt'>flags
9604 <i><category></i></span></span></p></td>
9605 <td valign="top" style=
9606 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9607 <p class="TextFontCX" align="left" style='text-align:left'>all
9608 flags pertaining to <category> (one of the categories listed
9609 by <span class="Flag"><span style='font-size:10.0pt'>splint -help
9610 flags</span></span>)</p></td></tr>
9612 <td valign="top" style=
9613 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9614 <p class="TextFontCX"><span class="Flag"><span style=
9615 'font-size:10.0pt'>flags alpha</span></span>
9616 </p></td>
9617 <td valign="top" style=
9618 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9619 <p class="TextFontCX" align="left" style='text-align:left'>all
9620 flags in alphabetical order</p></td></tr>
9622 <td valign="top" style=
9623 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9624 <p class="TextFontCX"><span class="Flag"><span style=
9625 'font-size:10.0pt'>flags full</span></span></p></td>
9626 <td valign="top" style=
9627 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9628 <p class="TextFontCX" align="left" style='text-align:left'>print a
9629 full description of all flags</p></td></tr>
9631 <td valign="top" style=
9632 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9633 <p class="TextFontCX"><span class="Flag"><span style=
9634 'font-size:10.0pt'>mail</span></span></p></td>
9635 <td valign="top" style=
9636 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9637 <p class="TextFontCX" align="left" style='text-align:left'>print
9638 information on mailing lists</p></td></tr>
9640 <td valign="top" style=
9641 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9642 <p class="TextFontCX"><span class="Flag"><span style=
9643 'font-size:10.0pt'>modes</span></span></p></td>
9644 <td valign="top" style=
9645 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9646 <p class="TextFontCX" align="left" style='text-align:left'>flags
9647 settings in modes</p></td></tr>
9649 <td valign="top" style=
9650 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9651 <p class="TextFontCX"><span class="Flag"><span style=
9652 'font-size:10.0pt'>prefixcodes</span></span></p></td>
9653 <td valign="top" style=
9654 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9655 <p class="TextFontCX" align="left" style='text-align:left'>
9656 character codes for setting namespace prefixes</p></td></tr>
9658 <td valign="top" style=
9659 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9660 <p class="TextFontCX"><span class="Flag"><span style=
9661 'font-size:10.0pt'>references</span></span></p></td>
9662 <td valign="top" style=
9663 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9664 <p class="TextFontCX" align="left" style='text-align:left'>print
9665 references to relevant papers and web sites</p></td></tr>
9667 <td valign="top" style=
9668 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9669 <p class="TextFontCX"><span class="Flag"><span style=
9670 'font-size:10.0pt'>vars</span></span></p></td>
9671 <td valign="top" style=
9672 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9673 <p class="TextFontCX" align="left" style='text-align:left'>describe
9674 environment variables</p></td></tr>
9676 <td valign="top" style=
9677 'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
9678 <p class="TextFontCX"><span class="Flag"><span style=
9679 'font-size:10.0pt'>version</span></span></p></td>
9680 <td valign="top" style=
9681 'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
9682 <p class="TextFontCX" align="left" style='text-align:left'>print
9683 maintainer and version information</p>
9684 <p class="TextFontCX" align="left" style='text-align:left'>
9685 </p></td></tr></table>
9686 <p class="afterlist"><span class="Flag"><span style=
9687 'font-size:10.0pt'>help</span></span> <span class=
9689 'font-size:10.0pt'><flag></span></span></p>
9690 <p class="IndentText">Describe flag <i><flag></i>. (May
9691 list several flags.)</p>
9692 <p class="TextFontCX"><span class="Flag"><span style=
9693 'font-size:10.0pt'>warn-flags</span></span></p>
9694 <p class="IndentText">Display a warning when a flag is set in a
9695 surprising way. An error is reported if an obsolete flag is
9696 set, a flag is set to its current value (i.e., the
9697 <span class="Flag"><span style=
9698 'font-size:10.0pt'>+</span></span> or <span class=
9699 "Flag"><span style='font-size:10.0pt'>-</span></span> may be
9700 wrong), or a mode selector flag is set after mode checking
9701 flags that will be reset by the mode were set. By
9702 default, <span class="Flag"><span style=
9703 'font-size:10.0pt'>+warn-flags</span></span> is on. To
9704 suppress flag warnings, use <span class="Flag"><span style=
9705 'font-size:10.0pt'>‑warn-flags</span></span>.</p>
9707 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9708 height="14" align="left">
9710 <td valign="top" align="left" height="14" style=
9711 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9712 <p class="TextFontCX" align="center" style=
9713 'text-align:center;background:#CCCCCC'><span style=
9714 'font-size:10.0pt'>P:</span> <span class=
9715 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
9716 <p class="TextFontCX"><span class="Flag"><span style=
9717 'font-size:10.0pt'>warn-rc</span></span></p>
9718 <p class="IndentText">There was a problem reading an initialization
9721 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9722 height="14" align="left">
9724 <td valign="top" align="left" height="14" style=
9725 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9726 <p class="TextFontCX" align="center" style=
9727 'text-align:center;background:#CCCCCC'><span style=
9728 'font-size:10.0pt'>P:</span> <span class=
9729 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
9730 <p class="TextFontCX"><span class="Flag"><span style=
9731 'font-size:10.0pt'>bad-flag</span></span></p>
9732 <p class="IndentText">A flag is not recognized or used in an
9735 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9736 height="14" align="left">
9738 <td valign="top" align="left" height="14" style=
9739 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9740 <p class="TextFontCX" align="center" style=
9741 'text-align:center;background:#CCCCCC'><span style=
9742 'font-size:10.0pt'>P:</span> <span class=
9743 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
9744 <p class="TextFontCX"><span class="Flag"><span style=
9745 'font-size:10.0pt'>fileextensions</span></span></p>
9746 <p class="IndentText">Warn when command line file does not have a
9747 recognized extension.</p>
9748 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
9749 <a name="_Toc534975042">Initialization</a></p>
9750 <p class="beforelist">These flags control directories and files
9751 used by Splint. They may be used from the command line or in
9752 an options file, but may not be used as control comments in the
9753 source code. Except where noted. they have the same meaning
9754 preceded by <span class="Flag"><span style=
9755 'font-size:10.0pt'>-</span></span> or <span class=
9756 "Flag"><span style='font-size:10.0pt'>+</span></span>. </p>
9757 <p class="TextFontCX"><span class="Flag"><span style=
9758 'font-size:10.0pt'>tmpdir</span></span> <span class=
9760 'font-size:10.0pt'><i><directory></i></span></span></p>
9761 <p class="IndentText">Set directory for writing temp files.
9762 Default is <span class="ProgramNameChar"><span style=
9763 'font-size:10.0pt'>/tmp/</span></span>.</p>
9764 <p class="TextFontCX"><span class="Flag"><span style=
9765 'font-size:10.0pt'>I<i><directory></i></span></span></p>
9766 <p class="IndentText">Add directory to path searched for C include
9767 files. Note there is no space after the <span class=
9768 "Flag"><span style='font-size:10.0pt'>I</span></span>, to be
9769 consistent with C preprocessor flags.</p>
9770 <p class="TextFontCX"><span class="Flag"><span style=
9771 'font-size:10.0pt'>S<i><directory></i></span></span></p>
9772 <p class="IndentText">Add directory to path search for
9773 <span class="ProgramNameChar"><span style=
9774 'font-size:10.0pt'>.lcl</span></span> specification
9776 <p class="IndentText"> </p>
9777 <p class="TextFontCX"><span class="Flag"><span style=
9778 'font-size:10.0pt'>larchpath</span></span> <span class=
9780 'font-size:10.0pt'><i><path></i></span></span></p>
9781 <p class="IndentText">Set path to search for library files.
9782 Overrides <span class="CodeText"><span style=
9783 'font-size:10.0pt'>LARCH_PATH</span></span> environment
9785 <p class="TextFontCX"><span class="Flag"><span style=
9786 'font-size:10.0pt'>lclimportdir</span></span> <span class=
9788 'font-size:10.0pt'><i><directory></i></span></span></p>
9789 <p class="IndentText">Set directory to search for LCL import
9790 files. Overrides<span class="CodeText"><span style=
9791 'font-size:10.0pt'>LCLIMPORTDIR</span></span> environment
9793 <p class="IndentText"> </p>
9794 <p class="TextFontCX"><span class="Flag"><span style=
9795 'font-size:10.0pt'>f</span></span> <span class=
9796 "Flag"><span style='font-size:10.0pt'><i><file></i></span></span></p>
9797 <p class="MsoNormal" style='margin-left:13.5pt'>Load options from
9798 <span class="Flag"><i><span style=
9799 'font-size:10.0pt'><file></span></i></span>. If this
9800 flag is used from the command line, the default <span class=
9801 "FileNameChar"><span style=
9802 'font-size:10.0pt'>~/.splintrc</span></span> file is not
9803 loaded. This flag may be used in an options file to include
9804 another options file.</p>
9805 <p class="TextFontCX"><span class="Flag"><span style=
9806 'font-size:10.0pt'>i</span></span> <span class=
9807 "Flag"><span style='font-size:10.0pt'><i><file></i></span></span></p>
9808 <p class="MsoNormal" style='margin-left:13.5pt'>Set LCL
9809 initilization file.</p>
9810 <p class="TextFontCX"><span class="Flag"><span style=
9811 'font-size:10.0pt'>nof</span></span></p>
9812 <p class="IndentText">Prevents the default options files
9813 (<span class="FileNameChar"><span style=
9814 'font-size:10.0pt'>./.splintrc</span></span>and <span class=
9815 "FileNameChar"><span style=
9816 'font-size:10.0pt'>~/.splintrc</span></span>) from being
9817 loaded. (Setting <span class="Flag"><span style=
9818 'font-size:10.0pt'>-nof</span></span> overrides <span class=
9819 "Flag"><span style='font-size:10.0pt'>+nof</span></span>, causing
9820 the options files to be loaded normally.)</p>
9821 <p class="TextFontCX"><span class="Flag"><span style=
9822 'font-size:10.0pt'>sys-dirs</span></span></p>
9823 <p class="IndentText">Set directories for system files (default is
9824 <span class="FileNameChar"><span style=
9825 'font-size:10.0pt'>/usr/</span></span>). Separate directories
9826 with the path separator for your operating system (e.g.,
9827 semi-colons for Windows or colons for Unix: <span class=
9828 "FileNameChar"><span style=
9829 'font-size:10.0pt'>/usr/include:/usr/local/lib</span></span>).
9830 Flag settings propagate to files in a system directory. If
9831 <span class="Flag"><span style=
9832 'font-size:10.0pt'>-sys-dir-errors</span></span> is set, no errors
9833 are reported for files in system directories.</p>
9834 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
9835 <a name="_Toc534975043"></a><a name=
9836 "_Ref345883190">Pre-processor</a></p>
9838 <p class="beforelist">These flags are used to define or undefine
9839 pre-processor constants. The <span class=
9840 "Flag"><span style='font-size:10.0pt'>-I<i><directory></i></span></span>
9841 flag is also passed to the C pre-processor.</p>
9842 <p class="TextFontCX"><span class="Flag"><span style=
9843 'font-size:10.0pt'>D<initializer></span></span></p>
9844 <p class="IndentText">Passed to the C pre-processor.</p>
9846 <p class="FileName0" style='margin-left:0in'><span class=
9847 "Flag">U<initializer></span></p>
9848 <p class="IndentText">Passed to the C pre-processor.</p>
9851 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9852 height="14" align="left">
9854 <td valign="top" align="left" height="14" style=
9855 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9856 <p class="TextFontCX" align="center" style=
9857 'text-align:center;background:#CCCCCC'><span style=
9858 'font-size:10.0pt'>P:</span> <span class=
9859 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
9860 <p class="TextFontCX"><span class="Flag"><span style=
9861 'font-size:10.0pt'>unrecogdirective</span></span></p>
9862 <p class="IndentText">Preprocessor directive is not recognized.
9866 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9867 height="14" align="left">
9869 <td valign="top" align="left" height="14" style=
9870 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9871 <p class="TextFontCX" align="center" style=
9872 'text-align:center;background:#CCCCCC'><span style=
9873 'font-size:10.0pt'>P:</span> <span class=
9874 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
9875 <p class="TextFontCX"><span class="Flag"><span style=
9876 'font-size:10.0pt'>preproc</span></span></p>
9877 <p class="IndentText">Preprocessing error.
9881 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
9882 <a name="_Toc534975044">Libraries</a></p>
9883 <p class="beforelist">These flags control the creation and use of
9885 <p class="TextFontCX"><span class="Flag"><span style=
9886 'font-size:10.0pt'>dump</span></span> <span class=
9888 'font-size:10.0pt'><i><file></i></span></span></p>
9889 <p class="IndentText">Save state in <span class=
9890 "Flag"><i><span style=
9891 'font-size: 10.0pt'><file></span></i></span> for
9892 loading. The default extension <span class=
9893 "ProgramNameChar"><span style='font-size:10.0pt'>.lcd</span></span>
9894 is added if <span class="Flag"><i><span style=
9895 'font-size:10.0pt'><file></span></i></span> has no
9897 <p class="TextFontCX"><span class="Flag"><span style=
9898 'font-size:10.0pt'>load</span></span><span class=
9899 "Flag"><span style='font-size:10.0pt'> <i><file></i></span></span></p>
9900 <p class="IndentText">Load state from <span class=
9901 "Flag"><i><span style=
9902 'font-size: 10.0pt'><file></span></i></span> (created by
9903 <span class="Flag"><span style=
9904 'font-size:10.0pt'>-dump</span></span>). The default
9905 extension <span class="FileNameChar"><span style=
9906 'font-size:10.0pt'>.lcd</span></span> is added if
9907 <span class="Flag"><i><span style=
9908 'font-size:10.0pt'><file></span></i></span> has no
9909 extension. Only one library file may be loaded.</p>
9910 <p class="betweenlists">By default, the standard library is loaded
9911 if the <span class="Flag"><span style=
9912 'font-size:10.0pt'>-load</span></span> flag is not used to load a
9913 user library. If no user library is loaded, one of the
9914 following flags may be used to select a different standard
9915 library. Precede the flag by <span class=
9916 "Flag"><span style='font-size:10.0pt'>+</span></span> to load
9917 the described library (or to prevent a library from being
9918 loaded using <span class="Flag"><span style=
9919 'font-size:10.0pt'>no-lib</span></span>). See Section 14.1
9920 for information on the provided libraries.</p>
9921 <p class="TextFontCX"><span class="Flag"><span style=
9922 'font-size:10.0pt'>no-lib</span></span></p>
9923 <p class="IndentText">Do not load any library. This prevents
9924 the standard library from being loaded.</p>
9925 <p class="TextFontCX"><span class="Flag"><span style=
9926 'font-size:10.0pt'>ansi-lib</span></span></p>
9927 <p class="IndentText">Use the ANSI standard library (selected by
9929 <p class="TextFontCX"><span class="Flag"><span style=
9930 'font-size:10.0pt'>strict-lib</span></span></p>
9931 <p class="IndentText">Use strict version of the ANSI standard
9933 <p class="TextFontCX"><span class="Flag"><span style=
9934 'font-size:10.0pt'>posix-lib</span></span></p>
9935 <p class="IndentText">Use the POSIX standard library.</p>
9936 <p class="TextFontCX"><span class="Flag"><span style=
9937 'font-size:10.0pt'>posix-strict-lib</span></span></p>
9938 <p class="IndentText">Use the strict version of the POSIX standard
9940 <p class="TextFontCX"><span class="Flag"><span style=
9941 'font-size:10.0pt'>unix-lib</span></span></p>
9942 <p class="IndentText">Use UNIX version of standard library.</p>
9943 <p class="TextFontCX"><span class="Flag"><span style=
9944 'font-size:10.0pt'>unix-strict-lib</span></span></p>
9945 <p class="IndentText">Use the strict version of the UNIX standard
9947 <p class="IndentText"> </p>
9948 <p class="TextFontCX"><span class="Flag"><span style=
9949 'font-size:10.0pt'>which-lib</span></span></p>
9950 <p class="IndentText">Print out the standard library filename and
9951 creation information.</p>
9954 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9955 height="14" align="left">
9957 <td valign="top" align="left" height="14" style=
9958 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9959 <p class="TextFontCX" align="center" style=
9960 'text-align:center;background:#CCCCCC'><span style=
9961 'font-size:10.0pt'>P:</span> <span class=
9962 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
9963 <p class="TextFontCX"><span class="Flag"><span style=
9964 'font-size:10.0pt'>newdecl</span></span></p>
9965 <p class="IndentText">There is a new declaration that is not declared in a loaded library or
9966 earlier file. (Use this flag to check for consistency against a library.)
9971 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
9972 height="14" align="left">
9974 <td valign="top" align="left" height="14" style=
9975 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
9976 <p class="TextFontCX" align="center" style=
9977 'text-align:center;background:#CCCCCC'><span style=
9978 'font-size:10.0pt'>P:</span> <span class=
9979 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
9980 <p class="TextFontCX"><span class="Flag"><span style=
9981 'font-size:10.0pt'>impconj</span></span></p>
9982 <p class="IndentText">Make all alternate types implicit (useful for making system libraries).
9985 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
9986 <a name="_Toc534975045">Output</a></p>
9987 <p class="beforelist">These flags control what additional
9988 information Splint prints. Setting <span class=
9990 'font-size:10.0pt'>+<i><flag></i></span></span> causes the
9991 described information to be printed; setting <span class=
9993 'font-size:10.0pt'>-<i><flag></i></span></span> prevents
9994 it. By default, all these flags are off.</p>
9995 <p class="TextFontCX"><span class="Flag"><span style=
9996 'font-size:10.0pt'>use-stderr</span></span></p>
9997 <p class="IndentText">Send error messages to standard error
9998 (instead of standard output).</p>
9999 <p class="TextFontCX"><span class="Flag"><span style=
10000 'font-size:10.0pt'>show-summary</span></span></p>
10001 <p class="IndentText">Show a summary of all errors reported and
10002 suppressed. Counts of suppressed errors are not necessarily
10003 correct since turning a flag off may prevent some checking from
10004 being done to save computation, and errors that are not reported
10005 may propagate differently from when they are reported.</p>
10006 <p class="TextFontCX"><span class="Flag"><span style=
10007 'font-size:10.0pt'>show-scan</span></span></p>
10008 <p class="IndentText">Show file names are they are processed.</p>
10009 <p class="TextFontCX"><span class="Flag"><span style=
10010 'font-size:10.0pt'>show-all-uses</span></span></p>
10011 <p class="IndentText">Show list of uses of all external identifiers
10012 sorted by number of uses.</p>
10013 <p class="TextFontCX"><span class="Flag"><span style=
10014 'font-size:10.0pt'>stats</span></span></p>
10015 <p class="IndentText">Display number of lines processed and
10017 <p class="TextFontCX"><span class="Flag"><span style=
10018 'font-size:10.0pt'>time-dist</span></span></p>
10019 <p class="IndentText">Display distribution of where checking time
10021 <p class="TextFontCX"><span class="Flag"><span style=
10022 'font-size:10.0pt'>quiet</span></span></p>
10023 <p class="IndentText">Suppress herald and error count. (If
10024 <span class="Flag"><span style=
10025 'font-size:10.0pt'>quiet</span></span> is not set, Splint prints
10026 out a herald with version information before checking begins, and a
10027 line summarizing the total number of errors reported.)</p>
10029 <p class="TextFontCX"><span class="Flag"><span style=
10030 'font-size:10.0pt'>iso-lib</span></span></p>
10031 <p class="IndentText">Use library based on the ISO standard library specification.
10034 <p class="TextFontCX"><span class="Flag"><span style=
10035 'font-size:10.0pt'>warn-unix-lib</span></span></p>
10036 <p class="IndentText">
10037 Warn when the unix library is used. Unix library may not be compatible with all platforms.
10040 <p class="TextFontCX"><span class="Flag"><span style=
10041 'font-size:10.0pt'>which-lib</span></span></p>
10042 <p class="IndentText">Print out the standard library filename and
10043 creation information.</p>
10048 <p class="TextFontCX"><span class="Flag"><span style=
10049 'font-size:10.0pt'>limit</span></span> <span class=
10050 "Flag"><span style=
10051 'font-size:10.0pt'><i><number></i></span></span></p>
10052 <p class="IndentText">At most <span class=
10053 "Flag"><i><span style='font-size:10.0pt'><number></span></i></span>
10054 similar errors are reported consecutively. Further
10055 errors are suppressed, and a message showing the number of
10056 suppressed messages is printed.</p>
10059 <p class="TextFontCX"><span class="Flag"><span style=
10060 'font-size:10.0pt'>message-stream</span></span> <span class=
10061 "Flag"><span style=
10062 'font-size:10.0pt'><i><file></i></span></span></p>
10063 <p class="IndentText">
10064 Send status messages to <i><span style='font-size:10.0pt'><file></span></i>.
10068 <p class="TextFontCX"><span class="Flag"><span style=
10069 'font-size:10.0pt'>message-stream-stdout</span></span> <span class=
10070 "Flag"><span style=
10071 'font-size:10.0pt'></span></span></p>
10072 <p class="IndentText">
10073 Send status messages to standard output stream.
10077 <p class="TextFontCX"><span class="Flag"><span style=
10078 'font-size:10.0pt'>message-stream-stderr</span></span> <span class=
10079 "Flag"><span style=
10080 'font-size:10.0pt'></span></span></p>
10081 <p class="IndentText">
10082 Send status messages to standard error stream.
10086 <p class="TextFontCX"><span class="Flag"><span style=
10087 'font-size:10.0pt'>warning-stream</span></span> <span class=
10088 "Flag"><span style=
10089 'font-size:10.0pt'><i><file></i></span></span></p>
10090 <p class="IndentText">
10091 Send warnings to <i><span style='font-size:10.0pt'><file></span></i>.
10095 <p class="TextFontCX"><span class="Flag"><span style=
10096 'font-size:10.0pt'>warning-stream-stdout</span></span> <span class=
10097 "Flag"><span style=
10098 'font-size:10.0pt'></span></span></p>
10099 <p class="IndentText">
10100 Send warnings to standard output stream.
10104 <p class="TextFontCX"><span class="Flag"><span style=
10105 'font-size:10.0pt'>warning-stream-stderr</span></span> <span class=
10106 "Flag"><span style=
10107 'font-size:10.0pt'></span></span></p>
10108 <p class="IndentText">
10109 Send warnings to standard error stream.
10113 <p class="TextFontCX"><span class="Flag"><span style=
10114 'font-size:10.0pt'>error-stream</span></span> <span class=
10115 "Flag"><span style=
10116 'font-size:10.0pt'><i><file></i></span></span></p>
10117 <p class="IndentText">
10118 Send fatal errors to <i><span style='font-size:10.0pt'><file></span></i>.
10122 <p class="TextFontCX"><span class="Flag"><span style=
10123 'font-size:10.0pt'>error-stream-stdout</span></span> <span class=
10124 "Flag"><span style=
10125 'font-size:10.0pt'></span></span></p>
10126 <p class="IndentText">
10127 Send fatal errors to standard output stream.
10131 <p class="TextFontCX"><span class="Flag"><span style=
10132 'font-size:10.0pt'>error-stream-stderr</span></span> <span class=
10133 "Flag"><span style=
10134 'font-size:10.0pt'></span></span></p>
10135 <p class="IndentText">
10136 Send fatal errors to standard error stream.
10140 <p class="TextFontCX"><span class="Flag"><span style=
10141 'font-size:10.0pt'>limit</span></span> <span class=
10142 "Flag"><span style=
10143 'font-size:10.0pt'><i><number></i></span></span></p>
10144 <p class="IndentText">At most <span class=
10145 "Flag"><i><span style='font-size:10.0pt'><number></span></i></span>
10146 similar errors are reported consecutively. Further
10147 errors are suppressed, and a message showing the number of
10148 suppressed messages is printed.</p>
10150 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
10151 <a name="_Toc534975046">Expected Errors</a></p>
10152 <p class="beforelist">Normally, Splint will expect to report no
10153 errors. The exit status will be success (<span class=
10154 "Keyword"><span style='font-size:10.0pt'>0</span></span>) if no
10155 errors are reported, and failure if any errors are reported.
10156 Flags can be used to set the expected number of reported
10157 errors. Because of the provided error suppression mechanisms,
10158 these options should probably not be used for final checking real
10159 programs but may be useful in developing programs using make.</p>
10160 <p class="TextFontCX"><span class="Flag"><span style=
10161 'font-size:10.0pt'>expect</span></span> <span class=
10162 "Flag"><span style=
10163 'font-size:10.0pt'><i><number></i></span></span></p>
10164 <p class="IndentText">Exactly <span class=
10165 "Flag"><i><span style='font-size:10.0pt'><number></span></i></span>
10166 code errors are expected. Splint will exit with failure
10167 exit status unless <span class="Flag"><i><span style=
10168 'font-size:10.0pt'><number></span></i></span> code
10169 errors are detected.</p>
10170 <p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
10171 <a name="_Toc534975047">Message Format</a></p>
10172 <p class="beforelist">These flags control how messages are
10173 printed. They may be set at the command line, in options
10174 files, or locally in syntactic comments. The
10175 <span class="Flag"><span style=
10176 'font-size:10.0pt'>line-len</span></span> and <span class=
10177 "Flag"><span style='font-size:10.0pt'>limit</span></span>
10178 flags may be preceded by <span class="Flag"><span style=
10179 'font-size:10.0pt'>+</span></span> or <span class=
10180 "Flag"><span style='font-size:10.0pt'>-</span></span> with
10181 the same meaning; for the other flags, <span class=
10182 "Flag"><span style='font-size: 10.0pt'>+</span></span> turns
10183 on the describe printing and <span class="Flag"><span style=
10184 'font-size:10.0pt'>-</span></span> turns it off. The
10185 box to the left of each flag gives its default value.</p>
10187 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10188 height="14" align="left">
10190 <td valign="top" align="left" height="14" style=
10191 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10192 <p class="TextFontCX" align="center" style=
10193 'text-align:center;background:#CCCCCC'><span class=
10194 "Flag"><span style=
10195 'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10196 <p class="TextFontCX"><span class="Flag"><span style=
10197 'font-size:10.0pt'>show-column</span></span></p>
10198 <p class="IndentText">Show column number where error is found.</p>
10200 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10201 height="14" align="left">
10203 <td valign="top" align="left" height="14" style=
10204 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10205 <p class="TextFontCX" align="center" style=
10206 'text-align:center;background:#CCCCCC'><span class=
10207 "Flag"><span style=
10208 'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10209 <p class="TextFontCX"><span class="Flag"><span style=
10210 'font-size:10.0pt'>show-func</span></span></p>
10211 <p class="IndentText">Show name of function (or macro) definition
10212 containing error. The function name is printed once before
10213 the first message detected in that function.</p>
10215 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10216 height="14" align="left">
10218 <td valign="top" align="left" height="14" style=
10219 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10220 <p class="TextFontCX" align="center" style=
10221 'text-align:center;background:#CCCCCC'><span class=
10222 "Flag"><span style=
10223 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
10224 <p class="TextFontCX"><span class="Flag"><span style=
10225 'font-size:10.0pt'>show-all-conjs</span></span></p>
10226 <p class="IndentText">Show all possible alternate types (see
10229 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10230 height="14" align="left">
10232 <td valign="top" align="left" height="14" style=
10233 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10234 <p class="TextFontCX" align="center" style=
10235 'text-align:center;background:#CCCCCC'><span class=
10236 "Flag"><span style=
10237 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
10238 <p class="TextFontCX"><span class="Flag"><span style=
10239 'font-size:10.0pt'>paren-file-format</span></span></p>
10240 <p class="IndentText">Use <span class="Flag"><i><span style=
10241 'font-size:10.0pt'><file></span></i></span><span class=
10242 "CodeText"><span style=
10243 'font-size:10.0pt'>(</span></span><span class=
10244 "Flag"><i><span style='font-size:10.0pt'><line></span></i></span><span class="CodeText">
10245 <span style='font-size:10.0pt'>)</span></span> format in
10246 messages. (Default is + for Win32 for compatibility with
10247 Microsoft VisualStudio.)</p>
10249 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10250 height="14" align="left">
10252 <td valign="top" align="left" height="14" style=
10253 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10254 <p class="TextFontCX" align="center" style=
10255 'text-align:center;background:#CCCCCC'><span class=
10256 "Flag"><span style=
10257 'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10258 <p class="TextFontCX"><span class="Flag"><span style=
10259 'font-size:10.0pt'>hints</span></span></p>
10260 <p class="IndentText">Provide hints describing an error and how a
10261 message may be suppressed for the first error reported in each
10264 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10265 height="14" align="left">
10267 <td valign="top" align="left" height="14" style=
10268 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10269 <p class="TextFontCX" align="center" style=
10270 'text-align:center;background:#CCCCCC'><span class=
10271 "Flag"><span style=
10272 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
10273 <p class="TextFontCX"><span class="Flag"><span style=
10274 'font-size:10.0pt'>force-hints</span></span></p>
10275 <p class="IndentText">Provide hints for all errors reported, even
10276 if the hint has already been displayed for the same error
10279 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10280 height="14" align="left">
10282 <td valign="top" align="left" height="14" style=
10283 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10284 <p class="TextFontCX" align="center" style=
10285 'text-align:center;background:#CCCCCC'><span class=
10286 "Flag"><span style=
10287 'font-size:10.0pt'>80</span></span></p></td></tr></table></div>
10288 <p class="TextFontCX"><span class="Flag"><span style=
10289 'font-size:10.0pt'>line-len</span></span> <span class=
10290 "Flag"><span style=
10291 'font-size:10.0pt'><i><number></i></span></span></p>
10292 <p class="IndentText">Set length of maximum message line to
10293 <span class="Flag"><i><span style=
10294 'font-size:10.0pt'><number></span></i></span>
10295 characters. Splint will split messages longer than
10296 <span class="Flag"><i><span style=
10297 'font-size: 10.0pt'><number></span></i></span> characters
10298 long into multiple lines.</p>
10301 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10302 height="14" align="left">
10304 <td valign="top" align="left" height="14" style=
10305 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10306 <p class="TextFontCX" align="center" style=
10307 'text-align:center;background:#CCCCCC'><span class=
10308 "Flag"><span style=
10309 'font-size:10.0pt'>3</span></span></p></td></tr></table></div>
10310 <p class="TextFontCX"><span class="Flag"><span style=
10311 'font-size:10.0pt'>indentspaces</span></span> <span class=
10312 "Flag"><span style=
10313 'font-size:10.0pt'><i><number></i></span></span></p>
10314 <p class="IndentText">
10315 Set the number of spaces to indent sub-messages.
10320 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10321 height="14" align="left">
10323 <td valign="top" align="left" height="14" style=
10324 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10325 <p class="TextFontCX" align="center" style=
10326 'text-align:center;background:#CCCCCC'><span class=
10327 "Flag"><span style=
10328 'font-size:10.0pt'>3</span></span></p></td></tr></table></div>
10329 <p class="TextFontCX"><span class="Flag"><span style=
10330 'font-size:10.0pt'>locindentspaces</span></span> <span class=
10331 "Flag"><span style=
10332 'font-size:10.0pt'><i><number></i></span></span></p>
10333 <p class="IndentText">
10334 Set number of spaces to indent sub-messages that start with file locations.
10340 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10341 height="14" align="left">
10343 <td valign="top" align="left" height="14" style=
10344 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10345 <p class="TextFontCX" align="center" style=
10346 'text-align:center;background:#CCCCCC'><span class=
10347 "Flag"><span style=
10348 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
10349 <p class="TextFontCX"><span class="Flag"><span style=
10350 'font-size:10.0pt'>showdeephistory</span></span> <span class=
10351 "Flag"><span style=
10352 'font-size:10.0pt'></span></span></p>
10353 <p class="IndentText">
10354 Show all available information about storage mentioned in warnings.
10358 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10359 height="14" align="left">
10361 <td valign="top" align="left" height="14" style=
10362 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10363 <p class="TextFontCX" align="center" style=
10364 'text-align:center;background:#CCCCCC'><span class=
10365 "Flag"><span style=
10366 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
10367 <p class="TextFontCX"><span class="Flag"><span style=
10368 'font-size:10.0pt'>showloadloc</span></span> <span class=
10369 "Flag"><span style=
10370 'font-size:10.0pt'></span></span></p>
10371 <p class="IndentText">
10372 Show location information for load files.
10377 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10378 height="14" align="left">
10380 <td valign="top" align="left" height="14" style=
10381 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10382 <p class="TextFontCX" align="center" style=
10383 'text-align:center;background:#CCCCCC'><span class=
10384 "Flag"><span style=
10385 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
10386 <p class="TextFontCX"><span class="Flag"><span style=
10387 'font-size:10.0pt'>csv</span></span> <span class=
10388 "Flag"><span style=
10389 'font-size:10.0pt'></span></span></p>
10390 <p class="IndentText">
10391 Produce comma-separated values (CSV) warnings output file.
10396 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10397 height="14" align="left">
10399 <td valign="top" align="left" height="14" style=
10400 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10401 <p class="TextFontCX" align="center" style=
10402 'text-align:center;background:#CCCCCC'><span class=
10403 "Flag"><span style=
10404 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
10405 <p class="TextFontCX"><span class="Flag"><span style=
10406 'font-size:10.0pt'>csvoverwrite</span></span> <span class=
10407 "Flag"><span style=
10408 'font-size:10.0pt'></span></span></p>
10409 <p class="IndentText">
10410 Overwrite exisiting CVS output file Show location information for load files.
10415 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10416 height="14" align="left">
10418 <td valign="top" align="left" height="14" style=
10419 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10420 <p class="TextFontCX" align="center" style=
10421 'text-align:center;background:#CCCCCC'><span class=
10422 "Flag"><span style=
10423 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
10424 <p class="TextFontCX"><span class="Flag"><span style=
10425 'font-size:10.0pt'>htmlfileformat</span></span> <span class=
10426 "Flag"><span style=
10427 'font-size:10.0pt'></span></span></p>
10428 <p class="IndentText">
10429 Show file locations as links.
10434 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10435 height="14" align="left">
10437 <td valign="top" align="left" height="14" style=
10438 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10439 <p class="TextFontCX" align="center" style=
10440 'text-align:center;background:#CCCCCC'><span class=
10441 "Flag"><span style=
10442 'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10443 <p class="TextFontCX"><span class="Flag"><span style=
10444 'font-size:10.0pt'>streamoverwrite</span></span> <span class=
10445 "Flag"><span style=
10446 'font-size:10.0pt'></span></span></p>
10447 <p class="IndentText">
10448 Warn and exit if a stream output file would overwrite an existing file.
10452 <p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
10453 <a name="_Toc534975048">Mode Selector Flags</a></p>
10454 <p class="TextFontCX">Mode selects flags set the mode checking
10455 flags to predefined values. They provide a quick coarse-grain
10456 way of controlling what classes of errors are reported. Specific
10457 checking flags may be set after a mode flag to override the mode
10458 settings. Mode flags may be used locally, however the mode
10459 settings will override specific command line flag settings. A
10460 warning is produced if a mode flag is used after a mode checking
10461 flag has been set.</p>
10462 <p class="TextFontCX"> </p>
10463 <p class="beforelist">These are brief descriptions to give a
10464 general idea of what each mode does. To see the complete flag
10465 settings in each mode, use <span class="Flag"><span style=
10466 'font-size:10.0pt'>splint -help modes</span></span>. A mode flag
10467 has the same effect when used with either <span class=
10468 "Flag"><span style='font-size:10.0pt'>+</span></span> or
10469 <span class="Flag"><span style=
10470 'font-size:10.0pt'>-</span></span>.</p>
10471 <p class="TextFontCX"><span class="Flag"><span style=
10472 'font-size:10.0pt'>weak</span></span></p>
10473 <p class="IndentText">Weak checking, intended for typical
10474 unannotated C code. No modifies checking, macro checking, rep
10475 exposure, or clean interface checking is done. Return values
10476 of type <span class="CodeText"><span style=
10477 'font-size:10.0pt'>int</span></span> may be ignored. The
10478 types <span class="CodeText"><span style=
10479 'font-size:10.0pt'>bool</span></span>, <span class=
10480 "CodeText"><span style='font-size:10.0pt'>int</span></span>,
10481 <span class="CodeText"><span style=
10482 'font-size:10.0pt'>char</span></span> and user-defined
10483 <span class="CodeText"><span style=
10484 'font-size:10.0pt'>enum</span></span> types are all
10485 equivalent. Old style declarations are unreported.</p>
10486 <p class="TextFontCX"><span class="Flag"><span style=
10487 'font-size:10.0pt'>standard</span></span></p>
10488 <p class="IndentText">The default mode. All checking done by
10489 <span class="Flag"><span style=
10490 'font-size:10.0pt'>weak</span></span>, plus modifies checking,
10491 global, alias checking, use all parameters, using released storage,
10492 ignored return values or any type, macro checking, unreachable
10493 code, infinite loops, and fall through cases. The types
10494 <span class="CodeText"><span style=
10495 'font-size:10.0pt'>bool</span></span>, <span class=
10496 "CodeText"><span style='font-size:10.0pt'>int</span></span> and
10497 <span class="CodeText"><span style=
10498 'font-size:10.0pt'>char</span></span> are distinct. Old style
10499 declarations are reported.</p>
10500 <p class="TextFontCX"> <span class="Flag"><span style=
10501 'font-size:10.0pt'>checks</span></span></p>
10502 <p class="IndentText">Moderately strict checking. All
10503 checking done by <span class="Flag"><span style=
10504 'font-size:10.0pt'>standard</span></span>, plus must modification
10505 checking, rep exposure, return alias, memory management and
10506 complete interfaces.</p>
10507 <p class="TextFontCX"><span class="Flag"><span style=
10508 'font-size:10.0pt'>strict</span></span></p>
10509 <p class="IndentText">Absurdly strict checking. All checking
10510 done by <span class="Flag"><span style=
10511 'font-size:10.0pt'>checks</span></span>, plus modifications and
10512 global variables used in unspecified functions, strict standard
10513 library, and strict typing of C operators. A special reward will be
10514 presented to the first person to produce a real program that
10515 produces no errors with <span class="Flag"><span style=
10516 'font-size:10.0pt'>strict</span></span> checking.</p>
10517 <p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
10518 <a name="_Ref344798116"></a><a name="_Toc534975049">Checking
10520 <p class="TextFontCX">These flags control checking done by
10521 Splint. They may be set locally using syntactic comments,
10522 from the command line, or in an options file. Some flags
10523 directly control whether a certain class of message is
10524 reported. Preceding the flag by <span class=
10525 "Flag"><span style='font-size:10.0pt'>+</span></span> turns
10526 reporting on, and preceding the flag by <span class=
10527 "Flag"><span style='font-size:10.0pt'>-</span></span> turns
10528 reporting off. Other flags control checking less directly by
10529 determining default values (what annotations are implicit), making
10530 types equivalent (to prevent certain type errors), controlling
10531 representation access, etc. For these flags, the effect of
10532 <span class="Flag"><span style='font-size:10.0pt'>+</span></span>
10533 is described, and the effect of <span class=
10534 "Flag"><span style='font-size:10.0pt'>-</span></span> is the
10535 opposite (or explicitly explained if there is no clear
10536 opposite). The organization of this section mirrors
10538 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
10539 <a name="_Toc534975051"></a>
10540 <a name="_Toc534975056">Null
10541 Dereferences</a> <span class="TextFontCXChar"><span style=
10542 'font-size:11.0pt; font-weight:normal'>(Section
10543 2)</span></span></p>
10546 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10547 height="14" align="left">
10549 <td valign="top" align="left" height="14" style=
10550 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10551 <p class="TextFontCX" align="center" style=
10552 'text-align:center;background:#CCCCCC'><span style=
10553 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
10554 <p class="TextFontCX"><span class="Flag"><span style=
10555 'font-size:10.0pt'>null</span></span></p>
10556 <p class="IndentText">A possibly null pointer may be dereferenced,
10557 or used somewhere a non-null pointer is expected. (sets nulldref, nullpass, nullassign, and nullstate</p>
10560 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10561 height="14" align="left">
10563 <td valign="top" align="left" height="14" style=
10564 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10565 <p class="TextFontCX" align="center" style=
10566 'text-align:center;background:#CCCCCC'><span style=
10567 'font-size:10.0pt'>m:</span><span class=
10568 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10569 <p class="TextFontCX"><span class="Flag"><span style=
10570 'font-size:10.0pt'>
10573 <p class="IndentText">A possibly null pointer is dereferenced. Value is either the result of a function which may return null (in which case,
10574 code should check it is not null), or a global, parameter or structure field declared with the null qualifier.
10580 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10581 height="14" align="left">
10583 <td valign="top" align="left" height="14" style=
10584 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10585 <p class="TextFontCX" align="center" style=
10586 'text-align:center;background:#CCCCCC'><span style=
10587 'font-size:10.0pt'>m:</span><span class=
10588 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10589 <p class="TextFontCX"><span class="Flag"><span style=
10590 'font-size:10.0pt'>
10593 <p class="IndentText">
10594 A possibly null pointer is passed as a parameter corresponding to a formal parameter with no /*@null@*/ annotation. If NULL may be
10595 used for this parameter, add a /*@null@*/ annotation to the function parameter declaration.
10598 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10599 height="14" align="left">
10601 <td valign="top" align="left" height="14" style=
10602 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10603 <p class="TextFontCX" align="center" style=
10604 'text-align:center;background:#CCCCCC'><span style=
10605 'font-size:10.0pt'>m:</span><span class=
10606 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10607 <p class="TextFontCX"><span class="Flag"><span style=
10608 'font-size:10.0pt'>
10611 <p class="IndentText">
10612 Function returns a possibly null pointer, but is not declared using /*@null@*/ annotation of result. If function may return NULL, add /*@null@*/ annotation to the return value declaration.
10616 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10617 height="14" align="left">
10619 <td valign="top" align="left" height="14" style=
10620 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10621 <p class="TextFontCX" align="center" style=
10622 'text-align:center;background:#CCCCCC'><span style=
10623 'font-size:10.0pt'>m:</span><span class=
10624 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10625 <p class="TextFontCX"><span class="Flag"><span style=
10626 'font-size:10.0pt'>
10629 <p class="IndentText">
10630 A possibly null pointer is reachable from a parameter or global variable that is not declared using a /*@null@*/ annotation.
10635 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10636 height="14" align="left">
10638 <td valign="top" align="left" height="14" style=
10639 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10640 <p class="TextFontCX" align="center" style=
10641 'text-align:center;background:#CCCCCC'><span style=
10642 'font-size:10.0pt'>m:</span><span class=
10643 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10644 <p class="TextFontCX"><span class="Flag"><span style=
10645 'font-size:10.0pt'>
10648 <p class="IndentText">
10649 A reference with no null annotation is assigned or initialized to NULL. Use /*@null@*/ to declare the reference as a possibly null pointer.
10652 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
10653 <a name="_Toc534975055">Use Before Definition</a>
10654 <span class="TextFontCXChar"><span style=
10655 'font-size:11.0pt; font-weight:normal'>(Section
10656 3)</span></span></p>
10658 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10659 height="14" align="left">
10661 <td valign="top" align="left" height="14" style=
10662 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10663 <p class="TextFontCX" align="center" style=
10664 'text-align:center;background:#CCCCCC'><span style=
10665 'font-size:10.0pt'>m:</span><span class=
10666 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10667 <p class="TextFontCX"><span class="Flag"><span style=
10668 'font-size:10.0pt'>usedef</span></span></p>
10669 <p class="IndentText">The value of a location that may not be
10670 initialized on some execution path is used.</p>
10672 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10673 height="14" align="left">
10675 <td valign="top" align="left" height="14" style=
10676 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10677 <p class="TextFontCX" align="center" style=
10678 'text-align:center;background:#CCCCCC'><span style=
10679 'font-size:10.0pt'>m:</span><span class=
10680 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
10681 <p class="TextFontCX"><span class="Flag"><span style=
10682 'font-size:10.0pt'>impouts</span></span></p>
10683 <p class="IndentText">Allow unannotated pointer parameters to
10684 functions to be implicit out parameters.</p>
10686 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10687 height="14" align="left">
10689 <td valign="top" align="left" height="14" style=
10690 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10691 <p class="TextFontCX" align="center" style=
10692 'text-align:center;background:#CCCCCC'><span style=
10693 'font-size:10.0pt'>m:</span><span class=
10694 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10695 <p class="TextFontCX"><span class="Flag"><span style=
10696 'font-size:10.0pt'>compdef</span></span></p>
10697 <p class="IndentText">Storage derivable from a parameter, return
10698 value or global variable is not completely defined.</p>
10700 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10701 height="14" align="left">
10703 <td valign="top" align="left" height="14" style=
10704 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10705 <p class="TextFontCX" align="center" style=
10706 'text-align:center;background:#CCCCCC'><span style=
10707 'font-size:10.0pt'>m:</span><span class=
10708 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10709 <p class="TextFontCX"><span class="Flag"><span style=
10710 'font-size:10.0pt'>uniondef</span></span></p>
10711 <p class="IndentText">No field of a union is defined. (No
10712 error is reported if at least one union field is defined.)</p>
10714 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10715 height="14" align="left">
10717 <td valign="top" align="left" height="14" style=
10718 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10719 <p class="TextFontCX" align="center" style=
10720 'text-align:center;background:#CCCCCC'><span style=
10721 'font-size:10.0pt'>m:</span><span class=
10722 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10723 <p class="TextFontCX"><span class="Flag"><span style=
10724 'font-size:10.0pt'>mustdefine</span></span></p>
10725 <p class="IndentText">Parameter declared with <span class=
10726 "Keyword"><span style='font-size:10.0pt'>out</span></span> is not
10727 defined before return or scope exit.</p>
10730 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
10733 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10734 height="14" align="left">
10736 <td valign="top" align="left" height="14" style=
10737 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10738 <p class="TextFontCX" align="center" style=
10739 'text-align:center;background:#CCCCCC'><span style=
10740 'font-size:10.0pt'>P:</span><span class=
10741 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10742 <p class="TextFontCX"><span class="Flag"><span style=
10743 'font-size:10.0pt'>
10746 <p class="IndentText">
10747 Initializer does not set every field in the structure.
10752 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10753 height="14" align="left">
10755 <td valign="top" align="left" height="14" style=
10756 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10757 <p class="TextFontCX" align="center" style=
10758 'text-align:center;background:#CCCCCC'><span style=
10759 'font-size:10.0pt'>P:</span><span class=
10760 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10761 <p class="TextFontCX"><span class="Flag"><span style=
10762 'font-size:10.0pt'>
10765 <p class="IndentText">
10766 Initializer does not define all elements of a declared array.
10771 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10772 height="14" align="left">
10774 <td valign="top" align="left" height="14" style=
10775 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10776 <p class="TextFontCX" align="center" style=
10777 'text-align:center;background:#CCCCCC'><span style=
10778 'font-size:10.0pt'>P:</span><span class=
10779 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10780 <p class="TextFontCX"><span class="Flag"><span style=
10781 'font-size:10.0pt'>
10784 <p class="IndentText">
10785 Initializer block contains more elements than the size of a declared array.
10790 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10791 height="14" align="left">
10793 <td valign="top" align="left" height="14" style=
10794 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10795 <p class="TextFontCX" align="center" style=
10796 'text-align:center;background:#CCCCCC'><span style=
10797 'font-size:10.0pt'>m:</span><span class=
10798 "Keyword"><span style='font-size:10.0pt'>---</span></span></p></td></tr></table></div>
10799 <p class="TextFontCX"><span class="Flag"><span style=
10800 'font-size:10.0pt'>
10803 <p class="IndentText">
10804 Pointer parameters to unspecified functions may be implicit <span class=
10805 "Keyword"><span style='font-size:10.0pt'>out</span></span> parameters.
10808 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
10809 Declarations<span class="TextFontCXChar"><span style=
10810 'font-size:11.0pt; font-weight:normal'></span></span>
10811 <span class="TextFontCXChar">
10813 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
10816 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10817 height="14" align="left">
10819 <td valign="top" align="left" height="14" style=
10820 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10821 <p class="TextFontCX" align="center" style=
10822 'text-align:center;background:#CCCCCC'><span style=
10823 'font-size:10.0pt'>m:</span><span class=
10824 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10825 <p class="TextFontCX"><span class="Flag"><span style=
10826 'font-size:10.0pt'>
10829 <p class="IndentText">
10830 A function, variable or constant is redefined with a different type.
10834 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10835 height="14" align="left">
10837 <td valign="top" align="left" height="14" style=
10838 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10839 <p class="TextFontCX" align="center" style=
10840 'text-align:center;background:#CCCCCC'><span style=
10841 'font-size:10.0pt'>m:</span><span class=
10842 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10843 <p class="TextFontCX"><span class="Flag"><span style=
10844 'font-size:10.0pt'>
10847 <p class="IndentText">
10848 A function type is dereferenced. The ANSI standard allows this because of
10849 implicit conversion of function designators, however the dereference is unnecessary.
10853 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10854 height="14" align="left">
10856 <td valign="top" align="left" height="14" style=
10857 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10858 <p class="TextFontCX" align="center" style=
10859 'text-align:center;background:#CCCCCC'><span style=
10860 'font-size:10.0pt'>m:</span><span class=
10861 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
10862 <p class="TextFontCX"><span class="Flag"><span style=
10863 'font-size:10.0pt'>
10866 <p class="IndentText">
10867 A declaration of an immutable object uses a redundant observer qualifier.
10872 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10873 height="14" align="left">
10875 <td valign="top" align="left" height="14" style=
10876 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10877 <p class="TextFontCX" align="center" style=
10878 'text-align:center;background:#CCCCCC'><span style=
10879 'font-size:10.0pt'>m:</span><span class=
10880 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10881 <p class="TextFontCX"><span class="Flag"><span style=
10882 'font-size:10.0pt'>
10885 <p class="IndentText">
10886 A declaration of an unsharable object uses a sharing annotation.
10889 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
10890 Types <span class="TextFontCXChar"><span style=
10891 'font-size:11.0pt; font-weight:normal'>(Section</span></span>
10892 <span class="TextFontCXChar"><span style=
10893 'font-size:11.0pt; font-weight:normal'>4</span></span>
10894 <span class="TextFontCXChar">
10896 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
10897 <p class="IndentText"> </p>
10900 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10901 height="14" align="left">
10903 <td valign="top" align="left" height="14" style=
10904 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10905 <p class="TextFontCX" align="center" style=
10906 'text-align:center;background:#CCCCCC'><span style=
10907 'font-size:10.0pt'>P:</span> <span class=
10908 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10909 <p class="TextFontCX"><span class="Flag"><span style=
10910 'font-size:10.0pt'>
10913 <p class="IndentText">Type mismatch.</p>
10916 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10917 height="14" align="left">
10919 <td valign="top" align="left" height="14" style=
10920 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10921 <p class="TextFontCX" align="center" style=
10922 'text-align:center;background:#CCCCCC'><span style=
10923 'font-size:10.0pt'>P:</span> <span class=
10924 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
10925 <p class="TextFontCX"><span class="Flag"><span style=
10926 'font-size:10.0pt'>
10927 string-literal-too-long
10929 <p class="IndentText">
10930 A string literal is assigned to a char array too small to hold it.
10934 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10935 height="14" align="left">
10937 <td valign="top" align="left" height="14" style=
10938 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10939 <p class="TextFontCX" align="center" style=
10940 'text-align:center;background:#CCCCCC'><span style=
10941 'font-size:10.0pt'>m:</span> <span class=
10942 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
10943 <p class="TextFontCX"><span class="Flag"><span style=
10944 'font-size:10.0pt'>
10945 string-literal--no-room
10947 <p class="IndentText">
10948 A string literal is assigned to a char array that is not big enough to hold the null terminator.
10953 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10954 height="14" align="left">
10956 <td valign="top" align="left" height="14" style=
10957 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10958 <p class="TextFontCX" align="center" style=
10959 'text-align:center;background:#CCCCCC'><span style=
10960 'font-size:10.0pt'>m:</span> <span class=
10961 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
10962 <p class="TextFontCX"><span class="Flag"><span style=
10963 'font-size:10.0pt'>
10964 string-literal--no-room-final-null
10966 <p class="IndentText">
10967 A string literal is assigned to a char array that is not big enough to
10968 hold the final null terminator. This may not be a problem because a null
10969 character has been explictedly included in the string literal using an
10974 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10975 height="14" align="left">
10977 <td valign="top" align="left" height="14" style=
10978 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10979 <p class="TextFontCX" align="center" style=
10980 'text-align:center;background:#CCCCCC'><span style=
10981 'font-size:10.0pt'>m:</span> <span class=
10982 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
10983 <p class="TextFontCX"><span class="Flag"><span style=
10984 'font-size:10.0pt'>
10985 string-literal-smaller
10987 <p class="IndentText">
10988 A string literal is assigned to a char array that smaller than the string literal needs.
10993 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
10994 height="14" align="left">
10996 <td valign="top" align="left" height="14" style=
10997 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
10998 <p class="TextFontCX" align="center" style=
10999 'text-align:center;background:#CCCCCC'><span style=
11000 'font-size:10.0pt'>m:</span> <span class=
11001 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
11002 <p class="TextFontCX"><span class="Flag"><span style=
11003 'font-size:10.0pt'>
11006 <p class="IndentText">
11007 Type of initial values for enum members must be int.
11010 <p class="Heading10">Boolean Types <span class=
11011 "HeadingNote"><span style=
11012 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
11013 <span class="HeadingNote"><span style=
11014 'font-size:10.5pt;font-weight:normal;font-style: normal'>4.2</span></span><span class="HeadingNote">
11016 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
11017 <p class="TextFontCX">These flags control the type name used to
11018 represent Booleans, and whether the Boolean type is abstract.</p>
11019 <p class="TextFontCX"> </p>
11021 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11022 height="14" align="left">
11024 <td valign="top" align="left" height="14" style=
11025 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11026 <p class="TextFontCX" align="center" style=
11027 'text-align:center;background:#CCCCCC'><span style=
11028 'font-size:10.0pt'>P:</span> <span class=
11029 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
11030 <p class="TextFontCX"><span class="Flag"><span style=
11031 'font-size:10.0pt'>bool</span></span></p>
11032 <p class="IndentText">Boolean type is an abstract type.</p>
11034 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11035 height="14" align="left">
11037 <td valign="top" align="left" height="14" style=
11038 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11039 <p class="TextFontCX" align="center" style=
11040 'text-align:center;background:#CCCCCC'><span style=
11041 'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
11042 'font-size:10.0pt'>bool</span></span></p></td></tr></table></div>
11043 <p class="TextFontCX"><span class="Flag"><span style=
11044 'font-size:10.0pt'>booltype</span></span> <span class=
11045 "Flag"><span style=
11046 'font-size:10.0pt'><i><name></i></span></span></p>
11047 <p class="IndentText">Set name of Boolean type to
11048 <i><name></i>.</p>
11050 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11051 height="14" align="left">
11053 <td valign="top" align="left" height="14" style=
11054 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11055 <p class="TextFontCX" align="center" style=
11056 'text-align:center;background:#CCCCCC'><span style=
11057 'font-size:10.0pt'>P:</span><span class="Flag"><span style=
11058 'font-size:10.0pt'>FALSE</span></span></p></td></tr></table></div>
11059 <p class="TextFontCX"><span class="Flag"><span style=
11060 'font-size:10.0pt'>boolfalse</span></span> <span class=
11061 "Flag"><span style=
11062 'font-size:10.0pt'><i><name></i></span></span></p>
11063 <p class="IndentText">Set name of Boolean false to
11064 <i><name></i>.</p>
11066 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11067 height="14" align="left">
11069 <td valign="top" align="left" height="14" style=
11070 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11071 <p class="TextFontCX" align="center" style=
11072 'text-align:center;background:#CCCCCC'><span style=
11073 'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
11074 'font-size:10.0pt'>TRUE</span></span></p></td></tr></table></div>
11075 <p class="TextFontCX"><span class="Flag"><span style=
11076 'font-size:10.0pt'>booltrue</span></span> <span class=
11077 "Flag"><span style=
11078 'font-size:10.0pt'><i><name></i></span></span></p>
11079 <p class="IndentText">Set name of Boolean true to
11080 <i><name></i>.</p>
11083 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11084 height="14" align="left">
11086 <td valign="top" align="left" height="14" style=
11087 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11088 <p class="TextFontCX" align="center" style=
11089 'text-align:center;background:#CCCCCC'><span style=
11090 'font-size:10.0pt'>P:</span> <span class=
11091 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11092 <p class="TextFontCX"><span class="Flag"><span style=
11093 'font-size:10.0pt'>
11096 <p class="IndentText">
11097 Splint has found a type which appears to be the boolean type. Use the -booltype, -boolfalse and -booltrue flags to change the name of the default boolean type.
11101 <p class="Heading10"><a name="_Ref344871224">Predicates</a></p>
11103 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11104 height="14" align="left">
11106 <td valign="top" align="left" height="14" style=
11107 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11108 <p class="TextFontCX" align="center" style=
11109 'text-align:center;background:#CCCCCC'><span style=
11110 'font-size:10.0pt'>m:</span><span class=
11111 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
11112 <p class="TextFontCX"><span class="Flag"><span style=
11113 'font-size:10.0pt'>pred-bool-ptr</span></span></p>
11114 <p class="IndentText">Type of condition test is a pointer.</p>
11116 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11117 height="14" align="left">
11119 <td valign="top" align="left" height="14" style=
11120 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11121 <p class="TextFontCX" align="center" style=
11122 'text-align:center;background:#CCCCCC'><span style=
11123 'font-size:10.0pt'>m:</span><span class=
11124 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
11125 <p class="TextFontCX"><span class="Flag"><span style=
11126 'font-size:10.0pt'>pred-bool-int</span></span></p>
11127 <p class="IndentText">Type of condition test is an integral
11130 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11131 height="14" align="left">
11133 <td valign="top" align="left" height="14" style=
11134 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11135 <p class="TextFontCX" align="center" style=
11136 'text-align:center;background:#CCCCCC'><span style=
11137 'font-size:10.0pt'>m:</span><span class=
11138 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
11139 <p class="TextFontCX"><span class="Flag"><span style=
11140 'font-size:10.0pt'>pred-bool-others</span></span></p>
11141 <p class="IndentText">Type of condition test is not a Boolean,
11142 pointer or integral type.</p>
11144 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11145 height="14" align="left">
11147 <td valign="top" align="left" height="14" style=
11148 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11149 <p class="TextFontCX" align="center" style=
11150 'text-align:center;background:#CCCCCC'><span style=
11151 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
11152 <p class="TextFontCX"><span class="Flag"><span style=
11153 'font-size:10.0pt'>pred-bool</span></span></p>
11154 <p class="IndentText">Sets <span class="Flag"><span style=
11155 'font-size:10.0pt'>predboolint</span></span>, <span class=
11156 "Flag"><span style='font-size:10.0pt'>predboolptr</span></span> and
11157 <span class="Flag"><span style=
11158 'font-size:10.0pt'>preboolothers</span></span>.</p>
11160 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11161 height="14" align="left">
11163 <td valign="top" align="left" height="14" style=
11164 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11165 <p class="TextFontCX" align="center" style=
11166 'text-align:center;background:#CCCCCC'><span style=
11167 'font-size:10.0pt'>P:</span> <span class=
11168 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11169 <p class="TextFontCX"><span class="Flag"><span style=
11170 'font-size:10.0pt'>pred-assign</span></span></p>
11171 <p class="IndentText">The condition test is an assignment
11172 expression. If an assignment is intended, add an extra parentheses
11173 nesting (e.g., <span class="CodeText"><span style=
11174 'font-size:10.0pt'>if ((a = b))</span></span> ...).</p>
11175 <p class="Heading10">Primitive Operations</p>
11177 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11178 height="14" align="left">
11180 <td valign="top" align="left" height="14" style=
11181 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11182 <p class="TextFontCX" align="center" style=
11183 'text-align:center;background:#CCCCCC'><span style=
11184 'font-size:10.0pt'>m:</span><span class=
11185 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
11186 <p class="TextFontCX"><span class="Flag"><span style=
11187 'font-size:10.0pt'>ptr-arith</span></span></p>
11188 <p class="IndentText">Arithmetic involving pointer and integer.</p>
11191 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11192 height="14" align="left">
11194 <td valign="top" align="left" height="14" style=
11195 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11196 <p class="TextFontCX" align="center" style=
11197 'text-align:center;background:#CCCCCC'><span style=
11198 'font-size:10.0pt'>m:</span> <span class=
11199 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
11200 <p class="TextFontCX"><span class="Flag"><span style=
11201 'font-size:10.0pt'>
11204 <p class="IndentText">
11205 Pointer arithmetic using a possibly null pointer and integer.
11210 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11211 height="14" align="left">
11213 <td valign="top" align="left" height="14" style=
11214 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11215 <p class="TextFontCX" align="center" style=
11216 'text-align:center;background:#CCCCCC'><span style=
11217 'font-size:10.0pt'>m:</span> <span class=
11218 "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
11219 <p class="TextFontCX"><span class="Flag"><span style=
11220 'font-size:10.0pt'>
11223 <p class="IndentText">
11224 The operand of a boolean operator is not a boolean. Use +ptrnegate to allow ! to be used on pointers.
11227 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11228 height="14" align="left">
11230 <td valign="top" align="left" height="14" style=
11231 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11232 <p class="TextFontCX" align="center" style=
11233 'text-align:center;background:#CCCCCC'><span style=
11234 'font-size:10.0pt'>m:</span><span class=
11235 "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
11236 <p class="TextFontCX"><span class="Flag"><span style=
11237 'font-size:10.0pt'>ptr-negate</span></span></p>
11238 <p class="IndentText">Allow the operand of the <span class=
11239 "CodeText"><span style='font-size:10.0pt'>!</span></span> operator
11240 to be a pointer.</p>
11242 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11243 height="14" align="left">
11245 <td valign="top" align="left" height="14" style=
11246 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11247 <p class="TextFontCX" align="center" style=
11248 'text-align:center;background:#CCCCCC'><span style=
11249 'font-size:10.0pt'>m:</span><span class=
11250 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
11251 <p class="TextFontCX"><span class="Flag"><span style=
11252 'font-size:10.0pt'>bitwise-signed</span></span><span class=
11253 "Flag"><span style='font-size:10.0pt'> </span></span></p>
11254 <p class="IndentText">An operand to a bitwise operator is not an
11255 unsigned value. This may have unexpected results depending on the
11256 signed representations.</p>
11260 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11261 height="14" align="left">
11263 <td valign="top" align="left" height="14" style=
11264 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11265 <p class="TextFontCX" align="center" style=
11266 'text-align:center;background:#CCCCCC'><span style=
11267 'font-size:10.0pt'>m:</span> <span class=
11268 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
11269 <p class="TextFontCX"><span class="Flag"><span style=
11270 'font-size:10.0pt'>
11271 shiftimplementation
11273 <p class="IndentText">
11274 The left operand to a shift operator may be negative (behavior is implementation-defined).
11279 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11280 height="14" align="left">
11282 <td valign="top" align="left" height="14" style=
11283 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11284 <p class="TextFontCX" align="center" style=
11285 'text-align:center;background:#CCCCCC'><span style=
11286 'font-size:10.0pt'>m:</span> <span class=
11287 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
11288 <p class="TextFontCX"><span class="Flag"><span style=
11289 'font-size:10.0pt'>
11292 <p class="IndentText">
11293 The right operand to a shift operator may be negative (behavior undefined).
11297 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11298 height="14" align="left">
11300 <td valign="top" align="left" height="14" style=
11301 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11302 <p class="TextFontCX" align="center" style=
11303 'text-align:center;background:#CCCCCC'><span style=
11304 'font-size:10.0pt'>m:</span><span class=
11305 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
11306 <p class="TextFontCX"><span class="Flag"><span style=
11307 'font-size:10.0pt'>shift-signed</span></span></p>
11308 <p class="IndentText">The left operand to a shift operator is not
11309 an unsigned value.</p>
11311 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11312 height="14" align="left">
11314 <td valign="top" align="left" height="14" style=
11315 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11316 <p class="TextFontCX" align="center" style=
11317 'text-align:center;background:#CCCCCC'><span style=
11318 'font-size:10.0pt'>m:</span><span class=
11319 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
11320 <p class="TextFontCX"><span class="Flag"><span style=
11321 'font-size:10.0pt'>strict-ops</span></span></p>
11322 <p class="IndentText">Primitive operation does not type check
11325 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11326 height="14" align="left">
11328 <td valign="top" align="left" height="14" style=
11329 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11330 <p class="TextFontCX" align="center" style=
11331 'text-align:center;background:#CCCCCC'><span style=
11332 'font-size:10.0pt'>m:</span><span class=
11333 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
11334 <p class="TextFontCX"><span class="Flag"><span style=
11335 'font-size:10.0pt'>sizeof-type</span></span></p>
11336 <p class="IndentText">Operand of <span class=
11337 "CodeText"><span style='font-size:10.0pt'>sizeof</span></span>
11338 operator is a type. (Safer to use <span class=
11339 "CodeText"><span style='font-size:10.0pt'>int *x = sizeof
11340 (*x);</span></span> instead of <span class=
11341 "CodeText"><span style='font-size:10.0pt'>sizeof
11342 (int)</span></span>.)</p>
11343 <p class="Heading10">Array Formal Parameters</p>
11344 <p class="TextFontCX">These flags control reporting of common
11345 errors caused by confusion about the semantics of array formal
11347 <p class="TextFontCX"> </p>
11349 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11350 height="14" align="left">
11352 <td valign="top" align="left" height="14" style=
11353 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11354 <p class="TextFontCX" align="center" style=
11355 'text-align:center;background:#CCCCCC'><span style=
11356 'font-size:10.0pt'>P:</span> <span class=
11357 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11358 <p class="TextFontCX"><span class="Flag"><span style=
11359 'font-size:10.0pt'>sizeof-formal-array</span></span></p>
11360 <p class="IndentText">The <span class="CodeText"><span style=
11361 'font-size:10.0pt'>sizeof</span></span> operator is used on a
11362 parameter declared as an array. (In many instances this has
11363 unexpected behavior, since the result is the size of a pointer to
11364 the element type, not the number of elements in the array.)</p>
11365 <p class="IndentText"> </p>
11367 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11368 height="14" align="left">
11370 <td valign="top" align="left" height="14" style=
11371 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11372 <p class="TextFontCX" align="center" style=
11373 'text-align:center;background:#CCCCCC'><span style=
11374 'font-size:10.0pt'>P:</span> <span class=
11375 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11376 <p class="TextFontCX"><span class="Flag"><span style=
11377 'font-size:10.0pt'>fixed-formal-array</span></span></p>
11378 <p class="IndentText">An array formal parameter is declared with a
11379 fixed size (e.g., <span class="CodeText"><span style=
11380 'font-size:10.0pt'>int x[20]</span></span>). This is likely
11381 to be confusing, since the size is ignored.</p>
11383 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11384 height="14" align="left">
11386 <td valign="top" align="left" height="14" style=
11387 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11388 <p class="TextFontCX" align="center" style=
11389 'text-align:center;background:#CCCCCC'><span style=
11390 'font-size:10.0pt'>P:</span> <span class=
11391 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
11392 <p class="TextFontCX"><span class="Flag"><span style=
11393 'font-size:10.0pt'>formal-array</span></span></p>
11394 <p class="IndentText">A formal parameter is declared as an
11395 array. This is probably not a problem, but can be confusing
11396 since it is treated as a pointer. </p>
11397 <p class="Heading10">Format Codes</p>
11399 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11400 height="14" align="left">
11402 <td valign="top" align="left" height="14" style=
11403 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11404 <p class="TextFontCX" align="center" style=
11405 'text-align:center;background:#CCCCCC'><span style=
11406 'font-size:10.0pt'>P:</span> <span class=
11407 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11408 <p class="TextFontCX"><span class="Flag"><span style=
11409 'font-size:10.0pt'>format-code</span></span></p>
11410 <p class="IndentText">Invalid format code in format string for
11411 <span class="Annot"><span style=
11412 'font-size:10.0pt'>printflike</span></span> or <span class=
11413 "Annot"><span style='font-size:10.0pt'>scanflike</span></span>
11416 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11417 height="14" align="left">
11419 <td valign="top" align="left" height="14" style=
11420 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11421 <p class="TextFontCX" align="center" style=
11422 'text-align:center;background:#CCCCCC'><span style=
11423 'font-size:10.0pt'>P:</span> <span class=
11424 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11425 <p class="TextFontCX"><span class="Flag"><span style=
11426 'font-size:10.0pt'>format-type</span></span></p>
11427 <p class="IndentText">Type-mismatch in parameter corresponding to
11428 format code in a <span class="Annot"><span style=
11429 'font-size:10.0pt'>printflike</span></span> or <span class=
11430 "Annot"><span style='font-size:10.0pt'>scanflike</span></span>
11434 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11435 height="14" align="left">
11437 <td valign="top" align="left" height="14" style=
11438 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11439 <p class="TextFontCX" align="center" style=
11440 'text-align:center;background:#CCCCCC'><span style=
11441 'font-size:10.0pt'>P:</span> <span class=
11442 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11443 <p class="TextFontCX"><span class="Flag"><span style=
11444 'font-size:10.0pt'>format-const</span></span></p>
11445 <p class="IndentText">Format parameter is not known at compile-time. This can lead to security vulnerabilities because the arguments cannot be type checked.</p>
11447 <p class="Heading10">Main</p>
11449 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11450 height="14" align="left">
11452 <td valign="top" align="left" height="14" style=
11453 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11454 <p class="TextFontCX" align="center" style=
11455 'text-align:center;background:#CCCCCC'><span style=
11456 'font-size:10.0pt'>P:</span> <span class=
11457 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11458 <p class="TextFontCX"><span class="Flag"><span style=
11459 'font-size:10.0pt'>main-type</span></span></p>
11460 <p class="IndentText">Type of <span class=
11461 "CodeText"><span style='font-size:10.0pt'>main</span></span>
11462 does not match expected type (function returning an
11463 <span class="CodeText"><span style=
11464 'font-size:10.0pt'>int</span></span>, taking no parameters or
11465 two parameters of type <span class="CodeText"><span style=
11466 'font-size:10.0pt'>int</span></span> and <span class=
11467 "CodeText"><span style='font-size:10.0pt'>char
11468 **</span></span>.)</p>
11469 <p class="Heading10">Comparisons</p>
11471 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11472 height="14" align="left">
11474 <td valign="top" align="left" height="14" style=
11475 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11476 <p class="TextFontCX" align="center" style=
11477 'text-align:center;background:#CCCCCC'><a name=
11478 "boolcompare"></a><a name="boolprose"><span style=
11479 'font-size:10.0pt'>m:</span></a><span class=
11480 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
11481 <p class="TextFontCX"><span class="Flag"><span style=
11482 'font-size:10.0pt'>bool-compare</span></span></p>
11483 <p class="IndentText">Comparison between Boolean values. This
11484 is dangerous since there may be multiple true values as any
11485 non-zero value is interpreted as true.</p>
11487 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11488 height="14" align="left">
11490 <td valign="top" align="left" height="14" style=
11491 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11492 <p class="TextFontCX" align="center" style=
11493 'text-align:center;background:#CCCCCC'><span style=
11494 'font-size:10.0pt'>m:</span><span class=
11495 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
11496 <p class="TextFontCX"><span class="Flag"><span style=
11497 'font-size:10.0pt'>real-compare</span></span></p>
11498 <p class="IndentText">Comparison involving <span class=
11499 "CodeText"><span style='font-size:10.0pt'>float</span></span> or
11500 <span class="CodeText"><span style=
11501 'font-size:10.0pt'>double</span></span> values. This is
11502 dangerous since it may produce unexpected results because floating
11503 point representations are inexact.</p>
11505 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11506 height="14" align="left">
11508 <td valign="top" align="left" height="14" style=
11509 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11510 <p class="TextFontCX" align="center" style=
11511 'text-align:center;background:#CCCCCC'><span style=
11512 'font-size:10.0pt'>m:</span><span class=
11513 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
11514 <p class="TextFontCX"><span class="Flag"><span style=
11515 'font-size:10.0pt'>ptr-compare</span></span></p>
11516 <p class="IndentText">Comparison between pointer and number.</p>
11519 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11520 height="14" align="left">
11522 <td valign="top" align="left" height="14" style=
11523 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11524 <p class="TextFontCX" align="center" style=
11525 'text-align:center;background:#CCCCCC'><span style=
11526 'font-size:10.0pt'>m:</span><span class=
11527 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
11528 <p class="TextFontCX"><span class="Flag"><span style=
11529 'font-size:10.0pt'>unsigned-compare</span></span></p>
11530 <p class="IndentText">
11531 An unsigned value is used in a comparison with zero in a way that is either a bug or confusing.
11534 <p class="Heading10">Type Equivalence</p>
11536 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11537 height="14" align="left">
11539 <td valign="top" align="left" height="14" style=
11540 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11541 <p class="TextFontCX" align="center" style=
11542 'text-align:center;background:#CCCCCC'><a name=
11543 "globs"></a><span style=
11544 'font-size:10.0pt'>m:</span><span class="Keyword"><span style='font-size: 10.0pt'>
11545 +---</span></span></p></td></tr></table></div>
11546 <p class="TextFontCX"><span class="Flag"><span style=
11547 'font-size:10.0pt'>void-abstract</span></span></p>
11548 <p class="IndentText">Allow <span class=
11549 "CodeText"><span style='font-size:10.0pt'>void
11550 *</span></span> to match pointers to abstract types.
11551 (Casting a pointer to an abstract type to a pointer to
11552 <span class="CodeText"><span style=
11553 'font-size:10.0pt'>void</span></span> is okay if <span class=
11554 "Flag"><span style=
11555 'font-size:10.0pt'>+void-abstract</span></span> is set.)</p>
11557 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11558 height="14" align="left">
11560 <td valign="top" align="left" height="14" style=
11561 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11562 <p class="TextFontCX" align="center" style=
11563 'text-align:center;background:#CCCCCC'><span style=
11564 'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
11565 <p class="TextFontCX"><span class="Flag"><span style=
11566 'font-size:10.0pt'>cast-fcn-ptr</span></span></p>
11567 <p class="IndentText"> A pointer to a function is cast to (or
11568 used as) a pointer to void (or vice versa).</p>
11570 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11571 height="14" align="left">
11573 <td valign="top" align="left" height="14" style=
11574 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11575 <p class="TextFontCX" align="center" style=
11576 'text-align:center;background:#CCCCCC'><span style=
11577 'font-size:10.0pt'>m:</span><span class=
11578 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11579 <p class="TextFontCX"><span class="Flag"><span style=
11580 'font-size:10.0pt'>forward-decl</span></span></p>
11581 <p class="IndentText">Forward declarations of pointers to abstract
11582 representation match abstract type.</p>
11584 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11585 height="14" align="left">
11587 <td valign="top" align="left" height="14" style=
11588 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11589 <p class="TextFontCX" align="center" style=
11590 'text-align:center;background:#CCCCCC'><span style=
11591 'font-size:10.0pt'>m:</span><span class=
11592 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
11593 <p class="TextFontCX"><span class="Flag"><span style=
11594 'font-size:10.0pt'>imp-type</span></span></p>
11595 <p class="IndentText">A variable declaration has no explicit
11596 type. The type is implicitly int.</p>
11598 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11599 height="14" align="left">
11601 <td valign="top" align="left" height="14" style=
11602 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11603 <p class="TextFontCX" align="center" style=
11604 'text-align:center;background:#CCCCCC'><span style=
11605 'font-size:10.0pt'>P:</span> <span class=
11606 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11607 <p class="TextFontCX"><span class="Flag"><span style=
11608 'font-size:10.0pt'>incomplete-type</span></span></p>
11609 <p class="IndentText">A formal parameter is declared with an
11610 incomplete type (e.g., <span class="Keyword"><span style=
11611 'font-size:10.0pt'>int[][]</span></span>).</p>
11613 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11614 height="14" align="left">
11616 <td valign="top" align="left" height="14" style=
11617 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11618 <p class="TextFontCX" align="center" style=
11619 'text-align:center;background:#CCCCCC'><span style=
11620 'font-size:10.0pt'>m:</span><span class=
11621 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11622 <p class="TextFontCX"><span class="Flag"><span style=
11623 'font-size:10.0pt'>char-index</span></span></p>
11624 <p class="IndentText">Allow <span class=
11625 "CodeText"><span style='font-size:10.0pt'>char</span></span>
11626 to index arrays.</p>
11628 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11629 height="14" align="left">
11631 <td valign="top" align="left" height="14" style=
11632 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11633 <p class="TextFontCX" align="center" style=
11634 'text-align:center;background:#CCCCCC'><span style=
11635 'font-size:10.0pt'>m:</span><span class=
11636 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
11637 <p class="TextFontCX"><span class="Flag"><span style=
11638 'font-size:10.0pt'>enum-index</span></span></p>
11639 <p class="IndentText">Allow members of <span class=
11640 "CodeText"><span style='font-size:10.0pt'>enum</span></span>type to
11643 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11644 height="14" align="left">
11646 <td valign="top" align="left" height="14" style=
11647 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11648 <p class="TextFontCX" align="center" style=
11649 'text-align:center;background:#CCCCCC'><span style=
11650 'font-size:10.0pt'>m:</span><span class=
11651 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11652 <p class="TextFontCX"><span class="Flag"><span style=
11653 'font-size:10.0pt'>bool-int</span></span></p>
11654 <p class="IndentText">Make <span class=
11655 "CodeText"><span style='font-size:10.0pt'>bool</span></span>
11656 and <span class="CodeText"><span style=
11657 'font-size:10.0pt'>int</span></span> are equivalent.
11658 (No type errors are reported when a Boolean is used where an
11659 integral type is expected and vice versa.)</p>
11661 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11662 height="14" align="left">
11664 <td valign="top" align="left" height="14" style=
11665 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11666 <p class="TextFontCX" align="center" style=
11667 'text-align:center;background:#CCCCCC'><span style=
11668 'font-size:10.0pt'>m:</span><span class=
11669 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11670 <p class="TextFontCX"><span class="Flag"><span style=
11671 'font-size:10.0pt'>char-int</span></span></p>
11672 <p class="IndentText">Make <span class=
11673 "CodeText"><span style='font-size:10.0pt'>char</span></span>
11674 and <span class="CodeText"><span style=
11675 'font-size:10.0pt'>int</span></span> types equivalent</p>
11678 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11679 height="14" align="left">
11681 <td valign="top" align="left" height="14" style=
11682 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11683 <p class="TextFontCX" align="center" style=
11684 'text-align:center;background:#CCCCCC'><span style=
11685 'font-size:10.0pt'>m:</span><span class=
11686 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11687 <p class="TextFontCX"><span class="Flag"><span style=
11688 'font-size:10.0pt'>charunsignedchar</span></span></p>
11689 <p class="IndentText">To allow <span class=
11690 "CodeText"><span style='font-size:10.0pt'>char</span></span>
11691 and <span class="CodeText"><span style=
11692 'font-size:10.0pt'>unsigned char</span></span> types to match use
11693 <span class="Flag"><span style=
11694 'font-size:10.0pt'>+charunsignedchar</span></span>
11698 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11699 height="14" align="left">
11701 <td valign="top" align="left" height="14" style=
11702 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11703 <p class="TextFontCX" align="center" style=
11704 'text-align:center;background:#CCCCCC'><span style=
11705 'font-size:10.0pt'>m:</span><span class=
11706 "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
11707 <p class="TextFontCX"><span class="Flag"><span style=
11708 'font-size:10.0pt'>enum-int</span></span></p>
11709 <p class="IndentText">Make <span class=
11710 "CodeText"><span style='font-size:10.0pt'>enum</span></span>
11711 and <span class="CodeText"><span style=
11712 'font-size:10.0pt'>int</span></span> types equivalent</p>
11714 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11715 height="14" align="left">
11717 <td valign="top" align="left" height="14" style=
11718 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11719 <p class="TextFontCX" align="center" style=
11720 'text-align:center;background:#CCCCCC'><span style=
11721 'font-size:10.0pt'>m:</span><span class=
11722 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11723 <p class="TextFontCX"><span class="Flag"><span style=
11724 'font-size:10.0pt'>float-double</span></span></p>
11725 <p class="IndentText">Make <span class=
11726 "CodeText"><span style='font-size:10.0pt'>float</span></span>
11727 and <span class="CodeText"><span style=
11728 'font-size:10.0pt'>double</span></span> types equivalent</p>
11730 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11731 height="14" align="left">
11733 <td valign="top" align="left" height="14" style=
11734 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11735 <p class="TextFontCX" align="center" style=
11736 'text-align:center;background:#CCCCCC'><span style=
11737 'font-size:10.0pt'>m:</span><span class=
11738 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
11739 <p class="TextFontCX"><span class="Flag"><span style=
11740 'font-size:10.0pt'>ignore-quals</span></span></p>
11741 <p class="IndentText">Ignore type qualifiers (<span class=
11742 "CodeText"><span style='font-size:10.0pt'>long</span></span>,
11743 <span class="CodeText"><span style=
11744 'font-size:10.0pt'>short</span></span>, <span class=
11745 "CodeText"><span style=
11746 'font-size:10.0pt'>unsigned</span></span>).</p>
11748 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11749 height="14" align="left">
11751 <td valign="top" align="left" height="14" style=
11752 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11753 <p class="TextFontCX" align="center" style=
11754 'text-align:center;background:#CCCCCC'><span style=
11755 'font-size:10.0pt'>m:</span><span class=
11756 "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
11757 <p class="TextFontCX"><span class="Flag"><span style=
11758 'font-size:10.0pt'>relax-quals</span></span></p>
11759 <p class="IndentText">Report qualifier mismatches only if dangerous
11760 (information may be lost since a larger type is assigned to (or
11761 passed as) a smaller one or a comparison uses <span class=
11762 "CodeText"><span style='font-size:10.0pt'>signed</span></span> and
11763 <span class="CodeText"><span style=
11764 'font-size:10.0pt'>unsigned</span></span> values.)</p>
11766 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11767 height="14" align="left">
11769 <td valign="top" align="left" height="14" style=
11770 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11771 <p class="TextFontCX" align="center" style=
11772 'text-align:center;background:#CCCCCC'><span style=
11773 'font-size:10.0pt'>m:</span><span class=
11774 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
11775 <p class="TextFontCX"><span class="Flag"><span style=
11776 'font-size:10.0pt'>ignore-signs</span></span></p>
11777 <p class="IndentText">Ignore signs in type comparisons
11778 (<span class="CodeText"><span style=
11779 'font-size:10.0pt'>unsigned</span></span> matches
11780 <span class="CodeText"><span style=
11781 'font-size:10.0pt'>signed</span></span>).</p>
11782 <p class="IndentText"> </p>
11784 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11785 height="14" align="left">
11787 <td valign="top" align="left" height="14" style=
11788 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11789 <p class="TextFontCX" align="center" style=
11790 'text-align:center;background:#CCCCCC'><span style=
11791 'font-size:10.0pt'>P:</span> <span class=
11792 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
11793 <p class="TextFontCX"><span class="Flag"><span style=
11794 'font-size:10.0pt'>long-integral</span></span></p>
11795 <p class="IndentText">Allow long type to match an arbitrary
11796 integral type (e.g., <span class="CodeText"><span style=
11797 'font-size:10.0pt'>dev_t</span></span>).</p>
11799 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11800 height="14" align="left">
11802 <td valign="top" align="left" height="14" style=
11803 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11804 <p class="TextFontCX" align="center" style=
11805 'text-align:center;background:#CCCCCC'><span style=
11806 'font-size:10.0pt'>m:</span><span class=
11807 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11808 <p class="TextFontCX"><span class="Flag"><span style=
11809 'font-size:10.0pt'>long-unsigned-integral</span></span></p>
11810 <p class="IndentText">Allow unsigned long type to match an
11811 arbitrary integral type (e.g., <span class=
11812 "CodeText"><span style='font-size:10.0pt'>dev_t</span></span>).</p>
11814 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11815 height="14" align="left">
11817 <td valign="top" align="left" height="14" style=
11818 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11819 <p class="TextFontCX" align="center" style=
11820 'text-align:center;background:#CCCCCC'><span style=
11821 'font-size:10.0pt'>P:</span> <span class=
11822 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
11823 <p class="TextFontCX"><span class="Flag"><span style=
11824 'font-size:10.0pt'>match-any-integral</span></span></p>
11825 <p class="IndentText">Allow any integral type to match an
11828 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11829 height="14" align="left">
11831 <td valign="top" align="left" height="14" style=
11832 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11833 <p class="TextFontCX" align="center" style=
11834 'text-align:center;background:#CCCCCC'><span style=
11835 'font-size:10.0pt'>P:</span> <span class=
11836 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
11837 <p class="TextFontCX"><span class="Flag"><span style=
11838 'font-size:10.0pt'>long-unsigned-unsigned-integral</span></span></p>
11839 <p class="IndentText">Allow unsigned long type to match an
11840 arbitrary unsigned integral type (e.g., <span class=
11841 "CodeText"><span style=
11842 'font-size:10.0pt'>size_t</span></span>).</p>
11844 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11845 height="14" align="left">
11847 <td valign="top" align="left" height="14" style=
11848 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11849 <p class="TextFontCX" align="center" style=
11850 'text-align:center;background:#CCCCCC'><span style=
11851 'font-size:10.0pt'>m:</span><span class=
11852 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11853 <p class="TextFontCX"><span class="Flag"><span style=
11854 'font-size:10.0pt'>long-signed-integral</span></span></p>
11855 <p class="IndentText">Allow long type to match an arbitrary signed
11856 integral type (e.g., <span class="CodeText"><span style=
11857 'font-size:10.0pt'>ssize_t</span></span>).</p>
11858 <p class="TextFontCX"><span class="Flag"><span style=
11859 'font-size:10.0pt'> </span></span></p>
11861 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11862 height="14" align="left">
11864 <td valign="top" align="left" height="14" style=
11865 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11866 <p class="TextFontCX" align="center" style=
11867 'text-align:center;background:#CCCCCC'><span style=
11868 'font-size:10.0pt'>P:</span> <span class=
11869 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11870 <p class="TextFontCX"><span class="Flag"><span style=
11871 'font-size:10.0pt'>num-literal</span></span></p>
11872 <p class="IndentText">Integer literals can be used as floats.</p>
11874 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11875 height="14" align="left">
11877 <td valign="top" align="left" height="14" style=
11878 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11879 <p class="TextFontCX" align="center" style=
11880 'text-align:center;background:#CCCCCC'><span style=
11881 'font-size:10.0pt'>P:</span> <span class=
11882 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
11883 <p class="TextFontCX"><span class="Flag"><span style=
11884 'font-size:10.0pt'>char-int-literal</span></span></p>
11885 <p class="IndentText">A character constant may be used as an
11886 <span class="CodeText"><span style=
11887 'font-size:10.0pt'>int</span></span>.</p>
11889 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11890 height="14" align="left">
11892 <td valign="top" align="left" height="14" style=
11893 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11894 <p class="TextFontCX" align="center" style=
11895 'text-align:center;background:#CCCCCC'><span style=
11896 'font-size:10.0pt'>P:</span> <span class=
11897 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11898 <p class="TextFontCX"><span class="Flag"><span style=
11899 'font-size:10.0pt'>zero-ptr</span></span></p>
11900 <p class="IndentText">Literal <span class=
11901 "CodeText"><span style='font-size:10.0pt'>0</span></span> may
11902 be used as a pointer.</p>
11904 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11905 height="14" align="left">
11907 <td valign="top" align="left" height="14" style=
11908 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11909 <p class="TextFontCX" align="center" style=
11910 'text-align:center;background:#CCCCCC'><span style=
11911 'font-size:10.0pt'>P:</span> <span class=
11912 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11913 <p class="TextFontCX"><span class="Flag"><span style=
11914 'font-size:10.0pt'>zero-bool</span></span></p>
11915 <p class="IndentText">Treat <span class=
11916 "CodeText"><span style='font-size:10.0pt'>0</span></span> as a boolean.
11919 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11920 height="14" align="left">
11922 <td valign="top" align="left" height="14" style=
11923 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11924 <p class="TextFontCX" align="center" style=
11925 'text-align:center;background:#CCCCCC'><span style=
11926 'font-size:10.0pt'>P:</span> <span class=
11927 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
11928 <p class="TextFontCX"><span class="Flag"><span style=
11929 'font-size:10.0pt'>relax-types</span></span></p>
11930 <p class="IndentText">Allow all numeric types to match.</p>
11931 <p class="Heading10"><a name="_Toc534975052">Abstract Types</a>
11932 <span class="TextFontCXChar"><span style=
11933 'font-size:11.0pt; font-weight:normal'>(Section</span></span>
11934 <span class="TextFontCXChar"><span style=
11935 'font-size:11.0pt; font-weight:normal'>4.3</span></span><span class="TextFontCXChar">
11937 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
11940 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11941 height="14" align="left">
11943 <td valign="top" align="left" height="14" style=
11944 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11945 <p class="TextFontCX" align="center" style=
11946 'text-align:center;background:#CCCCCC'><span style=
11947 'font-size:10.0pt'>m:</span> <span class=
11948 "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
11949 <p class="TextFontCX"><span class="Flag"><span style=
11950 'font-size:10.0pt'>shortint</span></span></p>
11951 <p class="IndentText">
11952 Make short int and int types equivalent.
11954 <p class="Heading10"><a name="_Toc534975052">Abstract Types</a>
11955 <span class="TextFontCXChar"><span style=
11956 'font-size:11.0pt; font-weight:normal'>(Section</span></span>
11957 <span class="TextFontCXChar"><span style=
11958 'font-size:11.0pt; font-weight:normal'>4.3</span></span><span class="TextFontCXChar">
11960 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
11965 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11966 height="14" align="left">
11968 <td valign="top" align="left" height="14" style=
11969 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11970 <p class="TextFontCX" align="center" style=
11971 'text-align:center;background:#CCCCCC'><span style=
11972 'font-size:10.0pt'>P:</span> <span class=
11973 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
11974 <p class="TextFontCX"><span class="Flag"><span style=
11975 'font-size:10.0pt'>abstract</span></span></p>
11976 <p class="IndentText">A data abstraction barrier is violated</p>
11978 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11979 height="14" align="left">
11981 <td valign="top" align="left" height="14" style=
11982 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
11983 <p class="TextFontCX" align="center" style=
11984 'text-align:center;background:#CCCCCC'><span style=
11985 'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
11986 'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
11987 <p class="TextFontCX"><span class="Flag"><span style=
11988 'font-size:10.0pt'>imp-abstract</span></span></p>
11989 <p class="IndentText">Implicit <span class=
11990 "Annot"><span style='font-size:10.0pt'>abstract</span></span>
11991 annotation for type declarations that do not use <span class=
11992 "Annot"><span style=
11993 'font-size:10.0pt'>concrete</span></span>.</p>
11995 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
11996 height="14" align="left">
11998 <td valign="top" align="left" height="14" style=
11999 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12000 <p class="TextFontCX" align="center" style=
12001 'text-align:center;background:#CCCCCC'><span style=
12002 'font-size:10.0pt'>m:</span><span class="Flag"><span style=
12003 'font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12004 <p class="TextFontCX"><span class="Flag"><span style=
12005 'font-size:10.0pt'>mut-rep</span></span></p>
12006 <p class="IndentText">Representation of mutable type has sharing
12008 <p class="Heading10">Access <span class=
12009 "TextFontCXChar"><span style=
12010 'font-size:11.0pt; font-weight:normal'>(Section
12011 4.3.1)</span></span></p>
12013 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12014 height="14" align="left">
12016 <td valign="top" align="left" height="14" style=
12017 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12018 <p class="TextFontCX" align="center" style=
12019 'text-align:center;background:#CCCCCC'><span style=
12020 'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
12021 <p class="TextFontCX"><span class="Flag"><span style=
12022 'font-size:10.0pt'>access-module</span></span></p>
12023 <p class="IndentText">An abstract type defined in
12024 <span class="ProgramNameChar"><i>M</i></span><span class=
12025 "ProgramNameChar">.h</span> (or specified in <span class=
12026 "ProgramNameChar"><i>M</i></span><span class=
12027 "ProgramNameChar">.lcl</span>) is accessible in <span class=
12028 "ProgramNameChar"><i>M</i></span><span class=
12029 "ProgramNameChar">.c</span>.</p>
12031 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12032 height="14" align="left">
12034 <td valign="top" align="left" height="14" style=
12035 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12036 <p class="TextFontCX" align="center" style=
12037 'text-align:center;background:#CCCCCC'><span style=
12038 'font-size:10.0pt'>P:</span> <span class=
12039 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
12040 <p class="TextFontCX"><span class="Flag"><span style=
12041 'font-size:10.0pt'>access-file</span></span></p>
12042 <p class="IndentText">An abstract type named <span class=
12043 "CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
12044 is accessible in files named <span class=
12045 "ProgramNameChar"><i>type</i></span><span class=
12046 "ProgramNameChar">.*</span></p>
12048 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12049 height="14" align="left">
12051 <td valign="top" align="left" height="14" style=
12052 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12053 <p class="TextFontCX" align="center" style=
12054 'text-align:center;background:#CCCCCC'><span style=
12055 'font-size:10.0pt'>P:</span> <span class=
12056 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
12057 <p class="MsoListBullet"><span class="Flag"><span style=
12058 'font-size:10.0pt'>access-czech</span></span></p>
12059 <p class="IndentText">An abstract type named <span class=
12060 "CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
12061 may be accessible in a function named <span class=
12062 "CodeText"><i><span style=
12063 'font-size:10.0pt'>type_name</span></i></span>. (Section
12066 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12067 height="14" align="left">
12069 <td valign="top" align="left" height="14" style=
12070 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12071 <p class="TextFontCX" align="center" style=
12072 'text-align:center;background:#CCCCCC'><span style=
12073 'font-size:10.0pt'>P:</span> <span class=
12074 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
12075 <p class="MsoListBullet"><span class="Flag"><span style=
12076 'font-size:10.0pt'>access-slovak</span></span></p>
12077 <p class="IndentText">An abstract type named <span class=
12078 "CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
12079 may be accessible in a function named <span class=
12080 "CodeText"><i><span style=
12081 'font-size:10.0pt'>typeName</span></i></span>.
12082 (Section.12.1.2)</p>
12084 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12085 height="14" align="left">
12087 <td valign="top" align="left" height="14" style=
12088 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12089 <p class="TextFontCX" align="center" style=
12090 'text-align:center;background:#CCCCCC'><span style=
12091 'font-size:10.0pt'>P:</span> <span class=
12092 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
12093 <p class="MsoListBullet"><span class="Flag"><span style=
12094 'font-size:10.0pt'>access-czechoslovak</span></span></p>
12095 <p class="IndentText">An abstract type named <span class=
12096 "CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
12097 may be accessible in a function named <span class=
12098 "CodeText"><i><span style=
12099 'font-size:10.0pt'>type_name</span></i></span> or
12100 <span class="CodeText"><i><span style=
12101 'font-size:10.0pt'>typeName</span></i></span>. (Section
12104 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12105 height="14" align="left">
12107 <td valign="top" align="left" height="14" style=
12108 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12109 <p class="TextFontCX" align="center" style=
12110 'text-align:center;background:#CCCCCC'><span style=
12111 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
12112 <p class="TextFontCX"><span class="Flag"><span style=
12113 'font-size:10.0pt'>access-all</span></span></p>
12114 <p class="IndentText">Sets <span class="Flag"><span style=
12115 'font-size:10.0pt'>access-module</span></span>, <span class=
12116 "Flag"><span style='font-size:10.0pt'>access-file</span></span> and
12117 <span class="Flag"><span style=
12118 'font-size:10.0pt'>access-czech</span></span>.</p>
12119 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
12120 <a name="_Toc534975053">Memory Management</a> <span class=
12121 "TextFontCXChar"><span style=
12122 'font-size:11.0pt; font-weight:normal'>(Section</span></span>
12123 <span class="TextFontCXChar"><span style=
12124 'font-size:11.0pt; font-weight:normal'>5</span></span><span class="TextFontCXChar">
12126 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
12127 <p class="TextFontCX">Reporting of memory management errors is
12128 controlled by flags setting checking and implicit annotations and
12129 code annotations. </p>
12130 <p class="Heading10">Deallocation Errors <span class=
12131 "TextFontCXChar"><span style=
12132 'font-size:11.0pt; font-weight:normal'>(Section
12133 5.2)</span></span></p>
12135 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12136 height="14" align="left">
12138 <td valign="top" align="left" height="14" style=
12139 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12140 <p class="TextFontCX" align="center" style=
12141 'text-align:center;background:#CCCCCC'><span style=
12142 'font-size:10.0pt'>m:</span><span class=
12143 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12144 <p class="TextFontCX"><span class="Flag"><span style=
12145 'font-size:10.0pt'>use-released</span></span></p>
12146 <p class="IndentText">Storage used after it may have been
12149 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12150 height="14" align="left">
12152 <td valign="top" align="left" height="14" style=
12153 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12154 <p class="TextFontCX" align="center" style=
12155 'text-align:center;background:#CCCCCC'><span style=
12156 'font-size:10.0pt'>m:</span><span class=
12157 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
12158 <p class="TextFontCX"><span class="Flag"><span style=
12159 'font-size:10.0pt'>strict-use-released</span></span></p>
12160 <p class="IndentText">An array element used after it may have been
12162 <p class="Heading10">Inconsistent Branches</p>
12164 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12165 height="14" align="left">
12167 <td valign="top" align="left" height="14" style=
12168 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12169 <p class="TextFontCX" align="center" style=
12170 'text-align:center;background:#CCCCCC'><span style=
12171 'font-size:10.0pt'>m:</span><span class=
12172 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12173 <p class="TextFontCX"><span class="Flag"><span style=
12174 'font-size:10.0pt'>branch-state</span></span></p>
12175 <p class="IndentText">Storage has inconsistent states of alternate
12176 paths through a branch (e.g., it is released in the true branch of
12177 an if-statement, but there is no else branch.)</p>
12179 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12180 height="14" align="left">
12182 <td valign="top" align="left" height="14" style=
12183 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12184 <p class="TextFontCX" align="center" style=
12185 'text-align:center;background:#CCCCCC'><span style=
12186 'font-size:10.0pt'>m:</span><span class=
12187 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
12188 <p class="TextFontCX"><span class="Flag"><span style=
12189 'font-size:10.0pt'>strict-branch-state</span></span></p>
12190 <p class="IndentText">Storage through array fetch has inconsistent
12191 states of alternate paths through a branch. Since array
12192 elements are not checked accurately, this may lead to spurious
12195 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12196 height="14" align="left">
12198 <td valign="top" align="left" height="14" style=
12199 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12200 <p class="TextFontCX" align="center" style=
12201 'text-align:center;background:#CCCCCC'><span style=
12202 'font-size:10.0pt'>m:</span><span class=
12203 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12204 <p class="TextFontCX"><span class="Flag"><span style=
12205 'font-size:10.0pt'>dep-arrays</span></span></p>
12206 <p class="IndentText">Treat array elements as <span class=
12207 "Annot"><span style='font-size:10.0pt'>dependent</span></span>
12208 storage. Checking of array elements cannot be done accurately
12209 by Splint. If <span class="Flag"><span style=
12210 'font-size:10.0pt'>dep-arrays</span></span> is not set, array
12211 elements are assumed to be independent, so code that releases the
12212 same element more than once will produce no error. If
12213 <span class="Flag"><span style=
12214 'font-size:10.0pt'>dep-arrays</span></span> is set, array elements
12215 are assumed to be dependent, so code that releases the same element
12216 more that once will produce an error, but code that releases
12217 different elements correctly will produce a spurious error.</p>
12218 <p class="Heading10">Memory Leaks</p>
12220 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12221 height="14" align="left">
12223 <td valign="top" align="left" height="14" style=
12224 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12225 <p class="TextFontCX" align="center" style=
12226 'text-align:center;background:#CCCCCC'><span style=
12227 'font-size:10.0pt'>m:</span><span class=
12228 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12229 <p class="TextFontCX"><span class="Flag"><span style=
12230 'font-size:10.0pt'>must-free</span></span></p>
12231 <p class="IndentText">Allocated storage was not released before
12232 return or scope exit. Errors are reported for
12233 <span class="Annot"><span style=
12234 'font-size:10.0pt'>only</span></span>, <span class=
12235 "Annot"><span style='font-size:10.0pt'>fresh</span></span> or
12236 <span class="Annot"><span style=
12237 'font-size:10.0pt'>owned</span></span> storage.</p>
12241 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12242 height="14" align="left">
12244 <td valign="top" align="left" height="14" style=
12245 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12246 <p class="TextFontCX" align="center" style=
12247 'text-align:center;background:#CCCCCC'><span style=
12248 'font-size:10.0pt'>m:</span><span class=
12249 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12250 <p class="TextFontCX"><span class="Flag"><span style=
12251 'font-size:10.0pt'>mustfreefresh</span></span></p>
12252 <p class="IndentText">
12253 Allocated storage was not released before return or scope exit. Errors are reported for
12254 <span class="Annot"><span style='font-size:10.0pt'>fresh</span></span> storage
12259 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12260 height="14" align="left">
12262 <td valign="top" align="left" height="14" style=
12263 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12264 <p class="TextFontCX" align="center" style=
12265 'text-align:center;background:#CCCCCC'><span style=
12266 'font-size:10.0pt'>m:</span><span class=
12267 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12268 <p class="TextFontCX"><span class="Flag"><span style=
12269 'font-size:10.0pt'>mustfreeonly</span></span></p>
12270 <p class="IndentText">
12271 Allocated storage was not released before return or scope exit. Errors are reported for
12272 <span class="Annot"><span style='font-size:10.0pt'>only</span></span> storage
12276 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12277 height="14" align="left">
12279 <td valign="top" align="left" height="14" style=
12280 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12281 <p class="TextFontCX" align="center" style=
12282 'text-align:center;background:#CCCCCC'><span style=
12283 'font-size:10.0pt'>shortcut</span><span class=
12284 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
12285 <p class="TextFontCX"><span class="Flag"><span style=
12286 'font-size:10.0pt'>memchecks</span></span></p>
12287 <p class="IndentText">
12288 Sets all dynamic memory checking flags
12290 "Flag"><span style='font-size:10.0pt'>memimplicit, mustfree, mustdefine, mustnotalias, null, memtrans</span> </span>).
12294 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12295 height="14" align="left">
12297 <td valign="top" align="left" height="14" style=
12298 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12299 <p class="TextFontCX" align="center" style=
12300 'text-align:center;background:#CCCCCC'><span style=
12301 'font-size:10.0pt'>m:</span><span class=
12302 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12303 <p class="TextFontCX"><span class="Flag"><span style=
12304 'font-size:10.0pt'>comp-destroy</span></span></p>
12305 <p class="IndentText">All only references derivable from
12306 <span class="Annot"><span style='font-size:10.0pt'>out
12307 only</span></span> parameter of type <span class=
12308 "CodeText"><span style='font-size:10.0pt'>void *</span></span> must
12309 be released. (This is the type of the parameter to
12310 <span class="CodeText"><span style=
12311 'font-size:10.0pt'>free</span></span>, but may also be used for
12312 user-defined deallocation functions.)</p>
12314 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12315 height="14" align="left">
12317 <td valign="top" align="left" height="14" style=
12318 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12319 <p class="TextFontCX" align="center" style=
12320 'text-align:center;background:#CCCCCC'><span style=
12321 'font-size:10.0pt'>m:</span><span class=
12322 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
12323 <p class="TextFontCX"><span class="Flag"><span style=
12324 'font-size:10.0pt'>strict-destroy</span></span></p>
12325 <p class="IndentText">Report complete destruction errors for array
12326 elements that may have been released. (If <span class=
12327 "Flag"><span style='font-size:10.0pt'>strict-destroy</span></span>
12328 is not set, Splint will assume that if any array element was
12329 released, the entire array was correctly released.)</p>
12330 <p class="Heading10">Transfer Errors</p>
12331 <p class="beforelist">A transfer error is reported when storage is
12332 transferred (by an assignment, passing a parameter, or returning)
12333 in a way that is inconsistent.</p>
12335 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12336 height="14" align="left">
12338 <td valign="top" align="left" height="14" style=
12339 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12340 <p class="TextFontCX" align="center" style=
12341 'text-align:center;background:#CCCCCC'><span style=
12342 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
12343 <p class="TextFontCX"><span class="Flag"><span style=
12344 'font-size:10.0pt'>mem-trans</span></span></p>
12345 <p class="IndentText">Sets all memory transfer errors flags.</p>
12347 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12348 height="14" align="left">
12350 <td valign="top" align="left" height="14" style=
12351 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12352 <p class="TextFontCX" align="center" style=
12353 'text-align:center;background:#CCCCCC'><span style=
12354 'font-size:10.0pt'>m:</span><span class=
12355 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12356 <p class="TextFontCX"><span class="Flag"><span style=
12357 'font-size:10.0pt'>only-trans</span></span></p>
12358 <p class="IndentText">Only storage transferred to non-only
12359 reference (memory leak).</p>
12361 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12362 height="14" align="left">
12364 <td valign="top" align="left" height="14" style=
12365 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12366 <p class="TextFontCX" align="center" style=
12367 'text-align:center;background:#CCCCCC'><span style=
12368 'font-size:10.0pt'>m:</span><span class=
12369 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12370 <p class="TextFontCX"><span class="Flag"><span style=
12371 'font-size:10.0pt'>ownedtrans</span></span></p>
12372 <p class="IndentText">Owned storage transferred to non-owned
12373 reference (memory leak).</p>
12375 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12376 height="14" align="left">
12378 <td valign="top" align="left" height="14" style=
12379 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12380 <p class="TextFontCX" align="center" style=
12381 'text-align:center;background:#CCCCCC'><span style=
12382 'font-size:10.0pt'>m:</span><span class=
12383 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12384 <p class="TextFontCX"><span class="Flag"><span style=
12385 'font-size:10.0pt'>fresh-trans</span></span></p>
12386 <p class="IndentText">Newly-allocated storage transferred to
12387 non-only reference (memory leak).</p>
12389 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12390 height="14" align="left">
12392 <td valign="top" align="left" height="14" style=
12393 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12394 <p class="TextFontCX" align="center" style=
12395 'text-align:center;background:#CCCCCC'><span style=
12396 'font-size:10.0pt'>m:</span><span class=
12397 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12398 <p class="TextFontCX"><span class="Flag"><span style=
12399 'font-size:10.0pt'>shared-trans</span></span></p>
12400 <p class="IndentText">Shared storage transferred to non-shared
12403 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12404 height="14" align="left">
12406 <td valign="top" align="left" height="14" style=
12407 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12408 <p class="TextFontCX" align="center" style=
12409 'text-align:center;background:#CCCCCC'><span style=
12410 'font-size:10.0pt'>m:</span><span class=
12411 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12412 <p class="TextFontCX"><span class="Flag"><span style=
12413 'font-size:10.0pt'>dependent-trans</span></span></p>
12414 <p class="IndentText">Inconsistent <span class=
12415 "Annot"><span style='font-size:10.0pt'>dependent</span></span>
12416 transfer. Dependent storage is transferred to a non-dependent
12419 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12420 height="14" align="left">
12422 <td valign="top" align="left" height="14" style=
12423 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12424 <p class="TextFontCX" align="center" style=
12425 'text-align:center;background:#CCCCCC'><span style=
12426 'font-size:10.0pt'>m:</span><span class=
12427 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12428 <p class="TextFontCX"><span class="Flag"><span style=
12429 'font-size:10.0pt'>temp-trans</span></span></p>
12430 <p class="IndentText">Temporary storage (associated with a
12431 <span class="Annot"><span style=
12432 'font-size:10.0pt'>temp</span></span> formal parameter) is
12433 transferred to a non-temporary reference. The storage may be
12434 released or new aliases created.</p>
12436 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12437 height="14" align="left">
12439 <td valign="top" align="left" height="14" style=
12440 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12441 <p class="TextFontCX" align="center" style=
12442 'text-align:center;background:#CCCCCC'><span style=
12443 'font-size:10.0pt'>m:</span><span class=
12444 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12445 <p class="TextFontCX"><span class="Flag"><span style=
12446 'font-size:10.0pt'>kept-trans</span></span></p>
12447 <p class="IndentText">Kept storage (storage what was passed as
12448 <span class="Annot"><span style=
12449 'font-size:10.0pt'>keep</span></span>) transferred to non-temporary
12452 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12453 height="14" align="left">
12455 <td valign="top" align="left" height="14" style=
12456 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12457 <p class="TextFontCX" align="center" style=
12458 'text-align:center;background:#CCCCCC'><span style=
12459 'font-size:10.0pt'>m:</span><span class=
12460 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12461 <p class="TextFontCX"><span class="Flag"><span style=
12462 'font-size:10.0pt'>keep-trans</span></span></p>
12463 <p class="IndentText">Keep storage is transferred in a way that may
12464 add a new alias to it, or release it.</p>
12466 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12467 height="14" align="left">
12469 <td valign="top" align="left" height="14" style=
12470 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12471 <p class="TextFontCX" align="center" style=
12472 'text-align:center;background:#CCCCCC'><span style=
12473 'font-size:10.0pt'>m:</span><span class=
12474 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12475 <p class="TextFontCX"><span class="Flag"><span style=
12476 'font-size:10.0pt'>refcount-trans</span></span></p>
12477 <p class="IndentText">Reference counted storage is transferred in
12478 an inconsistent way.</p>
12480 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12481 height="14" align="left">
12483 <td valign="top" align="left" height="14" style=
12484 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12485 <p class="TextFontCX" align="center" style=
12486 'text-align:center;background:#CCCCCC'><span style=
12487 'font-size:10.0pt'>m:</span><span class=
12488 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12489 <p class="TextFontCX"><span class="Flag"><span style=
12490 'font-size:10.0pt'>newref-trans</span></span></p>
12491 <p class="IndentText">A new reference transferred to a reference
12492 counted reference (reference count is not set correctly).</p>
12494 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12495 height="14" align="left">
12497 <td valign="top" align="left" height="14" style=
12498 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12499 <p class="TextFontCX" align="center" style=
12500 'text-align:center;background:#CCCCCC'><span style=
12501 'font-size:10.0pt'>m:</span><span class=
12502 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12503 <p class="TextFontCX"><span class="Flag"><span style=
12504 'font-size:10.0pt'>immediate-trans</span></span></p>
12505 <p class="IndentText">An immediate address (result of
12506 <span class="CodeText"><span style=
12507 'font-size:10.0pt'>&</span></span>) is transferred
12508 inconsistently.</p>
12510 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12511 height="14" align="left">
12513 <td valign="top" align="left" height="14" style=
12514 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12515 <p class="TextFontCX" align="center" style=
12516 'text-align:center;background:#CCCCCC'><span style=
12517 'font-size:10.0pt'>m:</span><span class=
12518 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12519 <p class="TextFontCX"><span class="Flag"><span style=
12520 'font-size:10.0pt'>static-trans</span></span></p>
12521 <p class="IndentText">Static storage is transferred in an
12522 inconsistent way.</p>
12524 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12525 height="14" align="left">
12527 <td valign="top" align="left" height="14" style=
12528 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12529 <p class="TextFontCX" align="center" style=
12530 'text-align:center;background:#CCCCCC'><span style=
12531 'font-size:10.0pt'>m:</span><span class=
12532 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12533 <p class="TextFontCX"><span class="Flag"><span style=
12534 'font-size:10.0pt'>expose-trans</span></span></p>
12535 <p class="IndentText">Inconsistent exposure transfer. Exposed
12536 storage is transferred to a non-<span class=
12537 "Annot"><span style='font-size:10.0pt'>exposed</span></span>,
12538 non-<span class="Annot"><span style=
12539 'font-size:10.0pt'>observer</span></span> reference.</p>
12541 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12542 height="14" align="left">
12544 <td valign="top" align="left" height="14" style=
12545 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12546 <p class="TextFontCX" align="center" style=
12547 'text-align:center;background:#CCCCCC'><span style=
12548 'font-size:10.0pt'>m:</span><span class=
12549 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12550 <p class="TextFontCX"><span class="Flag"><span style=
12551 'font-size:10.0pt'>observer-trans</span></span></p>
12552 <p class="IndentText">Inconsistent <span class=
12553 "Annot"><span style='font-size:10.0pt'>observer</span></span>
12554 transfer. Observer storage is transferred to a non-observer
12557 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12558 height="14" align="left">
12560 <td valign="top" align="left" height="14" style=
12561 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12562 <p class="TextFontCX" align="center" style=
12563 'text-align:center;background:#CCCCCC'><span style=
12564 'font-size:10.0pt'>m:</span><span class=
12565 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12566 <p class="TextFontCX"><span class="Flag"><span style=
12567 'font-size:10.0pt'>unqualified-trans</span></span></p>
12568 <p class="IndentText">Unqualified storage is transferred in an
12569 inconsistent way.</p>
12570 <p class="Heading11">Initializers</p>
12572 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12573 height="14" align="left">
12575 <td valign="top" align="left" height="14" style=
12576 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12577 <p class="TextFontCX" align="center" style=
12578 'text-align:center;background:#CCCCCC'><span style=
12579 'font-size:10.0pt'>m:</span><span class=
12580 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12581 <p class="TextFontCX"><span class="Flag"><span style=
12582 'font-size:10.0pt'>only-unq-global-trans</span></span></p>
12583 <p class="IndentText">Only storage transferred to an unqualified
12584 global or static reference. This may lead to a memory leak, since
12585 the new reference is not necessarily released.</p>
12587 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12588 height="14" align="left">
12590 <td valign="top" align="left" height="14" style=
12591 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12592 <p class="TextFontCX" align="center" style=
12593 'text-align:center;background:#CCCCCC'><span style=
12594 'font-size:10.0pt'>m:</span><span class=
12595 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12596 <p class="TextFontCX"><span class="Flag"><span style=
12597 'font-size:10.0pt'>static-init-trans</span></span></p>
12598 <p class="IndentText">Static storage is used as an initial value in
12599 an inconsistent way.</p>
12601 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12602 height="14" align="left">
12604 <td valign="top" align="left" height="14" style=
12605 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12606 <p class="TextFontCX" align="center" style=
12607 'text-align:center;background:#CCCCCC'><span style=
12608 'font-size:10.0pt'>m:</span><span class=
12609 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12610 <p class="TextFontCX"><span class="Flag"><span style=
12611 'font-size:10.0pt'>unqualified-init-trans</span></span></p>
12612 <p class="IndentText">Unqualified storage is used as an initial
12613 value in an inconsistent way.</p>
12614 <p class="Heading11">Derived Storage</p>
12616 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12617 height="14" align="left">
12619 <td valign="top" align="left" height="14" style=
12620 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12621 <p class="TextFontCX" align="center" style=
12622 'text-align:center;background:#CCCCCC'><span style=
12623 'font-size:10.0pt'>m:</span><span class=
12624 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12625 <p class="TextFontCX"><span class="Flag"><span style=
12626 'font-size:10.0pt'>comp-mem-pass</span></span></p>
12627 <p class="IndentText">Storage derivable from a parameter does not
12628 match the alias kind expected for the formal parameter.</p>
12629 <p class="Heading11">Stack References</p>
12631 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12632 height="14" align="left">
12634 <td valign="top" align="left" height="14" style=
12635 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12636 <p class="TextFontCX" align="center" style=
12637 'text-align:center;background:#CCCCCC'><span style=
12638 'font-size:10.0pt'>m:</span><span class=
12639 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
12640 <p class="TextFontCX"><span class="Flag"><span style=
12641 'font-size:10.0pt'>stack-ref</span></span></p>
12642 <p class="IndentText">A stack reference is pointed to by an
12643 external reference when the function returns. Since the call
12644 frame will be destroyed when the function returns the return value
12645 will point to dead storage. (Section 5.2.6)</p>
12646 <p class="Heading10">Implicit Memory Annotations <span class=
12647 "HeadingNote"><span style=
12648 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
12649 <span class="HeadingNote"><span style=
12650 'font-size:10.5pt;font-weight:normal;font-style: normal'>5.3</span></span><span class="HeadingNote">
12652 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
12656 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12657 height="14" align="left">
12659 <td valign="top" align="left" height="14" style=
12660 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12661 <p class="TextFontCX" align="center" style=
12662 'text-align:center;background:#CCCCCC'><span style=
12663 'font-size:10.0pt'>shortcut</span> <span class=
12664 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
12665 <p class="TextFontCX"><span class="Flag"><span style=
12666 'font-size:10.0pt'>all-imp-only</span></span></p>
12667 <p class="IndentText">Sets
12668 <span class="Flag"><span style=
12669 'font-size:10.0pt'>
12670 glob-imp-only, ret-imp-only, struct-imp-only, specglobimponly, specretimponly
12673 <span class="Flag"><span style=
12674 'font-size:10.0pt'>
12681 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12682 height="14" align="left">
12684 <td valign="top" align="left" height="14" style=
12685 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12686 <p class="TextFontCX" align="center" style=
12687 'text-align:center;background:#CCCCCC'><span style=
12688 'font-size:10.0pt'>P:</span> <span class=
12689 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
12690 <p class="TextFontCX"><span class="Flag"><span style=
12691 'font-size:10.0pt'>glob-imp-only</span></span></p>
12692 <p class="IndentText">Assume unannotated global storage is
12697 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12698 height="14" align="left">
12700 <td valign="top" align="left" height="14" style=
12701 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12702 <p class="TextFontCX" align="center" style=
12703 'text-align:center;background:#CCCCCC'><span style=
12704 'font-size:10.0pt'>P:</span> <span class=
12705 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
12706 <p class="TextFontCX"><span class="Flag"><span style=
12707 'font-size:10.0pt'>param-imp-temp</span></span></p>
12708 <p class="IndentText">Assume unannotated parameter is
12709 <span class="Annot"><span style=
12710 'font-size:10.0pt'>temp</span></span>.</p>
12712 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12713 height="14" align="left">
12715 <td valign="top" align="left" height="14" style=
12716 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12717 <p class="TextFontCX" align="center" style=
12718 'text-align:center;background:#CCCCCC'><span style=
12719 'font-size:10.0pt'>P:</span> <span class=
12720 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
12721 <p class="TextFontCX"><span class="Flag"><span style=
12722 'font-size:10.0pt'>ret-imp-only</span></span></p>
12723 <p class="IndentText">Assume unannotated returned storage is
12724 <span class="Annot"><span style=
12725 'font-size:10.0pt'>only</span></span>.</p>
12727 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12728 height="14" align="left">
12730 <td valign="top" align="left" height="14" style=
12731 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12732 <p class="TextFontCX" align="center" style=
12733 'text-align:center;background:#CCCCCC'><span style=
12734 'font-size:10.0pt'>P:</span> <span class=
12735 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
12736 <p class="TextFontCX"><span class="Flag"><span style=
12737 'font-size:10.0pt'>struct-imp-only</span></span></p>
12738 <p class="IndentText">Assume unannotated structure or union field
12739 is <span class="Annot"><span style=
12740 'font-size:10.0pt'>only</span></span>.</p>
12742 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12743 height="14" align="left">
12745 <td valign="top" align="left" height="14" style=
12746 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12747 <p class="TextFontCX" align="center" style=
12748 'text-align:center;background:#CCCCCC'><span style=
12749 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
12750 <p class="TextFontCX"><span class="Flag"><span style=
12751 'font-size:10.0pt'>code-imp-only</span></span></p>
12752 <p class="IndentText">Sets <span class="Flag"><span style=
12753 'font-size:10.0pt'>glob-imp-only</span></span>, <span class=
12754 "Flag"><span style='font-size:10.0pt'>ret-imp-only</span></span>
12755 and <span class="Flag"><span style=
12756 'font-size:10.0pt'>struct-imp-only</span></span>.</p>
12758 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12759 height="14" align="left">
12761 <td valign="top" align="left" height="14" style=
12762 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12763 <p class="TextFontCX" align="center" style=
12764 'text-align:center;background:#CCCCCC'><span style=
12765 'font-size:10.0pt'>m:</span><span class=
12766 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12767 <p class="TextFontCX"><span class="Flag"><span style=
12768 'font-size:10.0pt'>mem-imp</span></span></p>
12769 <p class="IndentText">Report memory errors for unqualified
12772 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12773 height="14" align="left">
12775 <td valign="top" align="left" height="14" style=
12776 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12777 <p class="TextFontCX" align="center" style=
12778 'text-align:center;background:#CCCCCC'><span style=
12779 'font-size:10.0pt'>m:</span><span class=
12780 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
12781 <p class="TextFontCX"><span class="Flag"><span style=
12782 'font-size:10.0pt'>pass-unknown</span></span></p>
12783 <p class="IndentText">Passing a value as an unannotated parameter
12784 clears its annotation. This will prevent many spurious errors
12785 from being report for unannotated programs, but eliminates the
12786 possibility of detecting many errors.</p>
12787 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
12788 <a name="_Toc534975054">Sharing</a> <span class=
12789 "TextFontCXChar"><span style=
12790 'font-size:11.0pt; font-weight:normal'>(Section
12791 6)</span></span></p>
12792 <p class="Heading10">Aliasing <span class=
12793 "TextFontCXChar"><span style=
12794 'font-size:11.0pt; font-weight:normal'>(Section</span></span>
12795 <span class="TextFontCXChar"><span style=
12796 'font-size:11.0pt; font-weight:normal'>6.1</span></span><span class="TextFontCXChar">
12798 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
12800 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12801 height="14" align="left">
12803 <td valign="top" align="left" height="14" style=
12804 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12805 <p class="TextFontCX" align="center" style=
12806 'text-align:center;background:#CCCCCC'><span style=
12807 'font-size:10.0pt'>m:</span><span class=
12808 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12809 <p class="TextFontCX"><span class="Flag"><span style=
12810 'font-size:10.0pt'>alias-unique</span></span></p>
12811 <p class="IndentText">An actual parameter that is passed as a
12812 <span class="Annot"><span style=
12813 'font-size:10.0pt'>unique</span></span> formal parameter is aliased
12814 by another parameter or global variable.</p>
12816 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12817 height="14" align="left">
12819 <td valign="top" align="left" height="14" style=
12820 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12821 <p class="TextFontCX" align="center" style=
12822 'text-align:center;background:#CCCCCC'><span style=
12823 'font-size:10.0pt'>m:</span><span class=
12824 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12825 <p class="TextFontCX"><span class="Flag"><span style=
12826 'font-size:10.0pt'>may-alias-unique</span></span></p>
12827 <p class="IndentText">An actual parameter that is passed as a
12828 <span class="Annot"><span style=
12829 'font-size:10.0pt'>unique</span></span> formal parameter may be
12830 aliased by another parameter or global variable.</p>
12832 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12833 height="14" align="left">
12835 <td valign="top" align="left" height="14" style=
12836 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12837 <p class="TextFontCX" align="center" style=
12838 'text-align:center;background:#CCCCCC'><span style=
12839 'font-size:10.0pt'>m:</span><span class=
12840 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12841 <p class="TextFontCX"><span class="Flag"><span style=
12842 'font-size:10.0pt'>must-not-alias</span></span></p>
12843 <p class="IndentText">An alias has been added to a
12844 <span class="Annot"><span style=
12845 'font-size:10.0pt'>temp</span></span>-qualifier parameter
12846 or global that is visible externally when the function
12849 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12850 height="14" align="left">
12852 <td valign="top" align="left" height="14" style=
12853 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12854 <p class="TextFontCX" align="center" style=
12855 'text-align:center;background:#CCCCCC'><span style=
12856 'font-size:10.0pt'>m:</span><span class=
12857 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12858 <p class="TextFontCX"><span class="Flag"><span style=
12859 'font-size:10.0pt'>ret-alias</span></span></p>
12860 <p class="IndentText">A function returns an alias to parameter or
12862 <p class="Heading10">Exposure <span class=
12863 "HeadingNote"><span style='font-size: 10.5pt;font-weight:normal;font-style:normal'>
12864 (Section</span></span> <span class="HeadingNote"><span style=
12865 'font-size:10.5pt;font-weight:normal;font-style: normal'>6.2</span></span><span class="HeadingNote">
12867 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
12869 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12870 height="14" align="left">
12872 <td valign="top" align="left" height="14" style=
12873 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12874 <p class="TextFontCX" align="center" style=
12875 'text-align:center;background:#CCCCCC'><span style=
12876 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
12877 <p class="TextFontCX"><span class="Flag"><span style=
12878 'font-size:10.0pt'>rep-expose</span></span></p>
12879 <p class="IndentText">The internal representation of an abstract
12880 type is visible to the caller. This means clients may have
12881 access to a pointer into the abstract representation. (Sets
12882 <span class="Flag"><span style=
12883 'font-size:10.0pt'>assign-expose</span></span>, <span class=
12884 "Flag"><span style='font-size:10.0pt'>ret-expose</span></span>, and
12885 <span class="Flag"><span style=
12886 'font-size:10.0pt'>cast-expose</span></span>.)</p>
12888 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12889 height="14" align="left">
12891 <td valign="top" align="left" height="14" style=
12892 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12893 <p class="TextFontCX" align="center" style=
12894 'text-align:center;background:#CCCCCC'><span style=
12895 'font-size:10.0pt'>m:</span><span class=
12896 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12897 <p class="TextFontCX"><span class="Flag"><span style=
12898 'font-size:10.0pt'>assign-expose</span></span></p>
12899 <p class="IndentText">Abstract representation is exposed by an
12900 assignment or passed parameter.</p>
12902 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12903 height="14" align="left">
12905 <td valign="top" align="left" height="14" style=
12906 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12907 <p class="TextFontCX" align="center" style=
12908 'text-align:center;background:#CCCCCC'><span style=
12909 'font-size:10.0pt'>m:</span><span class=
12910 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12911 <p class="TextFontCX"><span class="Flag"><span style=
12912 'font-size:10.0pt'>cast-expose</span></span></p>
12913 <p class="IndentText">Abstract representation is exposed through a
12916 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12917 height="14" align="left">
12919 <td valign="top" align="left" height="14" style=
12920 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12921 <p class="TextFontCX" align="center" style=
12922 'text-align:center;background:#CCCCCC'><span style=
12923 'font-size:10.0pt'>m:</span><span class=
12924 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12925 <p class="TextFontCX"><span class="Flag"><span style=
12926 'font-size:10.0pt'>ret-expose</span></span></p>
12927 <p class="IndentText">Abstract representation is exposed by a
12929 <p class="Heading11">Observer Modifications</p>
12931 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12932 height="14" align="left">
12934 <td valign="top" align="left" height="14" style=
12935 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12936 <p class="TextFontCX" align="center" style=
12937 'text-align:center;background:#CCCCCC'><span style=
12938 'font-size:10.0pt'>P:</span> <span class=
12939 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
12940 <p class="TextFontCX"><span class="Flag"><span style=
12941 'font-size:10.0pt'>mod-observer</span></span></p>
12942 <p class="IndentText">Possible modification of observer
12945 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12946 height="14" align="left">
12948 <td valign="top" align="left" height="14" style=
12949 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12950 <p class="TextFontCX" align="center" style=
12951 'text-align:center;background:#CCCCCC'><span style=
12952 'font-size:10.0pt'>m:</span><span class=
12953 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
12954 <p class="TextFontCX"><span class="Flag"><span style=
12955 'font-size:10.0pt'>mod-observer-uncon</span></span></p>
12956 <p class="IndentText">Storage declared with observer may be
12957 modified through a call to an unconstrained function.</p>
12958 <p class="Heading11">String Literals <span class=
12959 "TextFontCXChar"><span style=
12960 'font-weight: normal;font-style:normal'>(Section
12961 6.2.1)</span></span></p>
12963 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12964 height="14" align="left">
12966 <td valign="top" align="left" height="14" style=
12967 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12968 <p class="TextFontCX" align="center" style=
12969 'text-align:center;background:#CCCCCC'><span style=
12970 'font-size:10.0pt'>m:</span><span class=
12971 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
12972 <p class="TextFontCX"><span class="Flag"><span style=
12973 'font-size:10.0pt'>read-only-trans</span></span></p>
12974 <p class="IndentText">Report memory transfer errors for
12975 initializations to read-only string literals</p>
12977 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
12978 height="14" align="left">
12980 <td valign="top" align="left" height="14" style=
12981 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
12982 <p class="TextFontCX" align="center" style=
12983 'text-align:center;background:#CCCCCC'><span style=
12984 'font-size:10.0pt'>m:</span><span class=
12985 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
12986 <p class="TextFontCX"><span class="Flag"><span style=
12987 'font-size:10.0pt'>read-only-strings</span></span></p>
12988 <p class="IndentText">String literals are read-only (ISO
12989 semantics). An error is reported if a string literal may be
12990 modified or released.</p>
12991 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
12992 Function Interfaces <span class="TextFontCXChar"><span style=
12993 'font-size:11.0pt;font-weight:normal'>(Section</span></span>
12994 <span class="TextFontCXChar"><span style=
12995 'font-size:11.0pt; font-weight:normal'>7</span></span><span class="TextFontCXChar">
12997 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
12998 <p class="Heading10">Modification <span class=
12999 "TextFontCXChar"><span style=
13000 'font-size:11.0pt; font-weight:normal'>(Section
13001 7.1)</span></span></p>
13003 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13004 height="14" align="left">
13006 <td valign="top" align="left" height="14" style=
13007 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13008 <p class="TextFontCX" align="center" style=
13009 'text-align:center;background:#CCCCCC'><span style=
13010 'font-size:10.0pt'>P:</span> <span class=
13011 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
13012 <p class="TextFontCX"><span class="Flag"><span style=
13013 'font-size:10.0pt'>modifies</span></span></p>
13014 <p class="IndentText">Undocumented modification of caller-visible
13015 state. Without <span class="Flag"><span style=
13016 'font-size:10.0pt'>+moduncon</span></span>, modification errors are
13017 only reported in the definitions of functions declared with a
13018 modifies clause (or specified).</p>
13020 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13021 height="14" align="left">
13023 <td valign="top" align="left" height="14" style=
13024 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13025 <p class="TextFontCX" align="center" style=
13026 'text-align:center;background:#CCCCCC'><span style=
13027 'font-size:10.0pt'>m:</span><span class=
13028 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
13029 <p class="TextFontCX"><span class="Flag"><span style=
13030 'font-size:10.0pt'>must-mod</span></span></p>
13031 <p class="IndentText">Documented modification is not
13032 detected. An object listed in the modifies clause for a
13033 function, is not modified by the implementation.</p>
13035 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13036 height="14" align="left">
13038 <td valign="top" align="left" height="14" style=
13039 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13040 <p class="TextFontCX" align="center" style=
13041 'text-align:center;background:#CCCCCC'><span style=
13042 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
13043 <p class="TextFontCX"><span class="Flag"><span style=
13044 'font-size:10.0pt'>mod-uncon</span></span></p>
13045 <p class="IndentText">Report modification errors in functions
13046 declared without a modifies clause.(Sets <span class=
13047 "Flag"><span style='font-size:10.0pt'>mod-nomods</span></span>,
13048 <span class="Flag"><span style=
13049 'font-size:10.0pt'>mod-globs-nomods</span></span> and
13050 <span class="Flag"><span style=
13051 'font-size:10.0pt'>mod-strict-globs-nomods</span></span>.)</p>
13053 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13054 height="14" align="left">
13056 <td valign="top" align="left" height="14" style=
13057 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13058 <p class="TextFontCX" align="center" style=
13059 'text-align:center;background:#CCCCCC'><span style=
13060 'font-size:10.0pt'>m:</span><span class=
13061 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13062 <p class="TextFontCX"><span class="Flag"><span style=
13063 'font-size:10.0pt'>mod-nomods</span></span></p>
13064 <p class="IndentText">Report modification errors (not involving
13065 global variables) in functions declared without a modifies
13068 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13069 height="14" align="left">
13071 <td valign="top" align="left" height="14" style=
13072 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13073 <p class="TextFontCX" align="center" style=
13074 'text-align:center;background:#CCCCCC'><span style=
13075 'font-size:10.0pt'>m:</span><span class=
13076 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13077 <p class="TextFontCX"><span class="Flag"><span style=
13078 'font-size:10.0pt'>mod-uncon-nomods</span></span></p>
13079 <p class="IndentText">An unconstrained function is called in a
13080 function body where modifications are checked. Since the
13081 unconstrained function may modify anything, there may be undetected
13082 modifications in the checked function.</p>
13084 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13085 height="14" align="left">
13087 <td valign="top" align="left" height="14" style=
13088 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13089 <p class="TextFontCX" align="center" style=
13090 'text-align:center;background:#CCCCCC'><span style=
13091 'font-size:10.0pt'>m:</span><span class=
13092 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13093 <p class="TextFontCX"><span class="Flag"><span style=
13094 'font-size:10.0pt'>mod-internal-strict</span></span></p>
13095 <p class="IndentText">A function that modifies <span class=
13096 "Annot"><span style='font-size:10.0pt'>internalState</span></span>
13097 is called from a function that does not list <span class=
13098 "Annot"><span style='font-size:10.0pt'>internalState</span></span>
13099 in its modifies clause.</p>
13101 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13102 height="14" align="left">
13104 <td valign="top" align="left" height="14" style=
13105 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13106 <p class="TextFontCX" align="center" style=
13107 'text-align:center;background:#CCCCCC'><span style=
13108 'font-size:10.0pt'>m:</span><span class=
13109 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13110 <p class="TextFontCX"><span class="Flag"><span style=
13111 'font-size:10.0pt'>mod-file-sys</span></span></p>
13112 <p class="IndentText">A function modifies the file system but does
13113 not list <span class="Annot"><span style=
13114 'font-size:10.0pt'>fileSystem</span></span> in its modifies
13116 <p class="Heading10">Global Variables <span class=
13117 "HeadingNote"><span style=
13118 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
13119 <span class="HeadingNote"><span style=
13120 'font-size:10.5pt;font-weight:normal;font-style: normal'>7.2</span></span><span class="HeadingNote">
13122 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
13123 <p class="beforelist"><a name="globflags"></a>Errors involving the
13124 use and modification of global and file static variables are
13125 reported depending on flag settings, annotations where the global
13126 variable is declared, and whether or not the function where the
13127 global is used was declared with a globals clause.</p>
13129 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13130 height="14" align="left">
13132 <td valign="top" align="left" height="14" style=
13133 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13134 <p class="TextFontCX" align="center" style=
13135 'text-align:center;background:#CCCCCC'><span style=
13136 'font-size:10.0pt'>P:</span> <span class=
13137 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
13138 <p class="TextFontCX"><span class="Flag"><span style=
13139 'font-size:10.0pt'>globs</span></span></p>
13140 <p class="IndentText">Undocumented use of a checked global variable
13141 in a function with a globals list.</p>
13143 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13144 height="14" align="left">
13146 <td valign="top" align="left" height="14" style=
13147 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13148 <p class="TextFontCX" align="center" style=
13149 'text-align:center;background:#CCCCCC'><span style=
13150 'font-size:10.0pt'>m:</span><span class=
13151 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
13152 <p class="TextFontCX"><span class="Flag"><span style=
13153 'font-size:10.0pt'>glob-use</span></span></p>
13154 <p class="IndentText">A global listed in the globals list is not
13155 used in the implementation.</p>
13157 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13158 height="14" align="left">
13160 <td valign="top" align="left" height="14" style=
13161 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13162 <p class="TextFontCX" align="center" style=
13163 'text-align:center;background:#CCCCCC'><span style=
13164 'font-size:10.0pt'>m:</span><span class=
13165 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13166 <p class="TextFontCX"><span class="Flag"><span style=
13167 'font-size:10.0pt'>glob-noglobs</span></span></p>
13168 <p class="IndentText">Use of a checked global in a function with no
13171 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13172 height="14" align="left">
13174 <td valign="top" align="left" height="14" style=
13175 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13176 <p class="TextFontCX" align="center" style=
13177 'text-align:center;background:#CCCCCC'><span style=
13178 'font-size:10.0pt'>m:</span><span class=
13179 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13180 <p class="TextFontCX"><span class="Flag"><span style=
13181 'font-size:10.0pt'>internal-globs</span></span></p>
13182 <p class="IndentText">Undocumented use of internal state (should
13183 have <span class="Annot"><span style='font-size:10.0pt'>globals
13184 internalState</span></span>).</p>
13186 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13187 height="14" align="left">
13189 <td valign="top" align="left" height="14" style=
13190 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13191 <p class="TextFontCX" align="center" style=
13192 'text-align:center;background:#CCCCCC'><span style=
13193 'font-size:10.0pt'>m:</span><span class=
13194 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13195 <p class="TextFontCX"><span class="Flag"><span style=
13196 'font-size:10.0pt'>internal-globs-noglobs</span></span></p>
13197 <p class="TextFontCX">
13198 Use of internal state in function with no globals list.</p>
13200 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13201 height="14" align="left">
13203 <td valign="top" align="left" height="14" style=
13204 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13205 <p class="TextFontCX" align="center" style=
13206 'text-align:center;background:#CCCCCC'><span style=
13207 'font-size:10.0pt'>m:</span><span class=
13208 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13209 <p class="TextFontCX"><span class="Flag"><span style=
13210 'font-size:10.0pt'>glob-state</span></span></p>
13211 <p class="IndentText">A function returns with global in
13212 inconsistent state (null or undefined)</p>
13214 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13215 height="14" align="left">
13217 <td valign="top" align="left" height="14" style=
13218 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13219 <p class="TextFontCX" align="center" style=
13220 'text-align:center;background:#CCCCCC'><span style=
13221 'font-size:10.0pt'>m:</span><span class=
13222 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
13223 <p class="TextFontCX"><span class="Flag"><span style=
13224 'font-size:10.0pt'>all-globs</span></span></p>
13225 <p class="IndentText">Report use and modification errors for
13226 globals not annotated with <span class="Annot"><span style=
13227 'font-size:10.0pt'>unchecked</span></span>.</p>
13229 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13230 height="14" align="left">
13232 <td valign="top" align="left" height="14" style=
13233 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13234 <p class="TextFontCX" align="center" style=
13235 'text-align:center;background:#CCCCCC'><span style=
13236 'font-size:10.0pt'>m:</span><span class=
13237 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
13238 <p class="TextFontCX"><span class="Flag"><span style=
13239 'font-size:10.0pt'>check-strict-globs</span></span></p>
13240 <p class="IndentText">Report use and modification errors for
13241 <span class="Annot"><span style=
13242 'font-size:10.0pt'>checkedstrict</span></span> globals.</p>
13243 <p class="Heading11">Modification of Global Variables</p>
13245 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13246 height="14" align="left">
13248 <td valign="top" align="left" height="14" style=
13249 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13250 <p class="TextFontCX" align="center" style=
13251 'text-align:center;background:#CCCCCC'><span style=
13252 'font-size:10.0pt'>m:</span><span class=
13253 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13254 <p class="TextFontCX"><span class="Flag"><span style=
13255 'font-size:10.0pt'>mod-globs</span></span></p>
13256 <p class="IndentText">Undocumented modification of a checked global
13259 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13260 height="14" align="left">
13262 <td valign="top" align="left" height="14" style=
13263 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13264 <p class="TextFontCX" align="center" style=
13265 'text-align:center;background:#CCCCCC'><span style=
13266 'font-size:10.0pt'>m:</span><span class=
13267 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13268 <p class="TextFontCX"><span class="Flag"><span style=
13269 'font-size:10.0pt'>mod-globs-unchecked</span></span></p>
13270 <p class="IndentText">Undocumented modification of an
13271 <span class="Annot"><span style=
13272 'font-size:10.0pt'>unchecked</span></span>
13273 global variable.</p>
13275 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13276 height="14" align="left">
13278 <td valign="top" align="left" height="14" style=
13279 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13280 <p class="TextFontCX" align="center" style=
13281 'text-align:center;background:#CCCCCC'><span style=
13282 'font-size:10.0pt'>m:</span><span class=
13283 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13284 <p class="TextFontCX"><span class="Flag"><span style=
13285 'font-size:10.0pt'>mod-globs-nomods</span></span></p>
13286 <p class="IndentText">Undocumented modification of a checked global
13287 variable in a function with no modifies clause.</p>
13289 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13290 height="14" align="left">
13292 <td valign="top" align="left" height="14" style=
13293 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13294 <p class="TextFontCX" align="center" style=
13295 'text-align:center;background:#CCCCCC'><span style=
13296 'font-size:10.0pt'>m:</span><span class=
13297 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13298 <p class="TextFontCX"><span class="Flag"><span style=
13299 'font-size:10.0pt'>mod-strict-globs-nomods</span></span></p>
13300 <p class="IndentText">Undocumented modification of a
13301 <span class="Annot"><span style=
13302 'font-size:10.0pt'>checkedstrict</span></span>
13303 global variable in a function declared with no modifies
13305 <p class="Heading11">Globals Lists and Modifies Clauses</p>
13307 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13308 height="14" align="left">
13310 <td valign="top" align="left" height="14" style=
13311 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13312 <p class="TextFontCX" align="center" style=
13313 'text-align:center;background:#CCCCCC'><span style=
13314 'font-size:10.0pt'>m:</span><span class=
13315 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13316 <p class="TextFontCX"><span class="Flag"><span style=
13317 'font-size:10.0pt'>warn-missing-globs</span></span></p>
13318 <p class="IndentText">Global variable used in modifies clause is
13319 not listed in globals list. (The global is added to the
13322 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13323 height="14" align="left">
13325 <td valign="top" align="left" height="14" style=
13326 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13327 <p class="TextFontCX" align="center" style=
13328 'text-align:center;background:#CCCCCC'><span style=
13329 'font-size:10.0pt'>m:</span><span class=
13330 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13331 <p class="TextFontCX"><span class="Flag"><span style=
13332 'font-size:10.0pt'>warn-missing-globs-noglobs</span></span></p>
13333 <p class="IndentText">Global variable used in modifies clause of a
13334 function with no globals list.</p>
13336 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13337 height="14" align="left">
13339 <td valign="top" align="left" height="14" style=
13340 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13341 <p class="TextFontCX" align="center" style=
13342 'text-align:center;background:#CCCCCC'><span style=
13343 'font-size:10.0pt'>m:</span><span class=
13344 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
13345 <p class="TextFontCX"><span class="Flag"><span style=
13346 'font-size:10.0pt'>globs-imp-mods-nothing</span></span></p>
13347 <p class="IndentText">A function declared with a globals list but
13348 no modifies clause is assumed to modify nothing.</p>
13350 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13351 height="14" align="left">
13353 <td valign="top" align="left" height="14" style=
13354 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13355 <p class="TextFontCX" align="center" style=
13356 'text-align:center;background:#CCCCCC'><span style=
13357 'font-size:10.0pt'>m:</span><span class=
13358 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
13359 <p class="TextFontCX"><span class="Flag"><span style=
13360 'font-size:10.0pt'>mods-imp-noglobs</span></span></p>
13361 <p class="IndentText">A function declared with a modifies clause
13362 but no globals list is assumed to use no globals.</p>
13363 <p class="Heading11">Implicit Checking Annotations</p>
13365 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13366 height="14" align="left">
13368 <td valign="top" align="left" height="14" style=
13369 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13370 <p class="TextFontCX" align="center" style=
13371 'text-align:center;background:#CCCCCC'><span style=
13372 'font-size:10.0pt'>m:</span><span class=
13373 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
13374 <p class="TextFontCX"><span class="Flag"><span style=
13375 'font-size:10.0pt'>imp-checked-globs</span></span></p>
13376 <p class="IndentText">Implicit <span class=
13377 "Annot"><span style='font-size:10.0pt'>checked</span></span> annotation
13378 on global variables with no checking annotation.</p>
13380 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13381 height="14" align="left">
13383 <td valign="top" align="left" height="14" style=
13384 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13385 <p class="TextFontCX" align="center" style=
13386 'text-align:center;background:#CCCCCC'><span style=
13387 'font-size:10.0pt'>m:</span><span class=
13388 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
13389 <p class="TextFontCX"><span class="Flag"><span style=
13390 'font-size:10.0pt'>imp-checked-statics</span></span></p>
13391 <p class="IndentText">Implicit <span class=
13392 "Annot"><span style='font-size:10.0pt'>checked</span></span> qualifier
13393 file static scope variables with no checking annotation.</p>
13395 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13396 height="14" align="left">
13398 <td valign="top" align="left" height="14" style=
13399 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13400 <p class="TextFontCX" align="center" style=
13401 'text-align:center;background:#CCCCCC'><span style=
13402 'font-size:10.0pt'>m:</span><span class=
13403 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
13404 <p class="TextFontCX"><span class="Flag"><span style=
13405 'font-size:10.0pt'>imp-checkmod-globs</span></span></p>
13406 <p class="IndentText">Implicit <span class=
13407 "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
13408 qualifier on global variables with no checking
13410 <p class="IndentText"><span class="Flag"><span style=
13411 'font-size:10.0pt'> </span></span></p>
13413 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13414 height="14" align="left">
13416 <td valign="top" align="left" height="14" style=
13417 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13418 <p class="TextFontCX" align="center" style=
13419 'text-align:center;background:#CCCCCC'><span style=
13420 'font-size:10.0pt'>m:</span><span class=
13421 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
13422 <p class="TextFontCX"><span class="Flag"><span style=
13423 'font-size:10.0pt'>imp-checkmod-statics</span></span></p>
13424 <p class="IndentText">Implicit <span class=
13425 "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
13426 qualifier file static scope variables with no checking
13429 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13430 height="14" align="left">
13432 <td valign="top" align="left" height="14" style=
13433 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13434 <p class="TextFontCX" align="center" style=
13435 'text-align:center;background:#CCCCCC'><span style=
13436 'font-size:10.0pt'>m:</span><span class=
13437 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13438 <p class="TextFontCX"><span class="Flag"><span style=
13439 'font-size:10.0pt'>imp-checkedstrict-globs</span></span></p>
13440 <p class="IndentText">Implicit <span class=
13441 "Annot"><span style='font-size:10.0pt'>checked</span></span>
13442 qualifier on global variables with no checking
13445 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13446 height="14" align="left">
13448 <td valign="top" align="left" height="14" style=
13449 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13450 <p class="TextFontCX" align="center" style=
13451 'text-align:center;background:#CCCCCC'><span style=
13452 'font-size:10.0pt'>m:</span><span class=
13453 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13454 <p class="TextFontCX"><span class="Flag"><span style=
13455 'font-size:10.0pt'>imp-checkedstrict-statics</span></span></p>
13456 <p class="IndentText">Implicit <span class=
13457 "Annot"><span style='font-size:10.0pt'>checked</span></span>
13458 qualifier file static scope variables with no checking
13461 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13462 height="14" align="left">
13464 <td valign="top" align="left" height="14" style=
13465 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13466 <p class="TextFontCX" align="center" style=
13467 'text-align:center;background:#CCCCCC'><span style=
13468 'font-size:10.0pt'>m:</span><span class=
13469 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
13470 <p class="TextFontCX"><span class="Flag"><span style=
13471 'font-size:10.0pt'>imp-checkmod-internals</span></span></p>
13472 <p class="IndentText">Implicit <span class=
13473 "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
13474 qualifier on function scope static variables with no checking
13477 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13478 height="14" align="left">
13480 <td valign="top" align="left" height="14" style=
13481 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13482 <p class="TextFontCX" align="center" style=
13483 'text-align:center;background:#CCCCCC'><span style=
13484 'font-size:10.0pt'>m:</span><span class=
13485 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13486 <p class="IndentText" style='margin-left:0in'><span class=
13487 "Keyword"><span style='font-size:10.0pt'> </span></span></p>
13488 <p class="Heading11">Global Aliasing</p>
13490 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13491 height="14" align="left">
13493 <td valign="top" align="left" height="14" style=
13494 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13495 <p class="TextFontCX" align="center" style=
13496 'text-align:center;background:#CCCCCC'><span style=
13497 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
13498 <p class="TextFontCX"><span class="Flag"><span style=
13499 'font-size:10.0pt'>glob-alias</span></span></p>
13500 <p class="IndentText">Function returns with global aliasing
13501 external state (sets <span class="Flag"><span style=
13502 'font-size:10.0pt'>checkstrict-glob-alias</span></span>,
13503 <span class="Flag"><span style=
13504 'font-size:10.0pt'>checked-glob-alias</span></span>,
13505 c<span class="Flag"><span style=
13506 'font-size:10.0pt'>heckmod-glob-alias</span></span> and
13507 <span class="Flag"><span style=
13508 'font-size:10.0pt'>unchecked-glob-alias</span></span>).</p>
13510 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13511 height="14" align="left">
13513 <td valign="top" align="left" height="14" style=
13514 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13515 <p class="TextFontCX" align="center" style=
13516 'text-align:center;background:#CCCCCC'><span style=
13517 'font-size:10.0pt'>m:</span><span class=
13518 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13519 <p class="TextFontCX"><span class="Flag"><span style=
13520 'font-size:10.0pt'>checkstrict-glob-alias</span></span></p>
13521 <p class="IndentText">Function returns with a <span class=
13522 "Annot"><span style='font-size:10.0pt'>checkedstrict</span></span>
13523 global aliasing external state.</p>
13525 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13526 height="14" align="left">
13528 <td valign="top" align="left" height="14" style=
13529 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13530 <p class="TextFontCX" align="center" style=
13531 'text-align:center;background:#CCCCCC'><span style=
13532 'font-size:10.0pt'>m:</span><span class=
13533 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13534 <p class="TextFontCX"><span class="Flag"><span style=
13535 'font-size:10.0pt'>checked-glob-alias</span></span></p>
13536 <p class="IndentText">Function returns with a <span class=
13537 "Annot"><span style='font-size:10.0pt'>checked</span></span>
13538 global aliasing external state.</p>
13540 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13541 height="14" align="left">
13543 <td valign="top" align="left" height="14" style=
13544 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13545 <p class="TextFontCX" align="center" style=
13546 'text-align:center;background:#CCCCCC'><span style=
13547 'font-size:10.0pt'>m:</span><span class=
13548 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13549 <p class="TextFontCX"><span class="Flag"><span style=
13550 'font-size:10.0pt'>checkmod-glob-alias</span></span></p>
13551 <p class="IndentText">Function returns with a <span class=
13552 "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
13553 global aliasing external state.</p>
13555 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13556 height="14" align="left">
13558 <td valign="top" align="left" height="14" style=
13559 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13560 <p class="TextFontCX" align="center" style=
13561 'text-align:center;background:#CCCCCC'><span style=
13562 'font-size:10.0pt'>m:</span><span class=
13563 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
13564 <p class="TextFontCX"><span class="Flag"><span style=
13565 'font-size:10.0pt'>unchecked-glob-alias</span></span></p>
13566 <p class="IndentText">Function returns with an <span class=
13567 "Annot"><span style='font-size:10.0pt'>unchecked</span></span>
13568 global aliasing external state.</p>
13569 <p class="Heading10">Declaration Consistency <span style=
13570 'font-weight:normal'>(Section 7.3)</span></p>
13572 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13573 height="14" align="left">
13575 <td valign="top" align="left" height="14" style=
13576 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13577 <p class="TextFontCX" align="center" style=
13578 'text-align:center;background:#CCCCCC'><span style=
13579 'font-size:10.0pt'>m:</span><span class=
13580 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13581 <p class="TextFontCX"><span class="Flag"><span style=
13582 'font-size:10.0pt'>incon-defs</span></span></p>
13583 <p class="IndentText">Identifier redeclared or redefined with
13584 inconsistent type.</p>
13586 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13587 height="14" align="left">
13589 <td valign="top" align="left" height="14" style=
13590 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13591 <p class="TextFontCX" align="center" style=
13592 'text-align:center;background:#CCCCCC'><span style=
13593 'font-size:10.0pt'>m:</span><span class=
13594 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13595 <p class="TextFontCX"><span class="Flag"><span style=
13596 'font-size:10.0pt'>incon-defs-lib</span></span></p>
13597 <p class="IndentText">Identifier defined in a library is redefined
13598 with inconsistent type.</p>
13600 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13601 height="14" align="left">
13603 <td valign="top" align="left" height="14" style=
13604 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13605 <p class="TextFontCX" align="center" style=
13606 'text-align:center;background:#CCCCCC'><span style=
13607 'font-size:10.0pt'>m:</span><span class=
13608 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
13609 <p class="TextFontCX"><span class="Flag"><span style=
13610 'font-size:10.0pt'>overload</span></span></p>
13611 <p class="IndentText">Standard library function overloaded.</p>
13613 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13614 height="14" align="left">
13616 <td valign="top" align="left" height="14" style=
13617 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13618 <p class="TextFontCX" align="center" style=
13619 'text-align:center;background:#CCCCCC'><span style=
13620 'font-size:10.0pt'>m:</span><span class=
13621 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13622 <p class="TextFontCX"><span class="Flag"><span style=
13623 'font-size:10.0pt'>match-fields</span></span></p>
13624 <p class="IndentText">A <span class="CodeText"><span style=
13625 'font-size:10.0pt'>struct</span></span> or <span class=
13626 "CodeText"><span style='font-size:10.0pt'>enum</span></span> type
13627 is redefined with inconsistent fields or members.</p>
13628 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
13629 <a name="_Toc534975057">Macros</a> <span class=
13630 "TextFontCXChar"><span style=
13631 'font-size:11.0pt; font-weight:normal'>(Section</span></span>
13632 <span class="TextFontCXChar"><span style=
13633 'font-size:11.0pt; font-weight:normal'>11</span></span><span class="TextFontCXChar">
13635 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
13636 <p class="TextFontCX">These flags control expansion and checking of
13637 macro definitions and invocations.</p>
13638 <p class="Heading10">Macro Expansion</p>
13639 <p class="beforelist">These flags control which macros are checked
13640 as functions or constants, and which are expanded in the
13641 pre-processing phase. Macros preceded by <span class=
13642 "Annot"><span style=
13643 'font-size:10.0pt'>/*@notfunction@*/</span></span> are never
13644 expanded regardless of these flag settings. These flags may
13645 be used in source-file control comments.</p>
13647 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13648 height="14" align="left">
13650 <td valign="top" align="left" height="14" style=
13651 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13652 <p class="TextFontCX" align="center" style=
13653 'text-align:center;background:#CCCCCC'><span style=
13654 'font-size:10.0pt'>P:</span> <span class=
13655 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
13656 <p class="TextFontCX"><span class="Flag"><span style=
13657 'font-size:10.0pt'>fcn-macros</span></span></p>
13658 <p class="IndentText">Macros defined with parameter lists are not
13659 expanded and are checked as functions.</p>
13661 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13662 height="14" align="left">
13664 <td valign="top" align="left" height="14" style=
13665 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13666 <p class="TextFontCX" align="center" style=
13667 'text-align:center;background:#CCCCCC'><span style=
13668 'font-size:10.0pt'>P:</span> <span class=
13669 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
13670 <p class="TextFontCX"><span class="Flag"><span style=
13671 'font-size:10.0pt'>const-macros</span></span></p>
13672 <p class="IndentText">Macros defined without parameter lists are
13673 not expanded and are checked as constants.</p>
13675 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13676 height="14" align="left">
13678 <td valign="top" align="left" height="14" style=
13679 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13680 <p class="TextFontCX" align="center" style=
13681 'text-align:center;background:#CCCCCC'><span style=
13682 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
13683 <p class="TextFontCX"><span class="Flag"><span style=
13684 'font-size:10.0pt'>all-macros</span></span></p>
13685 <p class="IndentText">Sets <span class="Flag"><span style=
13686 'font-size:10.0pt'>fcn-macros</span></span> and <span class=
13687 "Flag"><span style=
13688 'font-size:10.0pt'>const-macros</span></span>.</p>
13690 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13691 height="14" align="left">
13693 <td valign="top" align="left" height="14" style=
13694 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13695 <p class="TextFontCX" align="center" style=
13696 'text-align:center;background:#CCCCCC'><span style=
13697 'font-size:10.0pt'>P:</span> <span class=
13698 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
13699 <p class="TextFontCX"><span class="Flag"><span style=
13700 'font-size:10.0pt'>lib-macros</span></span></p>
13701 <p class="IndentText">Macros defining identifiers declared in a
13702 loaded library are not expanded and are checked according to the
13703 library information.<span class="Flag"><span style=
13704 'font-size:10.0pt'> </span></span></p>
13705 <p class="Heading10">Macro Definitions</p>
13706 <p class="beforelist">These flags control what errors are reported
13707 in macro definitions.</p>
13709 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13710 height="14" align="left">
13712 <td valign="top" align="left" height="14" style=
13713 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13714 <p class="TextFontCX" align="center" style=
13715 'text-align:center;background:#CCCCCC'><span style=
13716 'font-size:10.0pt'>m:</span><span class=
13717 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13718 <p class="TextFontCX"><span class="Flag"><span style=
13719 'font-size:10.0pt'>macro-stmt</span></span></p>
13720 <p class="IndentText">Macro definition is not syntactically
13721 equivalent to function. This means if the macro is used as a
13722 statement (e.g., <span class="CodeText"><span style=
13723 'font-size:10.0pt'>if (test) macro();</span></span>) unexpected
13724 behavior may result. One fix is to surround the macro body
13725 with <span class="CodeText"><span style='font-size:10.0pt'>do {
13726 … } while (FALSE)</span></span>.</p>
13728 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13729 height="14" align="left">
13731 <td valign="top" align="left" height="14" style=
13732 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13733 <p class="TextFontCX" align="center" style=
13734 'text-align:center;background:#CCCCCC'><span style=
13735 'font-size:10.0pt'>m:</span><span class=
13736 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13737 <p class="TextFontCX"><span class="Flag"><span style=
13738 'font-size:10.0pt'>macro-return</span></span></p>
13739 <p class="IndentText">
13740 The body of a macro declared as a function uses a
13741 <span class="CodeText"><span style='font-size:10.0pt'>return</span></span>
13742 statement. This exhibits behavior that could not be implemented by a function.
13745 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13746 height="14" align="left">
13748 <td valign="top" align="left" height="14" style=
13749 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13750 <p class="TextFontCX" align="center" style=
13751 'text-align:center;background:#CCCCCC'><span style=
13752 'font-size:10.0pt'>m:</span><span class=
13753 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13754 <p class="TextFontCX"><span class="Flag"><span style=
13755 'font-size:10.0pt'>macro-assign</span></span></p>
13756 <p class="IndentText">A macro parameter is used as the left side of
13757 an assignment expression.</p>
13759 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13760 height="14" align="left">
13762 <td valign="top" align="left" height="14" style=
13763 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13764 <p class="TextFontCX" align="center" style=
13765 'text-align:center;background:#CCCCCC'><span style=
13766 'font-size:10.0pt'>m:</span><span class=
13767 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13768 <p class="TextFontCX"><span class="Flag"><span style=
13769 'font-size:10.0pt'>macro-parens</span></span></p>
13770 <p class="IndentText">A macro parameter is used without parentheses
13771 (in potentially dangerous context).</p>
13773 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13774 height="14" align="left">
13776 <td valign="top" align="left" height="14" style=
13777 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13778 <p class="TextFontCX" align="center" style=
13779 'text-align:center;background:#CCCCCC'><span style=
13780 'font-size:10.0pt'>m:</span><span class=
13781 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
13782 <p class="TextFontCX"><span class="Flag"><span style=
13783 'font-size:10.0pt'>macro-empty</span></span></p>
13784 <p class="IndentText">Macro definition of a function is
13785 empty. </p>
13787 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13788 height="14" align="left">
13790 <td valign="top" align="left" height="14" style=
13791 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13792 <p class="TextFontCX" align="center" style=
13793 'text-align:center;background:#CCCCCC'><span style=
13794 'font-size:10.0pt'>m:</span><span class=
13795 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13796 <p class="TextFontCX"><span class="Flag"><span style=
13797 'font-size:10.0pt'>macro-redef</span></span></p>
13798 <p class="IndentText">Macro is redefined. There is another
13799 macro defined with the same name.</p>
13801 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13802 height="14" align="left">
13804 <td valign="top" align="left" height="14" style=
13805 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13806 <p class="TextFontCX" align="center" style=
13807 'text-align:center;background:#CCCCCC'><span style=
13808 'font-size:10.0pt'>m:</span><span class=
13809 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13810 <p class="TextFontCX"><span class="Flag"><span style=
13811 'font-size:10.0pt'>macro-unrecog</span></span> </p>
13812 <p class="IndentText">An unrecognized identifier appears in a macro
13813 definition. Since the identifier may be defined where the
13814 macro is used, this could be okay, but Splint will not be able to
13815 check the unrecognized identifier appropriately.</p>
13816 <p class="Heading11">Corresponding Declarations</p>
13818 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13819 height="14" align="left">
13821 <td valign="top" align="left" height="14" style=
13822 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13823 <p class="TextFontCX" align="center" style=
13824 'text-align:center;background:#CCCCCC'><span style=
13825 'font-size:10.0pt'>m:</span><span class=
13826 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
13827 <p class="TextFontCX"><span class="Flag"><span style=
13828 'font-size:10.0pt'>macro-match-name</span></span></p>
13829 <p class="IndentText">An <span class="Annot"><span style=
13830 'font-size:10.0pt'>iter</span></span> or <span class=
13831 "Annot"><span style=
13832 'font-size:10.0pt'>constant</span></span> macro is defined
13833 using a different name from the one used in the previous syntactic
13836 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13837 height="14" align="left">
13839 <td valign="top" align="left" height="14" style=
13840 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13841 <p class="TextFontCX" align="center" style=
13842 'text-align:center;background:#CCCCCC'><span style=
13843 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
13844 <p class="TextFontCX"><span class="Flag"><span style=
13845 'font-size:10.0pt'>macro-decl</span></span></p>
13846 <p class="IndentText">A macro definition has no corresponding
13847 declaration. (Sets <span class="Flag"><span style=
13848 'font-size:10.0pt'>macrofcndecl</span></span> and
13849 <span class="Flag"><span style=
13850 'font-size:10.0pt'>macroconstdecl</span></span>.)</p>
13852 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13853 height="14" align="left">
13855 <td valign="top" align="left" height="14" style=
13856 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13857 <p class="TextFontCX" align="center" style=
13858 'text-align:center;background:#CCCCCC'><span style=
13859 'font-size:10.0pt'>m:</span><span class=
13860 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13861 <p class="TextFontCX"><span class="Flag"><span style=
13862 'font-size:10.0pt'>macro-fcn-decl</span></span></p>
13863 <p class="IndentText">Macro definition with parameter list has no
13864 corresponding function prototype. Without a prototype, the types of
13865 the macro result and parameters are unknown.</p>
13867 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13868 height="14" align="left">
13870 <td valign="top" align="left" height="14" style=
13871 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13872 <p class="TextFontCX" align="center" style=
13873 'text-align:center;background:#CCCCCC'><span style=
13874 'font-size:10.0pt'>m:</span><span class=
13875 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13876 <p class="TextFontCX"><span class="Flag"><span style=
13877 'font-size:10.0pt'>macro-const-decl</span></span></p>
13878 <p class="IndentText">A macro definition without parameter list has
13879 no corresponding constant declaration.<span class=
13880 "Flag"><span style=
13881 'font-size: 10.0pt'> </span></span></p>
13883 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13884 height="14" align="left">
13886 <td valign="top" align="left" height="14" style=
13887 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13888 <p class="TextFontCX" align="center" style=
13889 'text-align:center;background:#CCCCCC'><span style=
13890 'font-size:10.0pt'>P:</span> <span class=
13891 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
13892 <p class="TextFontCX"><span class="Flag"><span style=
13893 'font-size:10.0pt'>next-line-macros</span></span></p>
13894 <p class="IndentText">A constant or iter declaration is not
13895 immediately followed by a macro definition.</p>
13896 <p class="Heading10">Side Effect Free Parameters <span class=
13897 "HeadingNote"><span style=
13898 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
13899 <span class="HeadingNote"><span style=
13900 'font-size:10.5pt;font-weight:normal;font-style: normal'>11.2.1</span></span><span class="HeadingNote">
13902 'font-size: 10.5pt;font-weight:normal;font-style:normal'>)</span></span></p>
13903 <p class="beforelist">These flags control error reporting for
13904 parameters with inconsistent side effects in invocations of checked
13905 function macros and function calls.</p>
13907 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13908 height="14" align="left">
13910 <td valign="top" align="left" height="14" style=
13911 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13912 <p class="TextFontCX" align="center" style=
13913 'text-align:center;background:#CCCCCC'><span style=
13914 'font-size:10.0pt'>m:</span><span class=
13915 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
13916 <p class="TextFontCX"><span class="Flag"><span style=
13917 'font-size:10.0pt'>sef-params</span></span></p>
13918 <p class="IndentText">An actual parameter with side effects is
13919 passed as a formal parameter declared with <span class=
13920 "Annot"><span style='font-size:10.0pt'>sef</span></span>.</p>
13922 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13923 height="14" align="left">
13925 <td valign="top" align="left" height="14" style=
13926 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13927 <p class="TextFontCX" align="center" style=
13928 'text-align:center;background:#CCCCCC'><span style=
13929 'font-size:10.0pt'>m:</span><span class=
13930 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
13931 <p class="TextFontCX"><span class="Flag"><span style=
13932 'font-size:10.0pt'>sef-uncon</span></span></p>
13933 <p class="IndentText">An actual parameter involving a call to an
13934 unconstrained function (declared without modifies clause) that may
13935 modify anything is passed as a <span class=
13936 "Annot"><span style='font-size:10.0pt'>sef</span></span>
13938 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
13939 <a name="_Toc534975058">Iterators</a></p>
13941 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13942 height="14" align="left">
13944 <td valign="top" align="left" height="14" style=
13945 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13946 <p class="TextFontCX" align="center" style=
13947 'text-align:center;background:#CCCCCC'><span style=
13948 'font-size:10.0pt'>P:</span> <span class=
13949 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
13950 <p class="TextFontCX"><span class="Flag"><span style=
13951 'font-size:10.0pt'>iterbalance</span></span></p>
13952 <p class="IndentText">Iter is not balanced with end
13953 <span class="CodeText"><span style='font-size:10.0pt'> <iter></span></span>.
13957 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13958 height="14" align="left">
13960 <td valign="top" align="left" height="14" style=
13961 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13962 <p class="TextFontCX" align="center" style=
13963 'text-align:center;background:#CCCCCC'><span style=
13964 'font-size:10.0pt'>P:</span> <span class=
13965 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
13966 <p class="TextFontCX"><span class="Flag"><span style=
13967 'font-size:10.0pt'>iteryield</span></span></p>
13968 <p class="IndentText">Iter yield parameter is inappropriate.
13972 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13973 height="14" align="left">
13975 <td valign="top" align="left" height="14" style=
13976 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13977 <p class="TextFontCX" align="center" style=
13978 'text-align:center;background:#CCCCCC'><span style=
13979 'font-size:10.0pt'>P:</span> <span class=
13980 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
13981 <p class="TextFontCX"><span class="Flag"><span style=
13982 'font-size:10.0pt'>has-yield</span></span></p>
13983 <p class="IndentText">An iterator has been declared with no
13984 parameters annotated with <span class="Annot"><span style=
13985 'font-size:10.0pt'>yield</span></span>.</p>
13987 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
13988 <a name="_Toc534975059">Naming Conventions</a> <span class=
13989 "TextFontCXChar"><span style=
13990 'font-size:11.0pt; font-weight:normal'>(Section
13991 12)</span></span></p>
13993 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
13994 height="14" align="left">
13996 <td valign="top" align="left" height="14" style=
13997 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
13998 <p class="TextFontCX" align="center" style=
13999 'text-align:center;background:#CCCCCC'><span style=
14000 'font-size:10.0pt'>P:</span> <span class=
14001 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
14002 <p class="TextFontCX"><span class="Flag"><span style=
14003 'font-size:10.0pt'>name-checks</span></span></p>
14004 <p class="IndentText">Turns all name checking on or off without
14005 changing other settings.</p>
14006 <p class="Heading10">Type-Based Naming Conventions
14007 <span style='font-size:10.5pt; font-weight:normal'>(Section
14009 <p class="Heading11">Czech Naming Convention</p>
14011 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14012 height="14" align="left">
14014 <td valign="top" align="left" height="14" style=
14015 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14016 <p class="TextFontCX" align="center" style=
14017 'text-align:center;background:#CCCCCC'><span style=
14018 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
14019 <p class="TextFontCX"><span class="Flag"><span style=
14020 'font-size:10.0pt'>czech</span></span></p>
14021 <p class="IndentText">Selects complete Czech naming convention
14022 (sets <span class="Flag"><span style=
14023 'font-size:10.0pt'>access-czech</span></span>, <span class=
14024 "Flag"><span style='font-size:10.0pt'>czech-fcns</span></span>,
14025 <span class="Flag"><span style=
14026 'font-size:10.0pt'>czech-vars</span></span>, <span class=
14027 "Flag"><span style='font-size:10.0pt'>czech-consts</span></span>,
14028 <span class="Flag"><span style=
14029 'font-size:10.0pt'>czech-macros</span></span>, and
14030 <span class="Flag"><span style=
14031 'font-size:10.0pt'>czech-types</span></span>).</p>
14033 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14034 height="14" align="left">
14036 <td valign="top" align="left" height="14" style=
14037 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14038 <p class="TextFontCX" align="center" style=
14039 'text-align:center;background:#CCCCCC'><span style=
14040 'font-size:10.0pt'>P:</span> <span class=
14041 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
14042 <p class="TextFontCX"><span class="Flag"><span style=
14043 'font-size:10.0pt'>access-czech</span></span></p>
14044 <p class="IndentText">Allow access to abstract types following
14045 Czech naming convention. The representation of an abstract
14046 type named <span class="CodeText"><i><span style=
14047 'font-size:10.0pt'>t</span></i></span> is accessible in the
14048 definition of a function or constant named <span class=
14049 "CodeText"><i><span style=
14050 'font-size:10.0pt'>t_name</span></i></span>.</p>
14052 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14053 height="14" align="left">
14055 <td valign="top" align="left" height="14" style=
14056 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14057 <p class="TextFontCX" align="center" style=
14058 'text-align:center;background:#CCCCCC'><span style=
14059 'font-size:10.0pt'>P:</span> <span class=
14060 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14061 <p class="TextFontCX"><span class="Flag"><span style=
14062 'font-size:10.0pt'>czech-fcns</span></span></p>
14063 <p class="IndentText">Function or iterator name is not consistent
14064 with Czech naming convention.</p>
14066 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14067 height="14" align="left">
14069 <td valign="top" align="left" height="14" style=
14070 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14071 <p class="TextFontCX" align="center" style=
14072 'text-align:center;background:#CCCCCC'><span style=
14073 'font-size:10.0pt'>P:</span> <span class=
14074 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14075 <p class="TextFontCX"><span class="Flag"><span style=
14076 'font-size:10.0pt'>czech-vars</span></span></p>
14077 <p class="IndentText"> Variable name is not consistent with
14078 Czech naming convention.</p>
14080 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14081 height="14" align="left">
14083 <td valign="top" align="left" height="14" style=
14084 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14085 <p class="TextFontCX" align="center" style=
14086 'text-align:center;background:#CCCCCC'><span style=
14087 'font-size:10.0pt'>P:</span> <span class=
14088 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14089 <p class="TextFontCX"><span class="Flag"><span style=
14090 'font-size:10.0pt'>czech-macros</span></span></p>
14091 <p class="IndentText"> Expanded macro name is not consistent
14092 with Czech naming convention.</p>
14094 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14095 height="14" align="left">
14097 <td valign="top" align="left" height="14" style=
14098 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14099 <p class="TextFontCX" align="center" style=
14100 'text-align:center;background:#CCCCCC'><span style=
14101 'font-size:10.0pt'>P:</span> <span class=
14102 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14103 <p class="TextFontCX"><span class="Flag"><span style=
14104 'font-size:10.0pt'>czech-consts</span></span></p>
14105 <p class="IndentText">Constant name is not consistent with Czech
14106 naming convention.</p>
14108 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14109 height="14" align="left">
14111 <td valign="top" align="left" height="14" style=
14112 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14113 <p class="TextFontCX" align="center" style=
14114 'text-align:center;background:#CCCCCC'><span style=
14115 'font-size:10.0pt'>P:</span> <span class=
14116 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14117 <p class="TextFontCX"><span class="Flag"><span style=
14118 'font-size:10.0pt'>czech-types</span></span></p>
14119 <p class="IndentText">Type name is not consistent with Czech naming
14120 convention. Czech type names must not use the underscore
14122 <p class="Heading11">Slovak Naming Convention</p>
14124 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14125 height="14" align="left">
14127 <td valign="top" align="left" height="14" style=
14128 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14129 <p class="TextFontCX" align="center" style=
14130 'text-align:center;background:#CCCCCC'><span style=
14131 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
14132 <p class="TextFontCX"><span class="Flag"><span style=
14133 'font-size:10.0pt'>slovak</span></span></p>
14134 <p class="IndentText">Selects complete Slovak naming convention
14135 (sets <span class="Flag"><span style=
14136 'font-size:10.0pt'>access-slovak</span></span>, <span class=
14137 "Flag"><span style='font-size:10.0pt'>slovak-fcns</span></span>,
14138 <span class="Flag"><span style=
14139 'font-size:10.0pt'>slovak-vars</span></span>, <span class=
14140 "Flag"><span style='font-size:10.0pt'>slovak-consts</span></span>,
14141 <span class="Flag"><span style=
14142 'font-size:10.0pt'>slovak-macros</span></span>, and
14143 <span class="Flag"><span style=
14144 'font-size:10.0pt'>slovak-types</span></span>).</p>
14146 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14147 height="14" align="left">
14149 <td valign="top" align="left" height="14" style=
14150 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14151 <p class="TextFontCX" align="center" style=
14152 'text-align:center;background:#CCCCCC'><span style=
14153 'font-size:10.0pt'>P:</span> <span class=
14154 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14155 <p class="TextFontCX"><span class="Flag"><span style=
14156 'font-size:10.0pt'>access-slovak</span></span></p>
14157 <p class="IndentText">Allow access to abstract types following
14158 Slovak naming convention. The representation of an abstract type
14159 named <span class="CodeText"><i><span style=
14160 'font-size:10.0pt'>t</span></i></span> is accessible in the
14161 definition of a function or constant named <span class=
14162 "CodeText"><i><span style=
14163 'font-size:10.0pt'>tName</span></i></span>.</p>
14165 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14166 height="14" align="left">
14168 <td valign="top" align="left" height="14" style=
14169 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14170 <p class="TextFontCX" align="center" style=
14171 'text-align:center;background:#CCCCCC'><span style=
14172 'font-size:10.0pt'>P:</span> <span class=
14173 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14174 <p class="TextFontCX"><span class="Flag"><span style=
14175 'font-size:10.0pt'>slovak-fcns</span></span></p>
14176 <p class="IndentText">Function or iterator name is not consistent
14177 with Slovak naming convention.</p>
14179 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14180 height="14" align="left">
14182 <td valign="top" align="left" height="14" style=
14183 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14184 <p class="TextFontCX" align="center" style=
14185 'text-align:center;background:#CCCCCC'><span style=
14186 'font-size:10.0pt'>P:</span> <span class=
14187 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14188 <p class="TextFontCX"><span class="Flag"><span style=
14189 'font-size:10.0pt'>slovak-macros</span></span></p>
14190 <p class="IndentText">Expanded macro name is not consistent with
14191 Slovak naming convention.</p>
14193 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14194 height="14" align="left">
14196 <td valign="top" align="left" height="14" style=
14197 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14198 <p class="TextFontCX" align="center" style=
14199 'text-align:center;background:#CCCCCC'><span style=
14200 'font-size:10.0pt'>P:</span> <span class=
14201 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14202 <p class="TextFontCX"><span class="Flag"><span style=
14203 'font-size:10.0pt'>slovak-vars</span></span></p>
14204 <p class="IndentText"> Variable name is not consistent with
14205 Slovak naming convention.</p>
14207 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14208 height="14" align="left">
14210 <td valign="top" align="left" height="14" style=
14211 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14212 <p class="TextFontCX" align="center" style=
14213 'text-align:center;background:#CCCCCC'><span style=
14214 'font-size:10.0pt'>P:</span> <span class=
14215 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14216 <p class="TextFontCX"><span class="Flag"><span style=
14217 'font-size:10.0pt'>slovak-consts</span></span></p>
14218 <p class="IndentText"> Constant name is not consistent with
14219 Slovak naming convention.</p>
14221 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14222 height="14" align="left">
14224 <td valign="top" align="left" height="14" style=
14225 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14226 <p class="TextFontCX" align="center" style=
14227 'text-align:center;background:#CCCCCC'><span style=
14228 'font-size:10.0pt'>P:</span> <span class=
14229 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14230 <p class="TextFontCX"><span class="Flag"><span style=
14231 'font-size:10.0pt'>slovak-types</span></span></p>
14232 <p class="IndentText">Type name is not consistent with Slovak
14233 naming convention. Slovak type names may not include
14234 uppercase letters.</p>
14235 <p class="Heading11">Czechoslovak Naming Convention</p>
14237 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14238 height="14" align="left">
14240 <td valign="top" align="left" height="14" style=
14241 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14242 <p class="TextFontCX" align="center" style=
14243 'text-align:center;background:#CCCCCC'><span style=
14244 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
14245 <p class="TextFontCX"><span class="Flag"><span style=
14246 'font-size:10.0pt'>czechoslovak</span></span></p>
14247 <p class="IndentText">Selects complete Czechoslovak naming
14248 convention (sets <span class="Flag"><span style=
14249 'font-size:10.0pt'>access-czechoslovak</span></span>,
14250 <span class="Flag"><span style=
14251 'font-size:10.0pt'>czechoslovak-fcns</span></span>,
14252 <span class="Flag"><span style=
14253 'font-size:10.0pt'>czechoslovak-vars</span></span>,
14254 <span class="Flag"><span style=
14255 'font-size:10.0pt'>czechoslovak-consts</span></span>,
14256 <span class="Flag"><span style=
14257 'font-size:10.0pt'>czechoslovak-macros</span></span>, and
14258 <span class="Flag"><span style=
14259 'font-size:10.0pt'>czechoslovak-types</span></span>).</p>
14261 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14262 height="14" align="left">
14264 <td valign="top" align="left" height="14" style=
14265 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14266 <p class="TextFontCX" align="center" style=
14267 'text-align:center;background:#CCCCCC'><span style=
14268 'font-size:10.0pt'>P:</span> <span class=
14269 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14270 <p class="TextFontCX"><span class="Flag"><span style=
14271 'font-size:10.0pt'>access-czechoslovak</span></span></p>
14272 <p class="IndentText">Allow access to abstract types by
14273 Czechoslovak naming convention. The representation of an abstract
14274 type named <span class="CodeText"><i><span style=
14275 'font-size:10.0pt'>t</span></i></span> is accessible in the
14276 definition of a function or constant named <span class=
14277 "CodeText"><i><span style=
14278 'font-size:10.0pt'>t_name</span></i></span> or <span class=
14279 "CodeText"><i><span style=
14280 'font-size:10.0pt'>tName</span></i></span>.</p>
14282 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14283 height="14" align="left">
14285 <td valign="top" align="left" height="14" style=
14286 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14287 <p class="TextFontCX" align="center" style=
14288 'text-align:center;background:#CCCCCC'><span style=
14289 'font-size:10.0pt'>P:</span> <span class=
14290 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14291 <p class="TextFontCX"><span class="Flag"><span style=
14292 'font-size:10.0pt'>czechoslovak-fcns</span></span></p>
14293 <p class="IndentText"> Function name is not consistent with
14294 Czechoslovak naming convention.</p>
14296 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14297 height="14" align="left">
14299 <td valign="top" align="left" height="14" style=
14300 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14301 <p class="TextFontCX" align="center" style=
14302 'text-align:center;background:#CCCCCC'><span style=
14303 'font-size:10.0pt'>P:</span> <span class=
14304 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14305 <p class="TextFontCX"><span class="Flag"><span style=
14306 'font-size:10.0pt'>czechoslovak-macros</span></span></p>
14307 <p class="IndentText">Expanded macro name is not consistent with
14308 Czechoslovak naming convention.</p>
14310 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14311 height="14" align="left">
14313 <td valign="top" align="left" height="14" style=
14314 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14315 <p class="TextFontCX" align="center" style=
14316 'text-align:center;background:#CCCCCC'><span style=
14317 'font-size:10.0pt'>P:</span> <span class=
14318 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14319 <p class="TextFontCX"><span class="Flag"><span style=
14320 'font-size:10.0pt'>czechoslovak-vars</span></span></p>
14321 <p class="IndentText">Variable name is not consistent with
14322 Czechoslovak naming convention.</p>
14324 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14325 height="14" align="left">
14327 <td valign="top" align="left" height="14" style=
14328 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14329 <p class="TextFontCX" align="center" style=
14330 'text-align:center;background:#CCCCCC'><span style=
14331 'font-size:10.0pt'>P:</span> <span class=
14332 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14333 <p class="TextFontCX"><span class="Flag"><span style=
14334 'font-size:10.0pt'>czechoslovak-consts</span></span></p>
14335 <p class="IndentText">Constant name is not consistent with
14336 Czechoslovak naming convention.</p>
14338 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14339 height="14" align="left">
14341 <td valign="top" align="left" height="14" style=
14342 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14343 <p class="TextFontCX" align="center" style=
14344 'text-align:center;background:#CCCCCC'><span style=
14345 'font-size:10.0pt'>P:</span> <span class=
14346 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14347 <p class="TextFontCX"><span class="Flag"><span style=
14348 'font-size:10.0pt'>czechoslovak-types</span></span></p>
14349 <p class="IndentText">Type name is not consistent with Czechoslovak
14350 naming convention. Czechoslovak type names may not include
14351 uppercase letters or the underscore character.</p>
14352 <p class="Heading10">Namespace Prefixes <span style=
14353 'font-size:10.5pt; font-weight:normal'>(Section 12.2)</span></p>
14354 <p class="TextFontCX"><span class="Flag"><span style=
14355 'font-size:10.0pt'>macro-var-prefix</span></span><span class=
14356 "Flag"><span style='font-size:10.0pt'> <i><prefix
14357 string></i></span></span></p>
14358 <p class="IndentText">Set namespace prefix for variables declared
14359 in a macro body. (Default is <span class=
14360 "CodeText"><span style='font-size:10.0pt'>m_</span></span>.)</p>
14362 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14363 height="14" align="left">
14365 <td valign="top" align="left" height="14" style=
14366 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14367 <p class="TextFontCX" align="center" style=
14368 'text-align:center;background:#CCCCCC'>P: <span class=
14369 "Keyword"><span style=
14370 'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
14371 <p class="TextFontCX"><span class="Flag"><span style=
14372 'font-size:10.0pt'>macro-var-prefix-exclude</span></span></p>
14373 <p class="IndentText">A variable declared outside a macro body
14374 starts with the <span class="Flag"><span style=
14375 'font-size:10.0pt'>macro-var-prefix</span></span>.</p>
14376 <p class="TextFontCX"><span class="Flag"><span style=
14377 'font-size:10.0pt'>tag-prefix</span></span><span class=
14378 "Flag"><span style='font-size:10.0pt'> <i><prefix
14379 string></i></span></span></p>
14380 <p class="IndentText">Set namespace prefix of <span class=
14381 "CodeText"><span style='font-size:10.0pt'>struct</span></span>,
14382 <span class="CodeText"><span style=
14383 'font-size:10.0pt'>union</span></span> or <span class=
14384 "CodeText"><span style='font-size:10.0pt'>enum</span></span> tag
14387 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14388 height="14" align="left">
14390 <td valign="top" align="left" height="14" style=
14391 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14392 <p class="TextFontCX" align="center" style=
14393 'text-align:center;background:#CCCCCC'><span style=
14394 'font-size:10.0pt'>P:</span> <span class=
14395 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14396 <p class="TextFontCX"><span class="Flag"><span style=
14397 'font-size:10.0pt'>tag-prefix-exclude</span></span></p>
14398 <p class="IndentText">An identifier that is not a tag starts with
14399 the <span class="Flag"><span style=
14400 'font-size:10.0pt'>tagprefix</span></span>.</p>
14401 <p class="TextFontCX"><span class="Flag"><span style=
14402 'font-size:10.0pt'>enum-prefix</span></span><span class=
14403 "Flag"><span style='font-size:10.0pt'> <i><prefix
14404 string></i></span></span></p>
14405 <p class="IndentText">Set namespace prefix for <span class=
14406 "CodeText"><span style='font-size:10.0pt'>enum</span></span>
14409 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14410 height="14" align="left">
14412 <td valign="top" align="left" height="14" style=
14413 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14414 <p class="TextFontCX" align="center" style=
14415 'text-align:center;background:#CCCCCC'><span style=
14416 'font-size:10.0pt'>P:</span> <span class=
14417 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14418 <p class="TextFontCX"><span class="Flag"><span style=
14419 'font-size:10.0pt'>enum-prefix-exclude</span></span></p>
14420 <p class="IndentText">An identifier that is not an
14421 <span class="CodeText"><span style=
14422 'font-size:10.0pt'>enum</span></span> member starts with the
14423 <span class="Flag"><span style=
14424 'font-size:10.0pt'>enumprefix</span></span>.</p>
14425 <p class="TextFontCX"><span class="Flag"><span style=
14426 'font-size:10.0pt'>file-static-prefix</span></span><span class="Flag">
14427 <span style='font-size:10.0pt'> <i><prefix
14428 string></i></span></span></p>
14429 <p class="IndentText">Set namespace prefix for file
14430 <span class="CodeText"><span style=
14431 'font-size:10.0pt'>static</span></span> declarations.</p>
14433 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14434 height="14" align="left">
14436 <td valign="top" align="left" height="14" style=
14437 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14438 <p class="TextFontCX" align="center" style=
14439 'text-align:center;background:#CCCCCC'><span style=
14440 'font-size:10.0pt'>P:</span> <span class=
14441 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14442 <p class="TextFontCX"><span class="Flag"><span style=
14443 'font-size:10.0pt'>file-static-prefix-exclude</span></span></p>
14444 <p class="IndentText">An identifier that is not file static starts
14445 with the <span class="Flag"><span style=
14446 'font-size:10.0pt'>filestaticprefix</span></span>.</p>
14447 <p class="TextFontCX"><span class="Flag"><span style=
14448 'font-size:10.0pt'>global-prefix</span></span><span class=
14449 "Flag"><span style='font-size:10.0pt'> <i><prefix
14450 string></i></span></span></p>
14451 <p class="IndentText">Set namespace prefix for global
14454 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14455 height="14" align="left">
14457 <td valign="top" align="left" height="14" style=
14458 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14459 <p class="TextFontCX" align="center" style=
14460 'text-align:center;background:#CCCCCC'><span style=
14461 'font-size:10.0pt'>P:</span> <span class=
14462 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14463 <p class="TextFontCX"><span class="Flag"><span style=
14464 'font-size:10.0pt'>global-prefix-exclude</span></span></p>
14465 <p class="IndentText">An identifier that is not a global variable
14466 starts with the <span class="Flag"><span style=
14467 'font-size:10.0pt'>globalprefix</span></span>.</p>
14468 <p class="TextFontCX"><span class="Flag"><span style=
14469 'font-size:10.0pt'>type-prefix</span></span><span class=
14470 "Flag"><span style='font-size:10.0pt'> <i><prefix
14471 string></i></span></span></p>
14472 <p class="IndentText">Set namespace prefix for user-defined
14475 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14476 height="14" align="left">
14478 <td valign="top" align="left" height="14" style=
14479 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14480 <p class="TextFontCX" align="center" style=
14481 'text-align:center;background:#CCCCCC'><span style=
14482 'font-size:10.0pt'>P:</span> <span class=
14483 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14484 <p class="TextFontCX"><span class="Flag"><span style=
14485 'font-size:10.0pt'>type-prefix-exclude</span></span></p>
14486 <p class="IndentText">An identifier that is not a type name starts
14487 with the <span class="Flag"><span style=
14488 'font-size:10.0pt'>typeprefix</span></span>.</p>
14489 <p class="TextFontCX"><span class="Flag"><span style=
14490 'font-size:10.0pt'>external-prefix</span></span><span class=
14491 "Flag"><span style='font-size:10.0pt'> <i><prefix
14492 string></i></span></span></p>
14493 <p class="IndentText">Set namespace prefix for external
14496 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14497 height="14" align="left">
14499 <td valign="top" align="left" height="14" style=
14500 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14501 <p class="TextFontCX" align="center" style=
14502 'text-align:center;background:#CCCCCC'><span style=
14503 'font-size:10.0pt'>P:</span> <span class=
14504 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14505 <p class="TextFontCX"><span class="Flag"><span style=
14506 'font-size:10.0pt'>external-prefix-exclude</span></span></p>
14507 <p class="IndentText">An identifier that is not external starts
14508 with the <span class="Flag"><span style=
14509 'font-size:10.0pt'>externalprefix</span></span>.</p>
14510 <p class="TextFontCX"><span class="Flag"><span style=
14511 'font-size:10.0pt'>local-prefix</span></span><span class=
14512 "Flag"><span style='font-size:10.0pt'> <i><prefix
14513 string></i></span></span></p>
14514 <p class="IndentText">Set namespace prefix for local variables.</p>
14516 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14517 height="14" align="left">
14519 <td valign="top" align="left" height="14" style=
14520 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14521 <p class="TextFontCX" align="center" style=
14522 'text-align:center;background:#CCCCCC'><span style=
14523 'font-size:10.0pt'>P:</span> <span class=
14524 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14525 <p class="TextFontCX"><span class="Flag"><span style=
14526 'font-size:10.0pt'>local-prefix-exclude</span></span></p>
14527 <p class="IndentText"> An identifier that is not a local
14528 variable starts with the <span class="Flag"><span style=
14529 'font-size:10.0pt'>localprefix</span></span>.</p>
14530 <p class="TextFontCX"><span class="Flag"><span style=
14531 'font-size:10.0pt'>unchecked-macro-prefix</span></span><span class="Flag">
14532 <span style='font-size:10.0pt'> <i><prefix
14533 string></i></span></span></p>
14534 <p class="IndentText">Set namespace prefix for unchecked
14537 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14538 height="14" align="left">
14540 <td valign="top" align="left" height="14" style=
14541 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14542 <p class="TextFontCX" align="center" style=
14543 'text-align:center;background:#CCCCCC'><span style=
14544 'font-size:10.0pt'>P:</span> <span class=
14545 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14546 <p class="TextFontCX"><span class="Flag"><span style=
14547 'font-size:10.0pt'>unchecked-macro-prefix-exclude</span></span></p>
14548 <p class="IndentText">An identifier that is not the name of an
14549 unchecked macro starts with the <span class=
14550 "Flag"><span style='font-size:10.0pt'>uncheckedmacroprefix</span></span>.</p>
14551 <p class="TextFontCX"><span class="Flag"><span style=
14552 'font-size:10.0pt'>const-prefix</span></span><span class=
14553 "Flag"><span style='font-size:10.0pt'> <i><prefix
14554 string></i></span></span></p>
14555 <p class="IndentText">Set namespace prefix for constants.</p>
14557 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14558 height="14" align="left">
14560 <td valign="top" align="left" height="14" style=
14561 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14562 <p class="TextFontCX" align="center" style=
14563 'text-align:center;background:#CCCCCC'><span style=
14564 'font-size:10.0pt'>P:</span> <span class=
14565 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14566 <p class="TextFontCX"><span class="Flag"><span style=
14567 'font-size:10.0pt'>const-prefix-exclude</span></span></p>
14568 <p class="IndentText">An identifier that is not a constant starts
14569 with the <span class="Flag"><span style=
14570 'font-size:10.0pt'>constantprefix</span></span>.</p>
14571 <p class="TextFontCX"><span class="Flag"><span style=
14572 'font-size:10.0pt'>iter-prefix</span></span><span class=
14573 "Flag"><span style='font-size:10.0pt'> <i><prefix
14574 string></i></span></span></p>
14575 <p class="IndentText">Set namespace prefix for iterators.</p>
14577 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14578 height="14" align="left">
14580 <td valign="top" align="left" height="14" style=
14581 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14582 <p class="TextFontCX" align="center" style=
14583 'text-align:center;background:#CCCCCC'><span style=
14584 'font-size:10.0pt'>P:</span> <span class=
14585 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14586 <p class="TextFontCX"><span class="Flag"><span style=
14587 'font-size:10.0pt'>iter-prefix-exclude</span></span></p>
14588 <p class="IndentText">An identifier that is not an
14589 <span class="Flag"><span style=
14590 'font-size:10.0pt'>iter</span></span> starts with the
14591 <span class="Flag"><span style=
14592 'font-size:10.0pt'>iterprefix</span></span>.</p>
14593 <p class="TextFontCX"><span class="Flag"><span style=
14594 'font-size:10.0pt'>proto-param-prefix</span></span><span class="Flag">
14595 <span style='font-size:10.0pt'> <i><prefix
14596 string></i></span></span></p>
14597 <p class="IndentText">Set namespace prefix for parameters in
14598 function prototypes.</p>
14600 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14601 height="14" align="left">
14603 <td valign="top" align="left" height="14" style=
14604 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14605 <p class="TextFontCX" align="center" style=
14606 'text-align:center;background:#CCCCCC'><span style=
14607 'font-size:10.0pt'>P:</span> <span class=
14608 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14609 <p class="TextFontCX"><span class="Flag"><span style=
14610 'font-size:10.0pt'>proto-param-prefix-exclude</span></span></p>
14611 <p class="IndentText">An identifier that is not a parameter in a
14612 function prototype starts with the <span class=
14613 "Flag"><span style='font-size:10.0pt'>protoprarmprefix</span></span>.</p>
14615 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14616 height="14" align="left">
14618 <td valign="top" align="left" height="14" style=
14619 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14620 <p class="TextFontCX" align="center" style=
14621 'text-align:center;background:#CCCCCC'><span style=
14622 'font-size:10.0pt'>m:</span><span class=
14623 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
14624 <p class="TextFontCX"><span class="Flag"><span style=
14625 'font-size:10.0pt'>proto-param-name</span></span></p>
14626 <p class="IndentText">A parameter in a function prototype has a
14627 name (can interfere with macro definitions).</p>
14629 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14630 height="14" align="left">
14632 <td valign="top" align="left" height="14" style=
14633 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14634 <p class="TextFontCX" align="center" style=
14635 'text-align:center;background:#CCCCCC'><span style=
14636 'font-size:10.0pt'>m:</span><span class=
14637 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
14638 <p class="TextFontCX"><span class="Flag"><span style=
14639 'font-size:10.0pt'>proto-param-match</span></span></p>
14640 <p class="IndentText">The name of a parameter in a function
14641 definition does not match the corresponding name of the parameter
14642 in a function prototype (after removing the <span class=
14643 "Flag"><span style=
14644 'font-size:10.0pt'>protoparamprefix</span></span>).</p>
14645 <p class="Heading10">Naming Restrictions <span style=
14646 'font-size:10.5pt; font-weight:normal'>(Section 12.3)</span></p>
14648 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14649 height="14" align="left">
14651 <td valign="top" align="left" height="14" style=
14652 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14653 <p class="TextFontCX" align="center" style=
14654 'text-align:center;background:#CCCCCC'><span style=
14655 'font-size:10.0pt'>m:</span><span class=
14656 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
14657 <p class="TextFontCX"><span class="Flag"><span style=
14658 'font-size:10.0pt'>shadow</span></span></p>
14659 <p class="IndentText">Declaration reuses name visible in outer
14661 <p class="Heading11">Reserved Names</p>
14663 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14664 height="14" align="left">
14666 <td valign="top" align="left" height="14" style=
14667 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14668 <p class="TextFontCX" align="center" style=
14669 'text-align:center;background:#CCCCCC'><span style=
14670 'font-size:10.0pt'>m:</span><span class=
14671 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
14672 <p class="TextFontCX"><span class="Flag"><span style=
14673 'font-size:10.0pt'>ansi-reserved</span></span></p>
14674 <p class="IndentText">External name conflicts with name reserved
14675 for the compiler or standard library.</p>
14677 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14678 height="14" align="left">
14680 <td valign="top" align="left" height="14" style=
14681 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14682 <p class="TextFontCX" align="center" style=
14683 'text-align:center;background:#CCCCCC'><span style=
14684 'font-size:10.0pt'>m:</span><span class=
14685 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
14686 <p class="TextFontCX"><span class="Flag"><span style=
14687 'font-size:10.0pt'>ansi-reserved-internal</span></span></p>
14688 <p class="IndentText"> Internal name conflicts with name
14689 reserved for the compiler or standard library.</p>
14692 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14693 height="14" align="left">
14695 <td valign="top" align="left" height="14" style=
14696 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14697 <p class="TextFontCX" align="center" style=
14698 'text-align:center;background:#CCCCCC'><span style=
14699 'font-size:10.0pt'>m:</span><span class=
14700 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
14701 <p class="TextFontCX"><span class="Flag"><span style=
14702 'font-size:10.0pt'>iso-reserved</span></span></p>
14703 <p class="IndentText">
14704 External name is reserved for system use by ISO C99 standard.
14708 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14709 height="14" align="left">
14711 <td valign="top" align="left" height="14" style=
14712 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14713 <p class="TextFontCX" align="center" style=
14714 'text-align:center;background:#CCCCCC'><span style=
14715 'font-size:10.0pt'>m:</span><span class=
14716 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
14717 <p class="TextFontCX"><span class="Flag"><span style=
14718 'font-size:10.0pt'>iso-reserved-internal</span></span></p>
14719 <p class="IndentText">
14720 Internal name is reserved for system in ISO C99 standard (this should not be necessary unless you are worried about C library implementations that violate the standard and use macros).
14724 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14725 height="14" align="left">
14727 <td valign="top" align="left" height="14" style=
14728 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14729 <p class="TextFontCX" align="center" style=
14730 'text-align:center;background:#CCCCCC'><span style=
14731 'font-size:10.0pt'>m:</span><span class=
14732 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
14733 <p class="TextFontCX"><span class="Flag"><span style=
14734 'font-size:10.0pt'>cpp-names</span></span></p>
14735 <p class="IndentText">Internal or external name conflicts with a
14736 C++ reserved word. (Will cause problems if program is
14737 compiled with a C++ compiler.)</p>
14738 <p class="Heading11">Distinct External Names</p>
14740 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14741 height="14" align="left">
14743 <td valign="top" align="left" height="14" style=
14744 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14745 <p class="TextFontCX" align="center" style=
14746 'text-align:center;background:#CCCCCC'><span style=
14747 'font-size:10.0pt'>P:</span> <span class=
14748 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14749 <p class="TextFontCX"><span class="Flag"><span style=
14750 'font-size:10.0pt'>distinct-external-names</span></span></p>
14751 <p class="IndentText">An external name is not distinguishable from
14752 another external name using <span class="Flag"><span style=
14753 'font-size:10.0pt'>externalnamelen</span></span><i> </i>significant
14756 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14757 height="14" align="left">
14759 <td valign="top" align="left" height="14" style=
14760 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14761 <p class="TextFontCX" align="center" style=
14762 'text-align:center;background:#CCCCCC'><span style=
14763 'font-size:10.0pt'>P: 6</span></p></td></tr></table></div>
14764 <p class="TextFontCX"><span class="Flag"><span style=
14765 'font-size:10.0pt'>external-name-len</span></span><span class="Flag">
14767 'font-size:10.0pt'> <i><number></i></span></span></p>
14768 <p class="IndentText">Sets the number of significant characters in
14769 an external name (ANSI default minimum is 6). Sets
14770 <span class="Flag"><span style=
14771 'font-size:10.0pt'>+distinct-external-names</span></span>.</p>
14773 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14774 height="14" align="left">
14776 <td valign="top" align="left" height="14" style=
14777 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14778 <p class="TextFontCX" align="center" style=
14779 'text-align:center;background:#CCCCCC'><span style=
14780 'font-size:10.0pt'>P:</span> <span class=
14781 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14782 <p class="TextFontCX"><span class="Flag"><span style=
14783 'font-size:10.0pt'>external-name-case-insensitive</span></span></p>
14784 <p class="IndentText">Make alphabetic case insignificant in
14785 external names. According to ANSI standard, case need not be
14786 significant in an external name. If <span class=
14787 "Flag"><span style=
14788 'font-size:10.0pt'>+distinct-external-names</span></span> is
14789 not set, sets <span class="Flag"><span style=
14790 'font-size:10.0pt'>+distinct-external-names</span></span> with
14791 unlimited external name length.</p>
14792 <p class="Heading11">Distinct Internal Names</p>
14794 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14795 height="14" align="left">
14797 <td valign="top" align="left" height="14" style=
14798 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14799 <p class="TextFontCX" align="center" style=
14800 'text-align:center;background:#CCCCCC'><span style=
14801 'font-size:10.0pt'>m:</span><span class=
14802 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
14803 <p class="TextFontCX"><span class="Flag"><span style=
14804 'font-size:10.0pt'>distinct-internal-names</span></span></p>
14805 <p class="IndentText">An internal name is not distinguishable from
14806 another internal name using <span class="Flag"><span style=
14807 'font-size:10.0pt'>internalnamelen</span></span> significant
14808 characters. (Also effected by <span class=
14809 "Flag"><span style=
14810 'font-size:10.0pt'>internal-name-case-insensitive</span></span> and
14811 <span class="Flag"><span style=
14812 'font-size:10.0pt'>internal-name-lookalike</span></span>.)</p>
14814 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14815 height="14" align="left">
14817 <td valign="top" align="left" height="14" style=
14818 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14819 <p class="TextFontCX" align="center" style=
14820 'text-align:center;background:#CCCCCC'><span style=
14821 'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
14822 'font-size:10.0pt'>31</span></span></p></td></tr></table></div>
14823 <p class="TextFontCX"><span class="Flag"><span style=
14824 'font-size:10.0pt'>internal-name-len</span></span><span class="Flag">
14826 'font-size:10.0pt'> <i><number></i></span></span></p>
14827 <p class="IndentText">Set the number of significant characters in
14828 an internal name. Sets <span class="Flag"><span style=
14829 'font-size:10.0pt'>+distinct-internal-names</span></span>.</p>
14831 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14832 height="14" align="left">
14834 <td valign="top" align="left" height="14" style=
14835 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14836 <p class="TextFontCX" align="center" style=
14837 'text-align:center;background:#CCCCCC'><span style=
14838 'font-size:10.0pt'>P:</span> <span class=
14839 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14840 <p class="TextFontCX"><span class="Flag"><span style=
14841 'font-size:10.0pt'>internal-name-case-insensitive</span></span></p>
14842 <p class="IndentText">Set whether case is significant an internal
14843 names (<span class="Flag"><span style=
14844 'font-size:10.0pt'>-internal-name-case-insensitive</span></span> means
14845 case is significant). If <span class=
14846 "Flag"><span style='font-size:10.0pt'>+distinct-internal-names</span></span> is
14847 not set, sets <span class="Flag"><span style=
14848 'font-size:10.0pt'>+distinct-internal-names</span></span>
14849 with unlimited internal name length.</p>
14851 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14852 height="14" align="left">
14854 <td valign="top" align="left" height="14" style=
14855 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14856 <p class="TextFontCX" align="center" style=
14857 'text-align:center;background:#CCCCCC'><span style=
14858 'font-size:10.0pt'>P:</span> <span class=
14859 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
14860 <p class="TextFontCX"><span class="Flag"><span style=
14861 'font-size:10.0pt'>internal-name-lookalike</span></span></p>
14862 <p class="IndentText"> Set whether similar looking characters
14863 (e.g., “<span class="Keyword"><span style=
14864 'font-size:10.0pt'>1</span></span>” and
14865 “<span class="Keyword"><span style=
14866 'font-size:10.0pt'>l</span></span>”) match in internal
14868 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
14869 Control Flow <span class="TextFontCXChar"><span style=
14870 'font-size:11.0pt; font-weight:normal'>(Section
14871 8)</span></span></p>
14872 <p class="Heading10">Undefined Evaluation Order <span class=
14873 "HeadingNote"><span style=
14874 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
14875 <span class="HeadingNote"><span style=
14876 'font-size:10.5pt;font-weight:normal;font-style: normal'>8.2</span></span><span class="HeadingNote">
14878 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
14880 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14881 height="14" align="left">
14883 <td valign="top" align="left" height="14" style=
14884 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14885 <p class="TextFontCX" align="center" style=
14886 'text-align:center;background:#CCCCCC'><span style=
14887 'font-size:10.0pt'>m:</span><span class=
14888 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
14889 <p class="Heading10" style='margin:0in;margin-bottom:.0001pt'>
14890 <span class="Flag"><span style=
14891 'font-size:10.0pt;font-weight:normal'>eval-order</span></span></p>
14892 <p class="IndentText">Behavior of an expression is unspecified or
14893 implementation-dependent because sub-expressions contain
14894 interfering side effects that may be evaluated in any order.</p>
14896 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14897 height="14" align="left">
14899 <td valign="top" align="left" height="14" style=
14900 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14901 <p class="TextFontCX" align="center" style=
14902 'text-align:center;background:#CCCCCC'><span style=
14903 'font-size:10.0pt'>m:</span><span class=
14904 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
14905 <p class="TextFontCX"><span class="Flag"><span style=
14906 'font-size:10.0pt'>eval-order-uncon</span></span></p>
14907 <p class="IndentText">An expression may be undefined because a
14908 sub-expression contains a call to an unconstrained function (no
14909 modifies clause) that may modify something that may be modified or
14910 used by another sub-expression.</p>
14911 <p class="Heading10">Problematic Control Structures
14912 <span class="HeadingNote"><span style=
14913 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
14914 <span class="HeadingNote"><span style=
14915 'font-size:10.5pt;font-weight:normal;font-style: normal'>8.3</span></span><span class="HeadingNote">
14917 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
14919 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14920 height="14" align="left">
14922 <td valign="top" align="left" height="14" style=
14923 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14924 <p class="TextFontCX" align="center" style=
14925 'text-align:center;background:#CCCCCC'><span style=
14926 'font-size:10.0pt'>m:</span><span class=
14927 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
14928 <p class="TextFontCX"><span class="Flag"><span style=
14929 'font-size:10.0pt'>inf-loops</span></span></p>
14930 <p class="IndentText">Likely infinite loop is detected (Section
14933 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14934 height="14" align="left">
14936 <td valign="top" align="left" height="14" style=
14937 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14938 <p class="TextFontCX" align="center" style=
14939 'text-align:center;background:#CCCCCC'><span style=
14940 'font-size:10.0pt'>m:</span><span class=
14941 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
14942 <p class="TextFontCX"><span class="Flag"><span style=
14943 'font-size:10.0pt'>inf-loops-uncon</span></span></p>
14944 <p class="IndentText">Likely infinite loop is detected. Loop
14945 test or body calls an unconstrained function that may produce an
14946 undetected modification.</p>
14948 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14949 height="14" align="left">
14951 <td valign="top" align="left" height="14" style=
14952 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14953 <p class="TextFontCX" align="center" style=
14954 'text-align:center;background:#CCCCCC'><span style=
14955 'font-size:10.0pt'>m:</span><span class=
14956 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
14957 <p class="TextFontCX"><span class="Flag"><span style=
14958 'font-size:10.0pt'>elseif-complete</span></span></p>
14959 <p class="IndentText">There is no finals else following an else if
14960 construct (Section 8.3.5).</p>
14963 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14964 height="14" align="left">
14966 <td valign="top" align="left" height="14" style=
14967 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14968 <p class="TextFontCX" align="center" style=
14969 'text-align:center;background:#CCCCCC'><span style=
14970 'font-size:10.0pt'>m:</span><span class=
14971 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
14972 <p class="TextFontCX"><span class="Flag"><span style=
14973 'font-size:10.0pt'>case-break</span></span></p>
14974 <p class="IndentText">There is a non-empty case in a switch not
14975 followed by a <span class="CodeText"><span style=
14976 'font-size:10.0pt'>break</span></span><span class=
14977 "HeadingNote"><span style=
14978 'font-size:10.5pt;font-style:normal'>(Section</span></span>
14979 <span class="HeadingNote"><span style=
14980 'font-size:10.5pt;font-style:normal'>8.3.2</span></span><span class="HeadingNote">
14982 'font-size:10.5pt;font-style:normal'>).</span></span></p>
14986 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
14987 height="14" align="left">
14989 <td valign="top" align="left" height="14" style=
14990 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
14991 <p class="TextFontCX" align="center" style=
14992 'text-align:center;background:#CCCCCC'><span style=
14993 'font-size:10.0pt'>m:</span><span class=
14994 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
14995 <p class="TextFontCX"><span class="Flag"><span style=
14996 'font-size:10.0pt'>first-case</span></span></p>
14997 <p class="IndentText">
14998 The first statement after a switch is not a case.
15003 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15004 height="14" align="left">
15006 <td valign="top" align="left" height="14" style=
15007 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15008 <p class="TextFontCX" align="center" style=
15009 'text-align:center;background:#CCCCCC'><span style=
15010 'font-size:10.0pt'>m:</span><span class=
15011 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15012 <p class="TextFontCX"><span class="Flag"><span style=
15013 'font-size:10.0pt'>Duplicate-case</span></span></p>
15014 <p class="IndentText">
15015 Duplicate cases in switch.
15019 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15020 height="14" align="left">
15022 <td valign="top" align="left" height="14" style=
15023 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15024 <p class="TextFontCX" align="center" style=
15025 'text-align:center;background:#CCCCCC'><span style=
15026 'font-size:10.0pt'>m:</span><span class=
15027 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15028 <p class="TextFontCX"><span class="Flag"><span style=
15029 'font-size:10.0pt'>miss-case</span></span></p>
15030 <p class="IndentText">A switch on an <span class=
15031 "CodeText"><span style='font-size: 10.0pt'>enum</span></span> type
15032 is missing a case for a member of the enumerator.</p>
15035 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15036 height="14" align="left">
15038 <td valign="top" align="left" height="14" style=
15039 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15040 <p class="TextFontCX" align="center" style=
15041 'text-align:center;background:#CCCCCC'><span style=
15042 'font-size:10.0pt'>P</span><span class=
15043 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
15044 <p class="TextFontCX"><span class="Flag"><span style=
15045 'font-size:10.0pt'>emptyreturn
15047 <p class="IndentText">Empty return in function declared to return value.</p>
15050 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15051 height="14" align="left">
15053 <td valign="top" align="left" height="14" style=
15054 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15055 <p class="TextFontCX" align="center" style=
15056 'text-align:center;background:#CCCCCC'><span style=
15057 'font-size:10.0pt'>P</span><span class=
15058 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
15059 <p class="TextFontCX"><span class="Flag"><span style=
15060 'font-size:10.0pt'>alwaysexits
15062 <p class="IndentText">
15063 Loop predicate always exits.
15067 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15068 height="14" align="left">
15070 <td valign="top" align="left" height="14" style=
15071 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15072 <p class="TextFontCX" align="center" style=
15073 'text-align:center;background:#CCCCCC'><span style=
15074 'font-size:10.0pt'>shortcut</span><span class=
15075 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
15076 <p class="TextFontCX"><span class="Flag"><span style=
15077 'font-size:10.0pt'>loop-exec</span></span></p>
15078 <p class="IndentText">Assume all loops execute at least once.
15079 This effects use-before-definition and memory checking.
15080 It should probably not be used globally, but may be used
15081 surrounding a particular loop that is known to always execute to
15082 prevent spurious messages.
15084 <span class="Flag"><span style=
15085 'font-size:10.0pt'>
15086 for-loop-exec, while-loop-exec and iter-loop-exec
15091 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15092 height="14" align="left">
15094 <td valign="top" align="left" height="14" style=
15095 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15096 <p class="TextFontCX" align="center" style=
15097 'text-align:center;background:#CCCCCC'><span style=
15098 'font-size:10.0pt'>P</span><span class=
15099 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
15100 <p class="TextFontCX"><span class="Flag"><span style=
15101 'font-size:10.0pt'>for-loop-exec
15103 <p class="IndentText">
15104 Assume all<span class=
15105 "CodeText"><span style='font-size: 10.0pt'>
15108 loops execute at least once. This effects use-before-definition
15109 and memory checking. It should probably not be used globally, but may be used
15110 surrounding a particular loop that is known to always execute to prevent spurious messages.
15116 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15117 height="14" align="left">
15119 <td valign="top" align="left" height="14" style=
15120 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15121 <p class="TextFontCX" align="center" style=
15122 'text-align:center;background:#CCCCCC'><span style=
15123 'font-size:10.0pt'>P</span><span class=
15124 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
15125 <p class="TextFontCX"><span class="Flag"><span style=
15126 'font-size:10.0pt'>while-loop-exec
15128 <p class="IndentText">
15129 Assume all<span class=
15130 "CodeText"><span style='font-size: 10.0pt'>
15133 loops execute at least once. This effects use-before-definition
15134 and memory checking. It should probably not be used globally, but may be used
15135 surrounding a particular loop that is known to always execute to prevent spurious messages.
15140 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15141 height="14" align="left">
15143 <td valign="top" align="left" height="14" style=
15144 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15145 <p class="TextFontCX" align="center" style=
15146 'text-align:center;background:#CCCCCC'><span style=
15147 'font-size:10.0pt'>P</span><span class=
15148 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
15149 <p class="TextFontCX"><span class="Flag"><span style=
15150 'font-size:10.0pt'>iter-loop-exec
15152 <p class="IndentText">
15153 Assume all<span class=
15154 "CodeText"><span style='font-size: 10.0pt'>
15157 loops execute at least once. This effects use-before-definition
15158 and memory checking. It should probably not be used globally, but may be used
15159 surrounding a particular loop that is known to always execute to prevent spurious messages.
15165 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15166 height="14" align="left">
15168 <td valign="top" align="left" height="14" style=
15169 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15170 <p class="TextFontCX" align="center" style=
15171 'text-align:center;background:#CCCCCC'><span style=
15172 'font-size:10.0pt'>P</span><span class=
15173 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
15174 <p class="TextFontCX"><span class="Flag"><span style=
15175 'font-size:10.0pt'>obvious-loop-exec
15177 <p class="IndentText">
15178 Assume loop that can be determined to always execute always does.
15181 <p class="Heading10">Deep Break <span class=
15182 "TextFontCXChar"><span style=
15183 'font-size:11.0pt; font-weight:normal'>(Section</span></span>
15184 <span class="TextFontCXChar"><span style=
15185 'font-size:11.0pt; font-weight:normal'>8.3.3</span></span><span class="TextFontCXChar">
15187 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
15189 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15190 height="14" align="left">
15192 <td valign="top" align="left" height="14" style=
15193 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15194 <p class="TextFontCX" align="center" style=
15195 'text-align:center;background:#CCCCCC'><span style=
15196 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
15197 <p class="TextFontCX"><span class="Flag"><span style=
15198 'font-size:10.0pt'>deep-break</span></span></p>
15199 <p class="IndentText">Report errors for <span class=
15200 "CodeText"><span style='font-size:10.0pt'>break</span></span>
15201 statements inside a nested <span class=
15202 "CodeText"><span style='font-size:10.0pt'>while</span></span>,
15203 <span class="CodeText"><span style=
15204 'font-size:10.0pt'>for</span></span> or <span class=
15205 "CodeText"><span style=
15206 'font-size:10.0pt'>switch</span></span>. (Sets all
15207 nested break and continue flags.)</p>
15209 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15210 height="14" align="left">
15212 <td valign="top" align="left" height="14" style=
15213 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15214 <p class="TextFontCX" align="center" style=
15215 'text-align:center;background:#CCCCCC'><span style=
15216 'font-size:10.0pt'>m:</span><span class=
15217 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
15218 <p class="MsoListBullet"><span class="Flag"><span style=
15219 'font-size:10.0pt'>loop-loop-break</span></span></p>
15220 <p class="IndentText"><span class="TextFontCXChar">There is
15221 a</span> <span class="CodeText"><span style=
15222 'font-size:10.0pt'>break</span></span> inside a <span class=
15223 "CodeText"><span style='font-size:10.0pt'>while</span></span>,
15224 <span class="CodeText"><span style=
15225 'font-size:10.0pt'>for</span></span> or iterator loop that is
15226 inside a <span class="CodeText"><span style=
15227 'font-size: 10.0pt'>while</span></span>, <span class=
15228 "CodeText"><span style='font-size:10.0pt'>for</span></span> or
15229 iterator loop. Mark with <span class="Annot"><span style=
15230 'font-size:10.0pt'>/*@innerbreak@*/</span></span> to suppress the
15233 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15234 height="14" align="left">
15236 <td valign="top" align="left" height="14" style=
15237 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15238 <p class="TextFontCX" align="center" style=
15239 'text-align:center;background:#CCCCCC'><span style=
15240 'font-size:10.0pt'>m:</span><span class=
15241 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
15242 <p class="MsoListBullet"><span class="Flag"><span style=
15243 'font-size:10.0pt'>switch-loop-break</span></span></p>
15244 <p class="IndentText"><span class="TextFontCXChar">There is
15245 a</span><span class="CodeText"><span style=
15246 'font-size:10.0pt'>break</span></span> inside a <span class=
15247 "CodeText"><span style='font-size:10.0pt'>while</span></span>,
15248 <span class="CodeText"><span style=
15249 'font-size:10.0pt'>for</span></span> or iterator loop that is
15250 inside a <span class="CodeText"><span style=
15251 'font-size: 10.0pt'>switch</span></span> statement. Mark with
15252 <span class="Annot"><span style=
15253 'font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>
15255 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15256 height="14" align="left">
15258 <td valign="top" align="left" height="14" style=
15259 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15260 <p class="TextFontCX" align="center" style=
15261 'text-align:center;background:#CCCCCC'><span style=
15262 'font-size:10.0pt'>m:</span><span class=
15263 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15264 <p class="MsoListBullet"><span class="Flag"><span style=
15265 'font-size:10.0pt'>loop-switch-break</span></span></p>
15266 <p class="IndentText"><span class="TextFontCXChar">There is
15267 a</span><span class="CodeText"><span style=
15268 'font-size:10.0pt'>break</span></span> inside a <span class=
15269 "CodeText"><span style='font-size:10.0pt'>switch</span></span>
15270 statement that is inside a <span class=
15271 "CodeText"><span style='font-size:10.0pt'>while</span></span>,
15272 <span class="CodeText"><span style=
15273 'font-size:10.0pt'>for</span></span> or iterator loop.
15274 Mark with /<span class="Annot"><span style=
15275 'font-size:10.0pt'>*@switchbreak@*/</span></span>.</p>
15277 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15278 height="14" align="left">
15280 <td valign="top" align="left" height="14" style=
15281 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15282 <p class="TextFontCX" align="center" style=
15283 'text-align:center;background:#CCCCCC'><span style=
15284 'font-size:10.0pt'>m:</span><span class=
15285 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15286 <p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
15287 <span class="Flag"><span style=
15288 'font-size:10.0pt'>switch-switch-break</span></span></p>
15289 <p class="IndentText"><span class="TextFontCXChar">There is
15290 a</span><span class="CodeText"><span style=
15291 'font-size:10.0pt'>break</span></span> inside a <span class=
15292 "CodeText"><span style='font-size:10.0pt'>switch</span></span>
15293 statement that is inside another <span class=
15294 "CodeText"><span style='font-size: 10.0pt'>switch</span></span>
15295 statement. Mark with <span class="Annot"><span style=
15296 'font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>
15298 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15299 height="14" align="left">
15301 <td valign="top" align="left" height="14" style=
15302 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15303 <p class="TextFontCX" align="center" style=
15304 'text-align:center;background:#CCCCCC'><span style=
15305 'font-size:10.0pt'>m:</span><span class=
15306 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15307 <p class="TextFontCX"><span class="Flag"><span style=
15308 'font-size:10.0pt'>loop-loop-continue</span></span></p>
15309 <p class="IndentText">There is a <span class=
15310 "CodeText"><span style='font-size: 10.0pt'>continue</span></span>
15311 inside a while, for or iterator loop that is inside a while,
15312 for or iterator loop. Mark with <span class=
15313 "Annot"><span style=
15314 'font-size:10.0pt'>/*@innercontinue@*/</span></span>.</p>
15315 <p class="Heading10">Loop and if Bodies <span class=
15316 "TextFontCXChar"><span style=
15317 'font-size:11.0pt; font-weight:normal'>(Section
15318 8.3.4)</span></span></p>
15320 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15321 height="14" align="left">
15323 <td valign="top" align="left" height="14" style=
15324 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15325 <p class="TextFontCX" align="center" style=
15326 'text-align:center;background:#CCCCCC'><span style=
15327 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
15328 <p class="TextFontCX"><span class="Flag"><span style=
15329 'font-size:10.0pt'>all-empty</span></span></p>
15330 <p class="IndentText">An if, while or for statement has no body
15331 (sets <span class="Flag"><span style=
15332 'font-size:10.0pt'>if-empty</span></span>, <span class=
15333 "Flag"><span style=
15334 'font-size:10.0pt'>while-empty</span></span> and
15335 <span class="Flag"><span style=
15336 'font-size:10.0pt'>for-empty</span></span>.)</p>
15338 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15339 height="14" align="left">
15341 <td valign="top" align="left" height="14" style=
15342 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15343 <p class="TextFontCX" align="center" style=
15344 'text-align:center;background:#CCCCCC'><span style=
15345 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
15346 <p class="TextFontCX"><span class="Flag"><span style=
15347 'font-size:10.0pt'>all-block</span></span></p>
15348 <p class="IndentText">The body of an <span class=
15349 "CodeText"><span style='font-size: 10.0pt'>if</span></span>,
15350 <span class="CodeText"><span style=
15351 'font-size:10.0pt'>while</span></span> or <span class=
15352 "CodeText"><span style='font-size:10.0pt'>for</span></span>
15353 statement is not a block (sets <span class=
15354 "Flag"><span style='font-size:10.0pt'>if-block</span></span>,
15355 <span class="Flag"><span style=
15356 'font-size:10.0pt'>while-block</span></span> and
15357 <span class="Flag"><span style=
15358 'font-size:10.0pt'>for-block</span></span>.)</p>
15360 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15361 height="14" align="left">
15363 <td valign="top" align="left" height="14" style=
15364 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15365 <p class="TextFontCX" align="center" style=
15366 'text-align:center;background:#CCCCCC'><span style=
15367 'font-size:10.0pt'>m:</span><span class=
15368 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
15369 <p class="TextFontCX"><span class="Flag"><span style=
15370 'font-size:10.0pt'>while-empty</span></span></p>
15371 <p class="IndentText">A while statement has no body.</p>
15373 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15374 height="14" align="left">
15376 <td valign="top" align="left" height="14" style=
15377 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15378 <p class="TextFontCX" align="center" style=
15379 'text-align:center;background:#CCCCCC'><span style=
15380 'font-size:10.0pt'>m:</span><span class=
15381 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15382 <p class="TextFontCX"><span class="Flag"><span style=
15383 'font-size:10.0pt'>while-block</span></span></p>
15384 <p class="IndentText"> The body of a <span class=
15385 "CodeText"><span style='font-size: 10.0pt'>while</span></span>
15386 statement is not a block</p>
15388 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15389 height="14" align="left">
15391 <td valign="top" align="left" height="14" style=
15392 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15393 <p class="TextFontCX" align="center" style=
15394 'text-align:center;background:#CCCCCC'><span style=
15395 'font-size:10.0pt'>m:</span><span class=
15396 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15397 <p class="TextFontCX"><span class="Flag"><span style=
15398 'font-size:10.0pt'>for-empty</span></span></p>
15399 <p class="IndentText">A <span class="CodeText"><span style=
15400 'font-size:10.0pt'>for</span></span> statement has no body.</p>
15402 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15403 height="14" align="left">
15405 <td valign="top" align="left" height="14" style=
15406 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15407 <p class="TextFontCX" align="center" style=
15408 'text-align:center;background:#CCCCCC'><span style=
15409 'font-size:10.0pt'>m:</span><span class=
15410 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15411 <p class="TextFontCX"><span class="Flag"><span style=
15412 'font-size:10.0pt'>for-block</span></span></p>
15413 <p class="IndentText">The body of a <span class=
15414 "CodeText"><span style='font-size: 10.0pt'>for</span></span>
15415 statement is not a block.</p>
15417 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15418 height="14" align="left">
15420 <td valign="top" align="left" height="14" style=
15421 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15422 <p class="TextFontCX" align="center" style=
15423 'text-align:center;background:#CCCCCC'><span style=
15424 'font-size:10.0pt'>m:</span><span class=
15425 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
15426 <p class="TextFontCX"><span class="Flag"><span style=
15427 'font-size:10.0pt'>if-empty</span></span></p>
15428 <p class="IndentText">An <span class="CodeText"><span style=
15429 'font-size:10.0pt'>if</span></span> statement has no body.</p>
15431 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15432 height="14" align="left">
15434 <td valign="top" align="left" height="14" style=
15435 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15436 <p class="TextFontCX" align="center" style=
15437 'text-align:center;background:#CCCCCC'><span style=
15438 'font-size:10.0pt'>m:</span><span class=
15439 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15440 <p class="TextFontCX"><span class="Flag"><span style=
15441 'font-size:10.0pt'>ifblock</span></span></p>
15442 <p class="IndentText">The body of an <span class=
15443 "CodeText"><span style='font-size: 10.0pt'>if</span></span>
15444 statement is not a block.</p>
15445 <p class="Heading10">Suspicious Statements <span class=
15446 "TextFontCXChar"><span style=
15447 'font-size:11.0pt; font-weight:normal'>(Section
15448 8.4)</span></span></p>
15450 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15451 height="14" align="left">
15453 <td valign="top" align="left" height="14" style=
15454 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15455 <p class="TextFontCX" align="center" style=
15456 'text-align:center;background:#CCCCCC'><span style=
15457 'font-size:10.0pt'>m:</span><span class=
15458 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15459 <p class="TextFontCX"><span class="Flag"><span style=
15460 'font-size:10.0pt'>unreachable</span></span></p>
15461 <p class="IndentText">Code is not reached on any possible
15464 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15465 height="14" align="left">
15467 <td valign="top" align="left" height="14" style=
15468 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15469 <p class="TextFontCX" align="center" style=
15470 'text-align:center;background:#CCCCCC'><span style=
15471 'font-size:10.0pt'>m:</span><span class=
15472 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15473 <p class="TextFontCX"><span class="Flag"><span style=
15474 'font-size:10.0pt'>noeffect</span></span></p>
15475 <p class="IndentText">Statement has no effect.</p>
15477 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15478 height="14" align="left">
15480 <td valign="top" align="left" height="14" style=
15481 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15482 <p class="TextFontCX" align="center" style=
15483 'text-align:center;background:#CCCCCC'><span style=
15484 'font-size:10.0pt'>m:</span><span class=
15485 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15486 <p class="TextFontCX"><span class="Flag"><span style=
15487 'font-size:10.0pt'>noeffect-uncon</span></span></p>
15488 <p class="IndentText">Statement involving call to unconstrained
15489 function may have no effect.</p>
15491 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15492 height="14" align="left">
15494 <td valign="top" align="left" height="14" style=
15495 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15496 <p class="TextFontCX" align="center" style=
15497 'text-align:center;background:#CCCCCC'><span style=
15498 'font-size:10.0pt'>m:</span><span class=
15499 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15500 <p class="TextFontCX"><span class="Flag"><span style=
15501 'font-size:10.0pt'>noret</span></span></p>
15502 <p class="IndentText">There is a path with no <span class=
15503 "Keyword"><span style='font-size:10.0pt'>return</span></span> in a
15504 function declared to return a non-<span class=
15505 "Keyword"><span style='font-size:10.0pt'>void</span></span>
15507 <p class="Heading10">Ignored Return Values <span class=
15508 "TextFontCXChar"><span style=
15509 'font-size:11.0pt; font-weight:normal'>(Section</span></span>
15510 <span class="TextFontCXChar"><span style=
15511 'font-size:11.0pt; font-weight:normal'>8.4.2</span></span><span class="TextFontCXChar">
15513 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
15514 <p class="beforelist">These flags control when errors are reported
15515 for function calls that do not use the return value. Casting
15516 the function call to <span class="CodeText"><span style=
15517 'font-size:10.0pt'>void</span></span> or declaring the called
15518 function to return <span class="Annot"><span style=
15519 'font-size:10.0pt'>/*@alt void@*/</span></span>.</p>
15521 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15522 height="14" align="left">
15524 <td valign="top" align="left" height="14" style=
15525 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15526 <p class="TextFontCX" align="center" style=
15527 'text-align:center;background:#CCCCCC'><span style=
15528 'font-size:10.0pt'>m:</span><span class=
15529 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15530 <p class="TextFontCX"><span class="Flag"><span style=
15531 'font-size:10.0pt'>ret-val-bool</span></span></p>
15532 <p class="IndentText">Return value of type <span class=
15533 "CodeText"><span style='font-size:10.0pt'>bool</span></span>
15536 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15537 height="14" align="left">
15539 <td valign="top" align="left" height="14" style=
15540 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15541 <p class="TextFontCX" align="center" style=
15542 'text-align:center;background:#CCCCCC'><span style=
15543 'font-size:10.0pt'>m:</span><span class=
15544 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15545 <p class="TextFontCX"><span class="Flag"><span style=
15546 'font-size:10.0pt'>ret-val-int</span></span></p>
15547 <p class="IndentText">Return value of type <span class=
15548 "CodeText"><span style='font-size:10.0pt'>int</span></span>
15551 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15552 height="14" align="left">
15554 <td valign="top" align="left" height="14" style=
15555 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15556 <p class="TextFontCX" align="center" style=
15557 'text-align:center;background:#CCCCCC'><span style=
15558 'font-size:10.0pt'>m:</span><span class=
15559 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
15560 <p class="TextFontCX"><span class="Flag"><span style=
15561 'font-size:10.0pt'>ret-val-other</span></span></p>
15562 <p class="IndentText">Return value of type other than
15563 <span class="CodeText"><span style=
15564 'font-size:10.0pt'>bool</span></span> or <span class=
15565 "CodeText"><span style='font-size:10.0pt'>int</span></span>
15568 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15569 height="14" align="left">
15571 <td valign="top" align="left" height="14" style=
15572 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15573 <p class="TextFontCX" align="center" style=
15574 'text-align:center;background:#CCCCCC'><span style=
15575 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
15576 <p class="TextFontCX"><span class="Flag"><span style=
15577 'font-size:10.0pt'>ret-val</span></span></p>
15578 <p class="IndentText">Return value ignored (Sets <span class=
15579 "Flag"><span style='font-size:10.0pt'>retvalbool</span></span>,
15580 <span class="Flag"><span style=
15581 'font-size:10.0pt'>retvalint</span></span>, <span class=
15582 "Flag"><span style=
15583 'font-size:10.0pt'>retvalother</span></span>.)</p>
15585 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
15586 Memory Bounds <span class="HeadingNote"><span style=
15587 'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
15588 <span class="HeadingNote"><span style=
15589 'font-size:10.5pt;font-weight:normal;font-style: normal'>9</span></span>)
15592 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15593 height="14" align="left">
15595 <td valign="top" align="left" height="14" style=
15596 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15597 <p class="TextFontCX" align="center" style=
15598 'text-align:center;background:#CCCCCC'><span style=
15599 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
15600 <p class="TextFontCX"><span class="Flag"><span style=
15601 'font-size:10.0pt'>bounds</span></span></p>
15602 <p class="IndentText">
15603 Memory read or write may be out of bounds of allocated storage
15605 "Flag"><span style='font-size:10.0pt'>boundsread</span></span>
15607 <span class="Flag"><span style=
15608 'font-size:10.0pt'>boundswrite</span></span>
15612 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15613 height="14" align="left">
15615 <td valign="top" align="left" height="14" style=
15616 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15617 <p class="TextFontCX" align="center" style=
15618 'text-align:center;background:#CCCCCC'><span style=
15619 'font-size:10.0pt'>m:</span><span class=
15620 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
15621 <p class="TextFontCX"><span class="Flag"><span style=
15622 'font-size:10.0pt'>boundsread</span></span></p>
15623 <p class="IndentText">
15624 A memory read references memory beyond the allocated storage
15625 (also sets <span class=
15626 "Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>.
15630 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15631 height="14" align="left">
15633 <td valign="top" align="left" height="14" style=
15634 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15635 <p class="TextFontCX" align="center" style=
15636 'text-align:center;background:#CCCCCC'><span style=
15637 'font-size:10.0pt'>m:</span><span class=
15638 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
15639 <p class="TextFontCX"><span class="Flag"><span style=
15640 'font-size:10.0pt'>boundswrite</span></span></p>
15641 <p class="IndentText">
15642 A memory write may write to an address beyond the allocated buffer
15643 (also sets <span class=
15644 "Flag"><span style='font-size:10.0pt'>likelyboundswrite</span></span>.
15648 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15649 height="14" align="left">
15651 <td valign="top" align="left" height="14" style=
15652 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15653 <p class="TextFontCX" align="center" style=
15654 'text-align:center;background:#CCCCCC'><span style=
15655 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
15656 <p class="TextFontCX"><span class="Flag"><span style=
15657 'font-size:10.0pt'>likelybounds</span></span></p>
15658 <p class="IndentText">
15659 Likely memory read or write is likely to be out of bounds of allocated storage
15661 "Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>
15663 <span class="Flag"><span style=
15664 'font-size:10.0pt'>likelyboundswrite)</span></span>
15669 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15670 height="14" align="left">
15672 <td valign="top" align="left" height="14" style=
15673 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15674 <p class="TextFontCX" align="center" style=
15675 'text-align:center;background:#CCCCCC'><span style=
15676 'font-size:10.0pt'>m:</span><span class=
15677 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
15678 <p class="TextFontCX"><span class="Flag"><span style=
15679 'font-size:10.0pt'>likelyboundsread</span></span></p>
15680 <p class="IndentText">
15681 A likely memory read references memory beyond the allocated storage
15682 (also sets <span class=
15683 "Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>.
15687 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15688 height="14" align="left">
15690 <td valign="top" align="left" height="14" style=
15691 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15692 <p class="TextFontCX" align="center" style=
15693 'text-align:center;background:#CCCCCC'><span style=
15694 'font-size:10.0pt'>m:</span><span class=
15695 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
15696 <p class="TextFontCX"><span class="Flag"><span style=
15697 'font-size:10.0pt'>likelyboundswrite</span></span></p>
15698 <p class="IndentText">
15699 A memory write is likely to write to an address beyond the allocated buffer.
15703 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15704 height="14" align="left">
15706 <td valign="top" align="left" height="14" style=
15707 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15708 <p class="TextFontCX" align="center" style=
15709 'text-align:center;background:#CCCCCC'><span style=
15710 'font-size:10.0pt'>m:</span><span class=
15711 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
15712 <p class="TextFontCX"><span class="Flag">fcnpost<span style=
15713 'font-size:10.0pt'></span></span></p>
15714 <p class="IndentText">
15715 Display function post conditions.
15720 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15721 height="14" align="left">
15723 <td valign="top" align="left" height="14" style=
15724 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15725 <p class="TextFontCX" align="center" style=
15726 'text-align:center;background:#CCCCCC'><span style=
15727 'font-size:10.0pt'>m:</span><span class=
15728 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
15729 <p class="TextFontCX"><span class="Flag">redundantconstraints<span style=
15730 'font-size:10.0pt'></span></span></p>
15731 <p class="IndentText">
15732 Display seemingly redundant conditions.
15735 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15736 height="14" align="left">
15738 <td valign="top" align="left" height="14" style=
15739 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15740 <p class="TextFontCX" align="center" style=
15741 'text-align:center;background:#CCCCCC'><span style=
15742 'font-size:10.0pt'>m:</span><span class=
15743 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
15744 <p class="TextFontCX"><span class="Flag">checkpost<span style=
15745 'font-size:10.0pt'></span></span></p>
15746 <p class="IndentText">
15747 The functions implementation may not satidfy a post condition given in an ensures clause.
15752 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15753 height="14" align="left">
15755 <td valign="top" align="left" height="14" style=
15756 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15757 <p class="TextFontCX" align="center" style=
15758 'text-align:center;background:#CCCCCC'><span style=
15759 'font-size:10.0pt'>P-</span><span class=
15760 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
15761 <p class="TextFontCX"><span class="Flag">showconstraintparens<span style=
15762 'font-size:10.0pt'></span></span></p>
15763 <p class="IndentText">
15764 Display parentheses around constraint terms.
15767 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15768 height="14" align="left">
15770 <td valign="top" align="left" height="14" style=
15771 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15772 <p class="TextFontCX" align="center" style=
15773 'text-align:center;background:#CCCCCC'><span style=
15774 'font-size:10.0pt'>P+</span><span class=
15775 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
15776 <p class="TextFontCX"><span class="Flag">showconstraintlocation<span style=
15777 'font-size:10.0pt'></span></span></p>
15778 <p class="IndentText">
15779 Display location for every constraint generated.
15782 <p class="beforelist">
15783 The following flags are mainly of interest to Splint developers. The default values are adequate in normal use. They are included for completeness.
15787 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15788 height="14" align="left">
15790 <td valign="top" align="left" height="14" style=
15791 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15792 <p class="TextFontCX" align="center" style=
15793 'text-align:center;background:#CCCCCC'><span style=
15794 'font-size:10.0pt'>P-</span><span class=
15795 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
15796 <p class="TextFontCX"><span class="Flag">
15798 <span style='font-size:10.0pt'></span></span></p>
15799 <p class="IndentText">
15800 Perform buffer overflow checking even if the errors would be inhibited.
15806 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15807 height="14" align="left">
15809 <td valign="top" align="left" height="14" style=
15810 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15811 <p class="TextFontCX" align="center" style=
15812 'text-align:center;background:#CCCCCC'><span style=
15813 'font-size:10.0pt'>P-</span><span class=
15814 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
15815 <p class="TextFontCX"><span class="Flag">
15817 <span style='font-size:10.0pt'></span></span></p>
15818 <p class="IndentText">
15819 Generate implicit constraints for functions. This is an experimental option.
15820 Currently this option reduces the number of bounds errors but causes real error to be missed.
15825 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15826 height="14" align="left">
15828 <td valign="top" align="left" height="14" style=
15829 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15830 <p class="TextFontCX" align="center" style=
15831 'text-align:center;background:#CCCCCC'><span style=
15832 'font-size:10.0pt'>P-</span><span class=
15833 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
15834 <p class="TextFontCX"><span class="Flag">
15836 <span style='font-size:10.0pt'></span></span></p>
15837 <p class="IndentText">
15838 This flags affects the internal constraint resolution.  If set, the internal constraint resolution is more accurate.  The performance impact is minimal so there is little reason not to have this flag set.</p>
15840 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
15841 Extensible Checking <span class="HeadingNote"><span style=
15842 'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
15843 <span class="HeadingNote"><span style=
15844 'font-size:10.5pt;font-weight:normal;font-style: normal'>13</span></span><span class="HeadingNote">
15846 'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
15850 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15851 height="14" align="left">
15853 <td valign="top" align="left" height="14" style=
15854 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15855 <p class="TextFontCX" align="center" style=
15856 'text-align:center;background:#CCCCCC'><span style=
15857 'font-size:10.0pt'>P-</span><span class=
15858 "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
15859 <p class="TextFontCX"><span class="Flag">
15861 <span style='font-size:10.0pt'></span></span></p>
15862 <p class="IndentText">
15863 Load meta state declaration and corresponding xh file.
15868 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15869 height="14" align="left">
15871 <td valign="top" align="left" height="14" style=
15872 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15873 <p class="TextFontCX" align="center" style=
15874 'text-align:center;background:#CCCCCC'><span style=
15875 'font-size:10.0pt'>m:</span><span class=
15876 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
15877 <p class="TextFontCX"><span class="Flag">
15879 <span style='font-size:10.0pt'></span></span></p>
15880 <p class="IndentText">
15881 Transfer violates user-defined state rules.
15886 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15887 height="14" align="left">
15889 <td valign="top" align="left" height="14" style=
15890 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15891 <p class="TextFontCX" align="center" style=
15892 'text-align:center;background:#CCCCCC'><span style=
15893 'font-size:10.0pt'>m:</span><span class=
15894 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
15895 <p class="TextFontCX"><span class="Flag">
15897 <span style='font-size:10.0pt'></span></span></p>
15898 <p class="IndentText">
15899 Control path merge violates user-defined state merge rules.
15902 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
15903 Completeness <span class="HeadingNote"><span style=
15904 'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
15905 <span class="HeadingNote"><span style=
15906 'font-size:10.5pt;font-weight:normal;font-style: normal'>13</span></span><span class="HeadingNote">
15908 'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
15909 <p class="Heading10">Unused Declarations <span class=
15910 "HeadingNote"><span style=
15911 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
15912 <span class="HeadingNote"><span style=
15913 'font-size:10.5pt;font-weight:normal;font-style: normal'>13.1</span></span><span class="HeadingNote">
15915 'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
15916 <p class="beforelist">These flags control when errors are reported
15917 for declarations that are never used. The <span class=
15918 "Annot"><span style='font-size:10.0pt'>unused</span></span>
15919 annotation can be used to prevent unused errors from being report
15920 for a particular declaration.</p>
15922 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15923 height="14" align="left">
15925 <td valign="top" align="left" height="14" style=
15926 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15927 <p class="TextFontCX" align="center" style=
15928 'text-align:center;background:#CCCCCC'><span style=
15929 'font-size:10.0pt'>m:</span><span class=
15930 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
15931 <p class="TextFontCX"><span class="Flag"><span style=
15932 'font-size:10.0pt'>top-use</span></span></p>
15933 <p class="IndentText">An external declaration is not used in any
15936 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15937 height="14" align="left">
15939 <td valign="top" align="left" height="14" style=
15940 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15941 <p class="TextFontCX" align="center" style=
15942 'text-align:center;background:#CCCCCC'><span style=
15943 'font-size:10.0pt'>m:</span><span class=
15944 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15945 <p class="TextFontCX"><span class="Flag"><span style=
15946 'font-size:10.0pt'>const-use</span></span></p>
15947 <p class="IndentText">Constant never used.</p>
15949 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15950 height="14" align="left">
15952 <td valign="top" align="left" height="14" style=
15953 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15954 <p class="TextFontCX" align="center" style=
15955 'text-align:center;background:#CCCCCC'><span style=
15956 'font-size:10.0pt'>m:</span><span class=
15957 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15958 <p class="TextFontCX"><span class="Flag"><span style=
15959 'font-size:10.0pt'>enum-mem-use</span></span></p>
15960 <p class="IndentText">Member of enumerator never used.</p>
15962 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15963 height="14" align="left">
15965 <td valign="top" align="left" height="14" style=
15966 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15967 <p class="TextFontCX" align="center" style=
15968 'text-align:center;background:#CCCCCC'><span style=
15969 'font-size:10.0pt'>m:</span><span class=
15970 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
15971 <p class="TextFontCX"><span class="Flag"><span style=
15972 'font-size:10.0pt'>var-use</span></span></p>
15973 <p class="IndentText">Variable never used.</p>
15975 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15976 height="14" align="left">
15978 <td valign="top" align="left" height="14" style=
15979 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15980 <p class="TextFontCX" align="center" style=
15981 'text-align:center;background:#CCCCCC'><span style=
15982 'font-size:10.0pt'>m:</span><span class=
15983 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
15984 <p class="TextFontCX"><span class="Flag"><span style=
15985 'font-size:10.0pt'>param-use</span></span></p>
15986 <p class="IndentText">Function parameter never used.</p>
15988 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
15989 height="14" align="left">
15991 <td valign="top" align="left" height="14" style=
15992 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
15993 <p class="TextFontCX" align="center" style=
15994 'text-align:center;background:#CCCCCC'><span style=
15995 'font-size:10.0pt'>m:</span><span class=
15996 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
15997 <p class="TextFontCX"><span class="Flag"><span style=
15998 'font-size:10.0pt'>fcn-use</span></span></p>
15999 <p class="IndentText">Function is never used.</p>
16001 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16002 height="14" align="left">
16004 <td valign="top" align="left" height="14" style=
16005 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16006 <p class="TextFontCX" align="center" style=
16007 'text-align:center;background:#CCCCCC'><span style=
16008 'font-size:10.0pt'>m:</span><span class=
16009 "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
16010 <p class="TextFontCX"><span class="Flag"><span style=
16011 'font-size:10.0pt'>type-use</span></span></p>
16012 <p class="IndentText">Defined type never used.</p>
16014 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16015 height="14" align="left">
16017 <td valign="top" align="left" height="14" style=
16018 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16019 <p class="TextFontCX" align="center" style=
16020 'text-align:center;background:#CCCCCC'><span style=
16021 'font-size:10.0pt'>m:</span><span class=
16022 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
16023 <p class="TextFontCX"><span class="Flag"><span style=
16024 'font-size:10.0pt'>field-use</span></span></p>
16025 <p class="IndentText">Field of structure or union type is never
16028 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16029 height="14" align="left">
16031 <td valign="top" align="left" height="14" style=
16032 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16033 <p class="TextFontCX" align="center" style=
16034 'text-align:center;background:#CCCCCC'><span style=
16035 'font-size:10.0pt'>m:</span><span class=
16036 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
16037 <p class="TextFontCX"><span class="Flag"><span style=
16038 'font-size:10.0pt'>unused-special</span></span></p>
16039 <p class="IndentText">Declaration in a special file (corresponding
16040 to <span class="ProgramNameChar">.l</span> or <span class=
16041 "ProgramNameChar">.y</span> file) is unused.</p>
16042 <p class="Heading10">Complete Programs <span class=
16043 "TextFontCXChar"><span style=
16044 'font-size:11.0pt; font-weight:normal'>(Section
16045 13.2)</span></span></p>
16047 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16048 height="14" align="left">
16050 <td valign="top" align="left" height="14" style=
16051 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16052 <p class="TextFontCX" align="center" style=
16053 'text-align:center;background:#CCCCCC'><span style=
16054 'font-size:10.0pt'>m:</span><span class=
16055 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
16056 <p class="TextFontCX"><span class="Flag"><span style=
16057 'font-size:10.0pt'>decl-undef</span></span></p>
16058 <p class="IndentText">Function, variable, iterator or constant
16059 declared but never defined.</p>
16061 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16062 height="14" align="left">
16064 <td valign="top" align="left" height="14" style=
16065 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16066 <p class="TextFontCX" align="center" style=
16067 'text-align:center;background:#CCCCCC'><span style=
16068 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
16069 <p class="TextFontCX"><span class="Flag"><span style=
16070 'font-size:10.0pt'>partial</span></span></p>
16071 <p class="IndentText">Check as partial system (sets
16072 <span class="Flag"><span style=
16073 'font-size:10.0pt'>-decl-undef</span></span>, <span class=
16074 "Flag"><span style=
16075 'font-size:10.0pt'>-export-local</span></span> and
16076 prevents checking of macros in headers without corresponding
16077 <span class="ProgramNameChar">.c</span> files.)</p>
16078 <p class="Heading10">Exports</p>
16080 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16081 height="14" align="left">
16083 <td valign="top" align="left" height="14" style=
16084 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16085 <p class="TextFontCX" align="center" style=
16086 'text-align:center;background:#CCCCCC'><span style=
16087 'font-size:10.0pt'>m:</span><span class=
16088 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
16089 <p class="TextFontCX"><span class="Flag"><span style=
16090 'font-size:10.0pt'>export-local</span></span></p>
16091 <p class="IndentText">A declaration is exported but not used
16092 outside this module. (Declaration can use the
16093 <span class="CodeText"><span style=
16094 'font-size: 10.0pt'>static</span></span> qualifier.)</p>
16096 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16097 height="14" align="left">
16099 <td valign="top" align="left" height="14" style=
16100 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16101 <p class="TextFontCX" align="center" style=
16102 'text-align:center;background:#CCCCCC'><span style=
16103 'font-size:10.0pt'>m:</span><span class=
16104 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
16105 <p class="TextFontCX"><span class="Flag"><span style=
16106 'font-size:10.0pt'>export-header</span></span></p>
16107 <p class="IndentText">A declaration (other than a variable) is
16108 exported but does not appear in a header file.</p>
16110 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16111 height="14" align="left">
16113 <td valign="top" align="left" height="14" style=
16114 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16115 <p class="TextFontCX" align="center" style=
16116 'text-align:center;background:#CCCCCC'><span style=
16117 'font-size:10.0pt'>m:</span><span class=
16118 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
16119 <p class="TextFontCX"><span class="Flag"><span style=
16120 'font-size:10.0pt'>export-header-var</span></span></p>
16121 <p class="IndentText">A variable declaration is exported but does
16122 not appear in a header file.</p>
16123 <p class="Heading10">Unrecognized Identifiers</p>
16125 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16126 height="14" align="left">
16128 <td valign="top" align="left" height="14" style=
16129 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16130 <p class="TextFontCX" align="center" style=
16131 'text-align:center;background:#CCCCCC'><span style=
16132 'font-size:10.0pt'>P:</span> <span class=
16133 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16134 <p class="TextFontCX"><span class="Flag"><span style=
16135 'font-size:10.0pt'>unrecog</span></span></p>
16136 <p class="IndentText">An unrecognized identifier is used.</p>
16138 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16139 height="14" align="left">
16141 <td valign="top" align="left" height="14" style=
16142 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16143 <p class="TextFontCX" align="center" style=
16144 'text-align:center;background:#CCCCCC'><span style=
16145 'font-size:10.0pt'>P:</span> <span class=
16146 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16147 <p class="TextFontCX"><span class="Flag"><span style=
16148 'font-size:10.0pt'>sys-unrecog</span></span></p>
16149 <p class="IndentText">Report unrecognized identifiers that start
16150 with the system prefix, <span class="Keyword"><span style=
16151 'font-size:10.0pt'>__</span></span> (two underscores).</p>
16153 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16154 height="14" align="left">
16156 <td valign="top" align="left" height="14" style=
16157 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16158 <p class="TextFontCX" align="center" style=
16159 'text-align:center;background:#CCCCCC'><span style=
16160 'font-size:10.0pt'>P:</span> <span class=
16161 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16162 <p class="TextFontCX"><span class="Flag"><span style=
16163 'font-size:10.0pt'>repeat-unrecog</span></span></p>
16164 <p class="IndentText">Report multiple messages for unrecognized
16165 identifiers. If <span class="Flag"><span style=
16166 'font-size:10.0pt'>repeatunrecog</span></span> is not set, an error
16167 is reported only the first time a particular unrecognized
16168 identifier appears in the file.</p>
16169 <p class="Heading10">Multiple Definition and Declarations</p>
16171 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16172 height="14" align="left">
16174 <td valign="top" align="left" height="14" style=
16175 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16176 <p class="TextFontCX" align="center" style=
16177 'text-align:center;background:#CCCCCC'><span style=
16178 'font-size:10.0pt'>P:</span> <span class=
16179 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16180 <p class="TextFontCX"><span class="Flag"><span style=
16181 'font-size:10.0pt'>redef</span></span></p>
16182 <p class="IndentText">A function or variable is defined more than
16185 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16186 height="14" align="left">
16188 <td valign="top" align="left" height="14" style=
16189 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16190 <p class="TextFontCX" align="center" style=
16191 'text-align:center;background:#CCCCCC'><span style=
16192 'font-size:10.0pt'>m:</span><span class=
16193 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
16194 <p class="TextFontCX"><span class="Flag"><span style=
16195 'font-size:10.0pt'>redecl</span></span></p>
16196 <p class="IndentText">An identifier is declared more than once.</p>
16198 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16199 height="14" align="left">
16201 <td valign="top" align="left" height="14" style=
16202 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16203 <p class="TextFontCX" align="center" style=
16204 'text-align:center;background:#CCCCCC'><span style=
16205 'font-size:10.0pt'>m:</span><span class=
16206 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
16207 <p class="TextFontCX"><span class="Flag"><span style=
16208 'font-size:10.0pt'>nested-extern</span></span></p>
16209 <p class="IndentText">An <span class="Keyword"><span style=
16210 'font-size:10.0pt'>extern</span></span> declaration is used inside
16211 a function body.</p>
16212 <p class="Heading10">ISO Conformance</p>
16214 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16215 height="14" align="left">
16217 <td valign="top" align="left" height="14" style=
16218 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16219 <p class="TextFontCX" align="center" style=
16220 'text-align:center;background:#CCCCCC'><span style=
16221 'font-size:10.0pt'>m:</span><span class=
16222 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
16223 <p class="TextFontCX"><span class="Flag"><span style=
16224 'font-size:10.0pt'>noparams</span></span></p>
16225 <p class="IndentText">A function is declared without a parameter
16226 list prototype.</p>
16228 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16229 height="14" align="left">
16231 <td valign="top" align="left" height="14" style=
16232 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16233 <p class="TextFontCX" align="center" style=
16234 'text-align:center;background:#CCCCCC'><span style=
16235 'font-size:10.0pt'>m:</span><span class=
16236 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
16237 <p class="TextFontCX"><span class="Flag"><span style=
16238 'font-size:10.0pt'>old-style</span></span></p>
16239 <p class="IndentText">Function definition is in old style
16240 syntax. Standard prototype syntax is preferred.</p>
16242 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16243 height="14" align="left">
16245 <td valign="top" align="left" height="14" style=
16246 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16247 <p class="TextFontCX" align="center" style=
16248 'text-align:center;background:#CCCCCC'><span style=
16249 'font-size:10.0pt'>m:</span><span class=
16250 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
16251 <p class="TextFontCX"><span class="Flag"><span style=
16252 'font-size:10.0pt'>exit-arg</span></span></p>
16253 <p class="IndentText">Argument to <span class=
16254 "CodeText"><span style=
16255 'font-size: 10.0pt'>exit</span></span> has implementation
16256 defined behavior. The only valid arguments to
16257 <span class="CodeText"><span style=
16258 'font-size:10.0pt'>exit</span></span> are <span class=
16259 "CodeText"><span style=
16260 'font-size:10.0pt'>EXIT_SUCCESS</span></span>, <span class=
16261 "CodeText"><span style=
16262 'font-size:10.0pt'>EXIT_FAILURE</span></span> and
16263 <span class="CodeText"><span style=
16264 'font-size:10.0pt'>0</span></span>. An error is
16265 reported if Splint can determine statically that the argument
16266 to <span class="CodeText"><span style=
16267 'font-size:10.0pt'>exit</span></span> is not one of
16270 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16271 height="14" align="left">
16273 <td valign="top" align="left" height="14" style=
16274 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16275 <p class="TextFontCX" align="center" style=
16276 'text-align:center;background:#CCCCCC'><span style=
16277 'font-size:10.0pt'>P:</span> <span class=
16278 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16279 <p class="TextFontCX"><span class="Flag"><span style=
16280 'font-size:10.0pt'>use-varargs</span></span></p>
16281 <p class="IndentText">Report if <span class=
16282 "CodeText"><span style='font-size:10.0pt'><varargs.h></span></span>
16283 is used (should use <span class=
16284 "ProgramNameChar"><span style='font-size:10.0pt'>stdarg.h</span></span>).</p>
16285 <p class="Heading10">Limits</p>
16286 <p class="beforelist">The ANSI Standard includes limits on minimum
16287 numbers that a conforming compiler must support. Whether of
16288 not a particular compiler exceeds these limits, it is worth
16289 checking that a program does not exceed them so that other
16290 compilers may safely compile it. In addition, exceeding a
16291 limit may indicate a problem in the code (e.g., it is too complex
16292 if the control nest depth limit is exceeded) that should be fixed
16293 regardless of the compiler. Splint checks the following
16294 limits. For each limit, the maximum value may be set from the
16295 command line (or locally using a stylized comment). The
16296 minimum limits were increased for the ISO C99 specification.
16297 If the <span class="Flag"><span style=
16298 'font-size:10.0pt'>iso99-limits</span></span> flag is used, all
16299 limits are checked with the minimum values of an ISO C99 conforming
16300 compiler. If the <span class="Flag"><span style=
16301 'font-size:10.0pt'>ansi89-limits</span></span> flag is used, all
16302 limits are checked with the minimum values of an ANSI C89
16303 conforming compiler.</p>
16305 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16306 height="14" align="left">
16308 <td valign="top" align="left" height="14" style=
16309 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16310 <p class="TextFontCX" align="center" style=
16311 'text-align:center;background:#CCCCCC'><span style=
16312 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
16313 <p class="TextFontCX"><span class="Flag"><span style=
16314 'font-size:10.0pt'>ansi89-limits</span></span></p>
16315 <p class="IndentText">Check for violations of minimum limits
16316 prescribed by ANSI C89 standard (sets <span class=
16317 "Flag"><span style=
16318 'font-size:10.0pt'>control-nest-depth</span></span>,
16319 <span class="Flag"><span style=
16320 'font-size:10.0pt'>string-literal-len</span></span>,
16321 <span class="Flag"><span style=
16322 'font-size:10.0pt'>include-nest</span></span>, <span class=
16323 "Flag"><span style=
16324 'font-size:10.0pt'>num-struct-fields</span></span>, and
16325 <span class="Flag"><span style=
16326 'font-size:10.0pt'>num-enum-members</span></span>).</p>
16328 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16329 height="14" align="left">
16331 <td valign="top" align="left" height="14" style=
16332 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16333 <p class="TextFontCX" align="center" style=
16334 'text-align:center;background:#CCCCCC'><span style=
16335 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
16336 <p class="TextFontCX"><span class="Flag"><span style=
16337 'font-size:10.0pt'>iso99-limits</span></span></p>
16338 <p class="IndentText">Check for violations of minimum limits
16339 prescribed by ISO C99 standard (sets <span class=
16340 "Flag"><span style=
16341 'font-size:10.0pt'>control-nest-depth</span></span>,
16342 <span class="Flag"><span style=
16343 'font-size:10.0pt'>string-literal-len</span></span>,
16344 <span class="Flag"><span style=
16345 'font-size:10.0pt'>include-nest</span></span>, <span class=
16346 "Flag"><span style=
16347 'font-size:10.0pt'>num-struct-fields</span></span>, and
16348 <span class="Flag"><span style=
16349 'font-size:10.0pt'>num-enum-members</span></span>).</p>
16352 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16353 height="14" align="left">
16355 <td valign="top" align="left" height="14" style=
16356 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16357 <p class="TextFontCX" align="center" style=
16358 'text-align:center;background:#CCCCCC'><span style=
16359 'font-size:10.0pt'>m:</span><span class=
16360 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
16361 <p class="TextFontCX"><span class="Flag"><span style=
16362 'font-size:10.0pt'>control-nest-depth</span></span><span class="Flag">
16364 'font-size:10.0pt'> <i><number></i></span></span></p>
16365 <p class="IndentText">Set maximum nesting depth of compound
16366 statements, iteration control structures, and selection control
16367 structures (ISO C99 minimum is 63; ANSI C89 minimum is 15).</p>
16369 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16370 height="14" align="left">
16372 <td valign="top" align="left" height="14" style=
16373 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16374 <p class="TextFontCX" align="center" style=
16375 'text-align:center;background:#CCCCCC'><span style=
16376 'font-size:10.0pt'>m:</span><span class=
16377 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
16378 <p class="TextFontCX"><span class="Flag"><span style=
16379 'font-size:10.0pt'>string-literal-len</span></span><span class="Flag">
16381 'font-size:10.0pt'> <i><number></i></span></span></p>
16382 <p class="IndentText">Set maximum length of string literals (ISO
16383 C99 minimum is 4095; ANSI C89 minimum is 509).</p>
16385 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16386 height="14" align="left">
16388 <td valign="top" align="left" height="14" style=
16389 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16390 <p class="TextFontCX" align="center" style=
16391 'text-align:center;background:#CCCCCC'><span style=
16392 'font-size:10.0pt'>m:</span><span class=
16393 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
16394 <p class="TextFontCX"><span class="Flag"><span style=
16395 'font-size:10.0pt'>num-struct-fields</span></span><span class="Flag">
16397 'font-size:10.0pt'> <i><number></i></span></span></p>
16398 <p class="IndentText">Set maximum number of fields in a
16399 <span class="CodeText"><span style=
16400 'font-size:10.0pt'>struct</span></span> or <span class=
16401 "CodeText"><span style='font-size:10.0pt'>union</span></span>
16402 (ISO C99 minimum is 1023; ANSI minimum is 127).</p>
16404 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16405 height="14" align="left">
16407 <td valign="top" align="left" height="14" style=
16408 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16409 <p class="TextFontCX" align="center" style=
16410 'text-align:center;background:#CCCCCC'><span style=
16411 'font-size:10.0pt'>m:</span><span class=
16412 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
16413 <p class="TextFontCX"><span class="Flag"><span style=
16414 'font-size:10.0pt'>num-enum-members</span></span><span class=
16415 "Flag"><span style=
16416 'font-size:10.0pt'> <i><number></i></span></span></p>
16417 <p class="IndentText">Set maximum number of members of an
16418 <span class="CodeText"><span style=
16419 'font-size:10.0pt'>enum</span></span> type (ISO C99 minimum is
16420 1023; ANSI minimum is 127).</p>
16422 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16423 height="14" align="left">
16425 <td valign="top" align="left" height="14" style=
16426 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16427 <p class="TextFontCX" align="center" style=
16428 'text-align:center;background:#CCCCCC'><span style=
16429 'font-size:10.0pt'>m:</span><span class=
16430 "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
16431 <p class="TextFontCX"><span class="Flag"><span style=
16432 'font-size:10.0pt'>include-nest</span></span><span class=
16433 "Flag"><span style=
16434 'font-size:10.0pt'> <i><number></i></span></span></p>
16435 <p class="IndentText">Set maximum number of nested
16436 <span class="CodeText"><span style=
16437 'font-size:10.0pt'>#include</span></span> files (ISO C99
16438 minimum is 63; ANSI minimum is 8).</p>
16439 <p class="Heading10">Header Inclusion <a name=
16440 "_Ref344793948"><span class="TextFontCXChar"><span style=
16441 'font-size:11.0pt; font-weight:normal'>(Section</span></span></a>
16442 <span class="TextFontCXChar"><span style=
16443 'font-size:11.0pt; font-weight:normal'>14.3</span></span><span class="TextFontCXChar">
16445 'font-size:11.0pt; font-weight:normal'>)</span></span></p>
16447 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16448 height="14" align="left">
16450 <td valign="top" align="left" height="14" style=
16451 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16452 <p class="TextFontCX" align="center" style=
16453 'text-align:center;background:#CCCCCC'><span style=
16454 'font-size:10.0pt'>P:</span> <span class=
16455 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16456 <p class="TextFontCX"><span class="Flag"><span style=
16457 'font-size:10.0pt'>skip-ansi-headers</span></span></p>
16458 <p class="IndentText">Prevent inclusion of header files in a system
16459 directory with names that match standard ANSI headers. The
16460 symbolic information in the standard library is used instead.
16461 Flag in effect only if a library that includes the standard library is
16462 used. The ANSI headers are: <span class=
16463 "CodeText"><span style='font-size:10.0pt'>assert</span></span>,
16465 "CodeText"><span style='font-size:10.0pt'>ctype</span></span>,
16466 <span class="CodeText"><span style=
16467 'font-size:10.0pt'>errno</span></span>,
16468 <span class="CodeText"><span style=
16469 'font-size:10.0pt'>float</span></span>,
16471 "CodeText"><span style='font-size:10.0pt'>limits</span></span>,
16472 <span class="CodeText"><span style=
16473 'font-size:10.0pt'>locale</span></span>, <span class=
16474 "CodeText"><span style='font-size:10.0pt'>math</span></span>,
16475 <span class="CodeText"><span style=
16476 'font-size:10.0pt'>setjmp</span></span>, <span class=
16477 "CodeText"><span style='font-size:10.0pt'>signal</span></span>,
16478 <span class="CodeText"><span style=
16479 'font-size:10.0pt'>stdarg</span></span>,
16480 <span class="CodeText"><span style=
16481 'font-size:10.0pt'>stddef</span></span>, <span class=
16482 "CodeText"><span style='font-size:10.0pt'>stdio</span></span>,
16483 <span class="CodeText"><span style=
16484 'font-size:10.0pt'>stdlib</span></span>,
16486 "CodeText"><span style='font-size:10.0pt'>strings</span></span>,
16488 "CodeText"><span style='font-size:10.0pt'>string</span></span>,
16490 "CodeText"><span style='font-size:10.0pt'>time</span></span>,
16491 and <span class="CodeText"><span style=
16492 'font-size:10.0pt'>wchar</span></span>.
16496 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16497 height="14" align="left">
16499 <td valign="top" align="left" height="14" style=
16500 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16501 <p class="TextFontCX" align="center" style=
16502 'text-align:center;background:#CCCCCC'><span style=
16503 'font-size:10.0pt'>P:</span> <span class=
16504 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16505 <p class="TextFontCX"><span class="Flag"><span style=
16506 'font-size:10.0pt'>skip-iso-headers</span></span></p>
16507 <p class="IndentText">Prevent inclusion of header files in a system
16508 directory with names that match standard ISO C99 headers. The
16509 symbolic information in the standard library is used instead.
16510 In effect only if a library that includes the standard library is
16511 used. The ISO C99 headers are: <span class=
16512 "CodeText"><span style='font-size:10.0pt'>assert</span></span>,
16513 <span class="CodeText"><span style=
16514 'font-size:10.0pt'>complex</span></span>, <span class=
16515 "CodeText"><span style='font-size:10.0pt'>ctype</span></span>,
16516 <span class="CodeText"><span style=
16517 'font-size:10.0pt'>errno</span></span>, <span class=
16518 "CodeText"><span style='font-size:10.0pt'>fenv</span></span>,
16519 <span class="CodeText"><span style=
16520 'font-size:10.0pt'>float</span></span>, <span class=
16521 "CodeText"><span style='font-size:10.0pt'>inttypes</span></span>,
16522 <span class="CodeText"><span style=
16523 'font-size:10.0pt'>iso646</span></span>, <span class=
16524 "CodeText"><span style='font-size:10.0pt'>limits</span></span>,
16525 <span class="CodeText"><span style=
16526 'font-size:10.0pt'>locale</span></span>, <span class=
16527 "CodeText"><span style='font-size:10.0pt'>math</span></span>,
16528 <span class="CodeText"><span style=
16529 'font-size:10.0pt'>setjmp</span></span>, <span class=
16530 "CodeText"><span style='font-size:10.0pt'>signal</span></span>,
16531 <span class="CodeText"><span style=
16532 'font-size:10.0pt'>stdarg</span></span>, <span class=
16533 "CodeText"><span style='font-size:10.0pt'>stdbool</span></span>,
16534 <span class="CodeText"><span style=
16535 'font-size:10.0pt'>stddef</span></span>, <span class=
16536 "CodeText"><span style='font-size:10.0pt'>stdio</span></span>,
16537 <span class="CodeText"><span style=
16538 'font-size:10.0pt'>stdlib</span></span>, <span class=
16539 "CodeText"><span style='font-size:10.0pt'>string</span></span>,
16540 <span class="CodeText"><span style=
16541 'font-size:10.0pt'>tgmath</span></span>, <span class=
16542 "CodeText"><span style='font-size:10.0pt'>time</span></span>,
16543 <span class="CodeText"><span style=
16544 'font-size:10.0pt'>wchar</span></span>, and <span class=
16545 "CodeText"><span style='font-size:10.0pt'>wctype</span></span>.</p>
16549 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16550 height="14" align="left">
16552 <td valign="top" align="left" height="14" style=
16553 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16554 <p class="TextFontCX" align="center" style=
16555 'text-align:center;background:#CCCCCC'><span style=
16556 'font-size:10.0pt'>P:</span> <span class=
16557 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16558 <p class="TextFontCX"><span class="Flag"><span style=
16559 'font-size:10.0pt'>skip-posix-headers</span></span></p>
16560 <p class="IndentText">Prevent inclusion of header files in a system
16561 directory with names that match standard POSIX headers. The
16562 symbolic information in the standard library is used instead.
16563 In effect only if a library that includes the POSIX library is
16564 used. The skipped POSIX headers are: <span class=
16565 "CodeText"><span style='font-size:10.0pt'>dirent</span></span>,
16566 <span class="CodeText"><span style=
16567 'font-size:10.0pt'>fcntl</span></span>, <span class=
16568 "CodeText"><span style='font-size:10.0pt'>grp</span></span>,
16569 <span class="CodeText"><span style=
16570 'font-size:10.0pt'>pwd</span></span>, <span class=
16571 "CodeText"><span style='font-size:10.0pt'>termios</span></span>,
16572 <span class="CodeText"><span style=
16573 'font-size:10.0pt'>sys/stat</span></span>, <span class=
16574 "CodeText"><span style='font-size:10.0pt'>sys/times</span></span>,
16575 <span class="CodeText"><span style=
16576 'font-size:10.0pt'>sys/types</span></span>, <span class=
16577 "CodeText"><span style=
16578 'font-size:10.0pt'>sys/utsname</span></span>, <span class=
16579 "CodeText"><span style='font-size:10.0pt'>sys/wait</span></span>,
16580 <span class="CodeText"><span style=
16581 'font-size:10.0pt'>unistd</span></span>, and <span class=
16582 "CodeText"><span style='font-size:10.0pt'>utime</span></span>.</p>
16585 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16586 height="14" align="left">
16588 <td valign="top" align="left" height="14" style=
16589 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16590 <p class="TextFontCX" align="center" style=
16591 'text-align:center;background:#CCCCCC'><span style=
16592 'font-size:10.0pt'>P:</span> <span class=
16593 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16594 <p class="TextFontCX"><span class="Flag"><span style=
16595 'font-size:10.0pt'>warn-posix-headers</span></span></p>
16596 <p class="IndentText">Report use of a POSIX header when checking a
16597 program with a non-POSIX library.</p>
16598 <p class="IndentText"> </p>
16601 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16602 height="14" align="left">
16604 <td valign="top" align="left" height="14" style=
16605 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16606 <p class="TextFontCX" align="center" style=
16607 'text-align:center;background:#CCCCCC'><span style=
16608 'font-size:10.0pt'>P:</span> <span class=
16609 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16610 <p class="TextFontCX"><span class="Flag"><span style=
16611 'font-size:10.0pt'>warn-unix-headers</span></span></p>
16612 <p class="IndentText">
16613 Warn the user that the unix library may not be compatible with all platforms.
16617 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16618 height="14" align="left">
16620 <td valign="top" align="left" height="14" style=
16621 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16622 <p class="TextFontCX" align="center" style=
16623 'text-align:center;background:#CCCCCC'><span style=
16624 'font-size:10.0pt'>P:</span> <span class=
16625 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16626 <p class="TextFontCX"><span class="Flag"><span style=
16627 'font-size:10.0pt'>skip-sys-headers</span></span></p>
16628 <p class="IndentText">Prevent inclusion of all header files in
16629 system directories.</p>
16631 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16632 height="14" align="left">
16634 <td valign="top" align="left" height="14" style=
16635 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16636 <p class="TextFontCX" align="center" style=
16637 'text-align:center;background:#CCCCCC'><span style=
16638 'font-size:10.0pt'>P:</span> <span class=
16639 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16640 <p class="TextFontCX"><span class="Flag"><span style=
16641 'font-size:10.0pt'>sys-dir-expand-macros</span></span></p>
16642 <p class="IndentText">Expand macros in system directories
16643 regardless of other settings, except for macros corresponding to
16644 names defined in a load library.</p>
16646 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16647 height="14" align="left">
16649 <td valign="top" align="left" height="14" style=
16650 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16651 <p class="TextFontCX" align="center" style=
16652 'text-align:center;background:#CCCCCC'><span style=
16653 'font-size:10.0pt'>m:</span><span class=
16654 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
16655 <p class="TextFontCX"><span class="Flag"><span style=
16656 'font-size:10.0pt'>sys-dir-errors</span></span></p>
16657 <p class="IndentText">Report errors in files in system directories
16658 (set by <span class="Flag"><span style=
16659 'font-size:10.0pt'>-sys-dirs</span></span>). </p>
16660 <p class="IndentText"><span class="HeadingNote"><span style=
16661 'font-size:10.5pt; font-style:normal'> </span></span></p>
16664 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16665 height="14" align="left">
16667 <td valign="top" align="left" height="14" style=
16668 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16669 <p class="TextFontCX" align="center" style=
16670 'text-align:center;background:#CCCCCC'><span style=
16671 'font-size:10.0pt'>P:</span><span class=
16672 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16673 <p class="TextFontCX"><span class="Flag"><span style=
16674 'font-size:10.0pt'>
16677 <p class="IndentText">
16678 Warn when a system file was listed as a command line file but Splint
16679 is not set to report errors for system files. This prevents accidentally missing warnings
16680 in system files when Splint is run in a system directory.
16684 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16685 height="14" align="left">
16687 <td valign="top" align="left" height="14" style=
16688 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16689 <p class="TextFontCX" align="center" style=
16690 'text-align:center;background:#CCCCCC'><span style=
16691 'font-size:10.0pt'>global:</span> <span class=
16692 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16693 <p class="TextFontCX"><span class="Flag"><span style=
16694 'font-size:10.0pt'>single-include</span></span></p>
16695 <p class="IndentText">Optimize header inclusion to only include
16696 each header file once.</p>
16698 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16699 height="14" align="left">
16701 <td valign="top" align="left" height="14" style=
16702 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16703 <p class="TextFontCX" align="center" style=
16704 'text-align:center;background:#CCCCCC'><span style=
16705 'font-size:10.0pt'>global:</span> <span class=
16706 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16707 <p class="TextFontCX"><span class="Flag"><span style=
16708 'font-size:10.0pt'>never-include</span></span></p>
16709 <p class="IndentText">Use library information instead of including
16713 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16714 height="14" align="left">
16716 <td valign="top" align="left" height="14" style=
16717 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16718 <p class="TextFontCX" align="center" style=
16719 'text-align:center;background:#CCCCCC'><span style=
16720 'font-size:10.0pt'>global:</span> <span class=
16721 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16722 <p class="TextFontCX"><span class="Flag"><span style=
16723 'font-size:10.0pt'>case-insensitive-filenames</span></span></p>
16724 <p class="IndentText">
16725 File names are case insensitive (file.h and FILE.H are the same file).
16730 <p class="Heading10">Comments</p>
16731 <p class="beforelist">These flags control how syntactic comments
16732 are interpreted.</p>
16734 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16735 height="14" align="left">
16737 <td valign="top" align="left" height="14" style=
16738 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16739 <p class="TextFontCX" align="center" style=
16740 'text-align:center;background:#CCCCCC'><span style=
16741 'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
16742 'font-size:10.0pt'>@</span></span></p></td></tr></table></div>
16743 <p class="TextFontCX"><span class="Flag"><span style=
16744 'font-size:10.0pt'>comment-char</span></span> <span class=
16745 "Flag"><i><span style=
16746 'font-size:10.0pt'><char></span></i></span></p>
16747 <p class="IndentText">Set the marker character for syntactic
16748 comments. Comments beginning with <span class=
16749 "CodeText"><span style=
16750 'font-size:10.0pt'>/*</span></span><span class=
16751 "Flag"><i><span style=
16752 'font-size:10.0pt'><char></span></i></span> are interpreted
16755 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16756 height="14" align="left">
16758 <td valign="top" align="left" height="14" style=
16759 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16760 <p class="TextFontCX" align="center" style=
16761 'text-align:center;background:#CCCCCC'><span style=
16762 'font-size:10.0pt'>P:</span> <span class=
16763 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16764 <p class="TextFontCX"><span class="Flag"><span style=
16765 'font-size:10.0pt'>noaccess</span></span></p>
16766 <p class="IndentText">Ignore access comments.</p>
16768 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16769 height="14" align="left">
16771 <td valign="top" align="left" height="14" style=
16772 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16773 <p class="TextFontCX" align="center" style=
16774 'text-align:center;background:#CCCCCC'><span style=
16775 'font-size:10.0pt'>P:</span> <span class=
16776 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16777 <p class="TextFontCX"><span class="Flag"><span style=
16778 'font-size:10.0pt'>nocomments</span></span></p>
16779 <p class="IndentText">Ignore all stylized comments.</p>
16781 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16782 height="14" align="left">
16784 <td valign="top" align="left" height="14" style=
16785 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16786 <p class="TextFontCX" align="center" style=
16787 'text-align:center;background:#CCCCCC'><span style=
16788 'font-size:10.0pt'>P:</span> <span class=
16789 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16790 <p class="TextFontCX"><span class="Flag"><span style=
16791 'font-size:10.0pt'>sup-counts</span></span></p>
16792 <p class="IndentText">Actual number of errors does not match number
16793 in <span class="Annot"><span style=
16794 'font-size:10.0pt'>/*@i</span></span><span class=
16795 "Annot"><span style=
16796 'font-size:10.0pt'><n>@*/</span></span></p>
16798 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16799 height="14" align="left">
16801 <td valign="top" align="left" height="14" style=
16802 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16803 <p class="TextFontCX" align="center" style=
16804 'text-align:center;background:#CCCCCC'><span style=
16805 'font-size:10.0pt'>P:</span> <span class=
16806 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16807 <p class="TextFontCX"><span class="Flag"><span style=
16808 'font-size:10.0pt'>lint-comments</span></span></p>
16809 <p class="IndentText">Interpret traditional lint comments
16810 (<span class="CodeText"><span style=
16811 'font-size:10.0pt'>/*FALLTHROUGH*/</span></span>,
16812 <span class="CodeText"><span style=
16813 'font-size:10.0pt'>/*NOTREACHED*/</span></span>, <span class=
16814 "CodeText"><span style=
16815 'font-size:10.0pt'>/*PRINTFLIKE*/</span></span>).</p>
16817 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16818 height="14" align="left">
16820 <td valign="top" align="left" height="14" style=
16821 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16822 <p class="TextFontCX" align="center" style=
16823 'text-align:center;background:#CCCCCC'><span style=
16824 'font-size:10.0pt'>m:</span><span class=
16825 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
16826 <p class="TextFontCX"><span class="Flag"><span style=
16827 'font-size:10.0pt'>warn-lint-comments</span></span></p>
16828 <p class="IndentText">Print a warning and suggest an alternative
16829 when a traditional lint comment is used. </p>
16831 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16832 height="14" align="left">
16834 <td valign="top" align="left" height="14" style=
16835 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16836 <p class="TextFontCX" align="center" style=
16837 'text-align:center;background:#CCCCCC'><span style=
16838 'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
16839 <p class="TextFontCX"><span class="Flag"><span style=
16840 'font-size:10.0pt'>unrecog-comments</span></span></p>
16841 <p class="IndentText">Stylized comment is unrecognized.</p>
16844 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16845 height="14" align="left">
16847 <td valign="top" align="left" height="14" style=
16848 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16849 <p class="TextFontCX" align="center" style=
16850 'text-align:center;background:#CCCCCC'><span style=
16851 'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
16852 <p class="TextFontCX"><span class="Flag"><span style=
16853 'font-size:10.0pt'>unrecog-flag-comments</span></span></p>
16854 <p class="IndentText">
16855 Semantic comment attempts to set a flag that is not recognized.
16860 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16861 height="14" align="left">
16863 <td valign="top" align="left" height="14" style=
16864 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16865 <p class="TextFontCX" align="center" style=
16866 'text-align:center;background:#CCCCCC'><span style=
16867 'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
16868 <p class="TextFontCX"><span class="Flag"><span style=
16869 'font-size:10.0pt'>annotationerror
16871 <p class="IndentText">
16872 A declaration uses an invalid annotation.
16877 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16878 height="14" align="left">
16880 <td valign="top" align="left" height="14" style=
16881 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16882 <p class="TextFontCX" align="center" style=
16883 'text-align:center;background:#CCCCCC'><span style=
16884 'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
16885 <p class="TextFontCX"><span class="Flag"><span style=
16886 'font-size:10.0pt'>commenterror
16888 <p class="IndentText">
16889 A syntactic comment is used inconsistently.
16892 <p class="Heading10">Parsing</p>
16894 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16895 height="14" align="left">
16897 <td valign="top" align="left" height="14" style=
16898 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16899 <p class="TextFontCX" align="center" style=
16900 'text-align:center;background:#CCCCCC'><span style=
16901 'font-size:10.0pt'>P:</span> <span class=
16902 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16903 <p class="TextFontCX"><span class="Flag"><span style=
16904 'font-size:10.0pt'>continue-comment</span></span></p>
16905 <p class="IndentText">A line continuation marker
16906 (<span class="CodeText"><span style=
16907 'font-size:10.0pt'>\</span></span>) appears inside a comment
16908 on the same line as the comment close. Preprocessors should
16909 handle this correctly, but it causes problems for some
16912 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16913 height="14" align="left">
16915 <td valign="top" align="left" height="14" style=
16916 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16917 <p class="TextFontCX" align="center" style=
16918 'text-align:center;background:#CCCCCC'><span style=
16919 'font-size:10.0pt'>P:</span> <span class=
16920 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16921 <p class="TextFontCX"><span class="Flag"><span style=
16922 'font-size:10.0pt'>nest-comment</span></span></p>
16923 <p class="IndentText">A comment open sequence (<span class=
16924 "CodeText"><span style='font-size:10.0pt'>/*</span></span>) appears
16925 inside a comment. This usually indicates that an earlier
16926 comment was not closed.</p>
16929 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16930 height="14" align="left">
16932 <td valign="top" align="left" height="14" style=
16933 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16934 <p class="TextFontCX" align="center" style=
16935 'text-align:center;background:#CCCCCC'><span style=
16936 'font-size:10.0pt'>P:</span> <span class=
16937 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
16938 <p class="TextFontCX"><span class="Flag"><span style=
16939 'font-size:10.0pt'>slashslashcomment</span></span></p>
16940 <p class="IndentText">A
16942 "CodeText"><span style='font-size:10.0pt'>//</span></span>
16943 comment is used.  ISO C99 allows
16945 "CodeText"><span style='font-size:10.0pt'>//</span></span>
16946 comments, but earlier standards did not.
16950 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16951 height="14" align="left">
16953 <td valign="top" align="left" height="14" style=
16954 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16955 <p class="TextFontCX" align="center" style=
16956 'text-align:center;background:#CCCCCC'><span style=
16957 'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
16958 <p class="TextFontCX"><span class="Flag"><span style=
16959 'font-size:10.0pt'>duplicate-quals</span></span></p>
16960 <p class="IndentText">Report duplicate type qualifiers (e.g.,
16961 <span class="CodeText"><span style='font-size:10.0pt'>unsigned
16962 unsigned</span></span>).</p>
16964 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16965 height="14" align="left">
16967 <td valign="top" align="left" height="14" style=
16968 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16969 <p class="TextFontCX" align="center" style=
16970 'text-align:center;background:#CCCCCC'><span style=
16971 'font-size:10.0pt'>P:</span> <span class=
16972 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16973 <p class="TextFontCX"><span class="Flag"><span style=
16974 'font-size:10.0pt'>gnu-extensions</span></span></p>
16975 <p class="IndentText">Support some GNU and Microsoft language
16979 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16980 height="14" align="left">
16982 <td valign="top" align="left" height="14" style=
16983 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16984 <p class="TextFontCX" align="center" style=
16985 'text-align:center;background:#CCCCCC'><span style=
16986 'font-size:10.0pt'>P:</span> <span class=
16987 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
16988 <p class="TextFontCX"><span class="Flag"><span style=
16989 'font-size:10.0pt'>syntax</span></span></p>
16990 <p class="IndentText">Parse error.</p>
16993 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
16994 height="14" align="left">
16996 <td valign="top" align="left" height="14" style=
16997 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
16998 <p class="TextFontCX" align="center" style=
16999 'text-align:center;background:#CCCCCC'><span style=
17000 'font-size:10.0pt'>P:</span> <span class=
17001 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
17002 <p class="TextFontCX"><span class="Flag"><span style=
17003 'font-size:10.0pt'>try-to-recover</span></span></p>
17004 <p class="IndentText">Try to recover from a parse error. If
17005 <span class="Flag"><span style=
17006 'font-size:10.0pt'>trytorecover</span></span> is not set, Splint
17007 will abort checking after a parse error is detected. If it is
17008 set, Splint will attempt to recover, but Splint does performs only
17009 minimal error recovery. It is likely that trying to recover
17010 after a parse error will lead to an internal assertion failing.</p>
17013 <p class="Heading10">Warn use</p>
17016 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17017 height="14" align="left">
17019 <td valign="top" align="left" height="14" style=
17020 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17021 <p class="TextFontCX" align="center" style=
17022 'text-align:center;background:#CCCCCC'><span style=
17023 'font-size:10.0pt'>m:</span> <span class=
17024 "Keyword"><span style='font-size:10.0pt'>-+++
17025 </span></span></p></td></tr></table></div>
17026 <p class="TextFontCX"><span class="Flag"><span style=
17027 'font-size:10.0pt'>
17030 <p class="IndentText">
17031 Use of function that may lead to buffer overflow.
17035 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17036 height="14" align="left">
17038 <td valign="top" align="left" height="14" style=
17039 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17040 <p class="TextFontCX" align="center" style=
17041 'text-align:center;background:#CCCCCC'><span style=
17042 'font-size:10.0pt'>m:</span> <span class=
17043 "Keyword"><span style='font-size:10.0pt'>++++
17044 </span></span></p></td></tr></table></div>
17045 <p class="TextFontCX"><span class="Flag"><span style=
17046 'font-size:10.0pt'>
17049 <p class="IndentText">
17050 Use of function that may lead to buffer overflow.
17056 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17057 height="14" align="left">
17059 <td valign="top" align="left" height="14" style=
17060 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17061 <p class="TextFontCX" align="center" style=
17062 'text-align:center;background:#CCCCCC'><span style=
17063 'font-size:10.0pt'>m:</span> <span class=
17064 "Keyword"><span style='font-size:10.0pt'>--++
17065 </span></span></p></td></tr></table></div>
17066 <p class="TextFontCX"><span class="Flag"><span style=
17067 'font-size:10.0pt'>
17068 implementationoptional
17070 <p class="IndentText">
17071 Use of a declarator that is implementation optional, not required by ISO99.
17076 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17077 height="14" align="left">
17079 <td valign="top" align="left" height="14" style=
17080 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17081 <p class="TextFontCX" align="center" style=
17082 'text-align:center;background:#CCCCCC'><span style=
17083 'font-size:10.0pt'>m:</span> <span class=
17084 "Keyword"><span style='font-size:10.0pt'>--++
17085 </span></span></p></td></tr></table></div>
17086 <p class="TextFontCX"><span class="Flag"><span style=
17087 'font-size:10.0pt'>
17090 <p class="IndentText">
17091 Non-reentrant function should not be used in multithreaded code.
17095 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17096 height="14" align="left">
17098 <td valign="top" align="left" height="14" style=
17099 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17100 <p class="TextFontCX" align="center" style=
17101 'text-align:center;background:#CCCCCC'><span style=
17102 'font-size:10.0pt'>m:</span> <span class=
17103 "Keyword"><span style='font-size:10.0pt'>--++
17104 </span></span></p></td></tr></table></div>
17105 <p class="TextFontCX"><span class="Flag"><span style=
17106 'font-size:10.0pt'>
17109 <p class="IndentText">
17110 Use of function that may have implementation-dependent behavior.
17115 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17116 height="14" align="left">
17118 <td valign="top" align="left" height="14" style=
17119 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17120 <p class="TextFontCX" align="center" style=
17121 'text-align:center;background:#CCCCCC'><span style=
17122 'font-size:10.0pt'>m:</span> <span class=
17123 "Keyword"><span style='font-size:10.0pt'>--++
17124 </span></span></p></td></tr></table></div>
17125 <p class="TextFontCX"><span class="Flag"><span style=
17126 'font-size:10.0pt'>
17129 <p class="IndentText">
17130 Call to function restricted to superusers.
17135 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17136 height="14" align="left">
17138 <td valign="top" align="left" height="14" style=
17139 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17140 <p class="TextFontCX" align="center" style=
17141 'text-align:center;background:#CCCCCC'><span style=
17142 'font-size:10.0pt'>m:</span> <span class=
17143 "Keyword"><span style='font-size:10.0pt'>---+
17144 </span></span></p></td></tr></table></div>
17145 <p class="TextFontCX"><span class="Flag"><span style=
17146 'font-size:10.0pt'>
17149 <p class="IndentText">
17150 Possible time of check, time of use vulnerability.
17156 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17157 height="14" align="left">
17159 <td valign="top" align="left" height="14" style=
17160 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17161 <p class="TextFontCX" align="center" style=
17162 'text-align:center;background:#CCCCCC'><span style=
17163 'font-size:10.0pt'>m:</span> <span class=
17164 "Keyword"><span style='font-size:10.0pt'>----
17165 </span></span></p></td></tr></table></div>
17166 <p class="TextFontCX"><span class="Flag"><span style=
17167 'font-size:10.0pt'>
17170 <p class="IndentText">
17171 Use of function that need not be provided by UNIX implementations
17174 <p class="Heading10">ITS4 compatibility flags</p>
17178 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17179 height="14" align="left">
17181 <td valign="top" align="left" height="14" style=
17182 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17183 <p class="TextFontCX" align="center" style=
17184 'text-align:center;background:#CCCCCC'><span style=
17185 'font-size:10.0pt'>P:</span> <span class=
17186 "Keyword"><span style='font-size:10.0pt'>-
17187 </span></span></p></td></tr></table></div>
17188 <p class="TextFontCX"><span class="Flag"><span style=
17189 'font-size:10.0pt'>
17192 <p class="IndentText">
17193 Security vulnerability classified as most risky in its4 database.
17197 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17198 height="14" align="left">
17200 <td valign="top" align="left" height="14" style=
17201 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17202 <p class="TextFontCX" align="center" style=
17203 'text-align:center;background:#CCCCCC'><span style=
17204 'font-size:10.0pt'>P:</span> <span class=
17205 "Keyword"><span style='font-size:10.0pt'>-
17206 </span></span></p></td></tr></table></div>
17207 <p class="TextFontCX"><span class="Flag"><span style=
17208 'font-size:10.0pt'>
17211 <p class="IndentText">
17212 Security vulnerability classified as very risky in its4 database.
17217 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17218 height="14" align="left">
17220 <td valign="top" align="left" height="14" style=
17221 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17222 <p class="TextFontCX" align="center" style=
17223 'text-align:center;background:#CCCCCC'><span style=
17224 'font-size:10.0pt'>P:</span> <span class=
17225 "Keyword"><span style='font-size:10.0pt'>-
17226 </span></span></p></td></tr></table></div>
17227 <p class="TextFontCX"><span class="Flag"><span style=
17228 'font-size:10.0pt'>
17231 <p class="IndentText">
17232 Security vulnerability classified as risky in its4 database.
17237 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17238 height="14" align="left">
17240 <td valign="top" align="left" height="14" style=
17241 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17242 <p class="TextFontCX" align="center" style=
17243 'text-align:center;background:#CCCCCC'><span style=
17244 'font-size:10.0pt'>P:</span> <span class=
17245 "Keyword"><span style='font-size:10.0pt'>-
17246 </span></span></p></td></tr></table></div>
17247 <p class="TextFontCX"><span class="Flag"><span style=
17248 'font-size:10.0pt'>
17251 <p class="IndentText">
17252 Security vulnerability classified as moderate risk in its4 database.
17258 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17259 height="14" align="left">
17261 <td valign="top" align="left" height="14" style=
17262 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17263 <p class="TextFontCX" align="center" style=
17264 'text-align:center;background:#CCCCCC'><span style=
17265 'font-size:10.0pt'>P:</span> <span class=
17266 "Keyword"><span style='font-size:10.0pt'>-
17267 </span></span></p></td></tr></table></div>
17268 <p class="TextFontCX"><span class="Flag"><span style=
17269 'font-size:10.0pt'>
17272 <p class="IndentText">
17273 Security vulnerability classified as risky in its4 database.
17276 <p class="Heading10">Debug flags</p>
17279 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17280 height="14" align="left">
17282 <td valign="top" align="left" height="14" style=
17283 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17284 <p class="TextFontCX" align="center" style=
17285 'text-align:center;background:#CCCCCC'><span style=
17286 'font-size:10.0pt'>P:</span> <span class=
17287 "Keyword"><span style='font-size:10.0pt'>3
17288 </span></span></p></td></tr></table></div>
17289 <p class="TextFontCX"><span class="Flag"><span style=
17290 'font-size:10.0pt'>
17293 <p class="IndentText">
17294 Set maximum number of bugs detected before giving up.
17299 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17300 height="14" align="left">
17302 <td valign="top" align="left" height="14" style=
17303 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17304 <p class="TextFontCX" align="center" style=
17305 'text-align:center;background:#CCCCCC'><span style=
17306 'font-size:10.0pt'>m:</span> <span class=
17307 "Keyword"><span style='font-size:10.0pt'>----
17308 </span></span></p></td></tr></table></div>
17309 <p class="TextFontCX"><span class="Flag"><span style=
17310 'font-size:10.0pt'>
17313 <p class="IndentText">
17314 Perform buffer overflow checking even if the errors would be surpressed.
17320 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17321 height="14" align="left">
17323 <td valign="top" align="left" height="14" style=
17324 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17325 <p class="TextFontCX" align="center" style=
17326 'text-align:center;background:#CCCCCC'><span style=
17327 'font-size:10.0pt'>P:</span> <span class=
17328 "Keyword"><span style='font-size:10.0pt'>-
17329 </span></span></p></td></tr></table></div>
17330 <p class="TextFontCX"><span class="Flag"><span style=
17331 'font-size:10.0pt'>
17334 <p class="IndentText">
17335 Debug parsing. Prints bison generated debuging information.
17341 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17342 height="14" align="left">
17344 <td valign="top" align="left" height="14" style=
17345 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17346 <p class="TextFontCX" align="center" style=
17347 'text-align:center;background:#CCCCCC'><span style=
17348 'font-size:10.0pt'>P:</span> <span class=
17349 "Keyword"><span style='font-size:10.0pt'>-
17350 </span></span></p></td></tr></table></div>
17351 <p class="TextFontCX"><span class="Flag"><span style=
17352 'font-size:10.0pt'>
17355 <p class="IndentText">
17356 Do not delete temporary files.
17361 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17362 height="14" align="left">
17364 <td valign="top" align="left" height="14" style=
17365 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17366 <p class="TextFontCX" align="center" style=
17367 'text-align:center;background:#CCCCCC'><span style=
17368 'font-size:10.0pt'>P:</span> <span class=
17369 "Keyword"><span style='font-size:10.0pt'>-
17370 </span></span></p></td></tr></table></div>
17371 <p class="TextFontCX"><span class="Flag"><span style=
17372 'font-size:10.0pt'>
17375 <p class="IndentText">
17376 Do not pre-process input files.
17381 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
17382 height="14" align="left">
17384 <td valign="top" align="left" height="14" style=
17385 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
17386 <p class="TextFontCX" align="center" style=
17387 'text-align:center;background:#CCCCCC'><span style=
17388 'font-size:10.0pt'>P:</span> <span class=
17389 "Keyword"><span style='font-size:10.0pt'>-
17390 </span></span></p></td></tr></table></div>
17391 <p class="TextFontCX"><span class="Flag"><span style=
17392 'font-size:10.0pt'>
17395 <p class="IndentText">
17396 Display the source code location where a warning is produced.
17402 <p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
17403 <a name="_Toc534975062"></a><a name="_Ref348845752">Appendix
17405 'font:7.0pt "Times New Roman"'> </span>
17406 <a id="annotations" name="annotations">
17407 Annotations</a></a></p>
17408 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
17409 <a name="_Toc534975063"></a><a name="_Ref348010146">Suppressin</a>g
17411 <p class="beforelist">Several annotations are provided for
17412 suppressing messages. In general, it is usually better to use
17413 specific flags to suppress a particular error permanently, but the
17414 general error suppression flags may be more convenient for quickly
17415 suppressing messages for code that will be corrected or documented
17417 <p class="TextFontCX"><span class="Flag"><span style=
17418 'font-size:10.0pt'>ignore</span></span></p>
17419 <p class="TextFontCX"><span class="Flag"><span style=
17420 'font-size:10.0pt'>end</span></span></p>
17421 <p class="IndentText">No errors will be reported in code regions
17422 between <span class="Annot"><span style=
17423 'font-size:10.0pt'>/*@ignore@*/</span></span> and
17424 <span class="Annot"><span style=
17425 'font-size:10.0pt'>/*@end@*/</span></span>. These
17426 comments can be used to easily suppress an unlimited number
17427 of messages, but are dangerous since if real errors are
17428 introduced in the <span class="Flag"><span style=
17429 'font-size:10.0pt'>ignore</span></span>…<span class=
17430 "Flag"><span style='font-size:10.0pt'>end</span></span>
17431 region they will not be reported. The <span class=
17432 "Annot"><span style='font-size:10.0pt'>ignore</span></span>
17433 and <span class="Annot"><span style=
17434 'font-size:10.0pt'>end</span></span> comments must be matched
17435 — a warning is printed if the file ends in an ignore
17436 region or if <span class="Flag"><span style=
17437 'font-size:10.0pt'>ignore</span></span> is used inside ignore
17439 <p class="TextFontCX"><span class="Flag"><span style=
17440 'font-size:10.0pt'>i</span></span></p>
17441 <p class="IndentText">No errors will be reported from an
17442 <span class="Annot"><span style=
17443 'font-size:10.0pt'>/*@i@*/</span></span> comment to the end of the
17445 <p class="TextFontCX"><span class="Flag"><span style=
17446 'font-size:10.0pt'>i</span></span><span class=
17447 "Flag"><span style='font-size:10.0pt'><i><n></i></span></span></p>
17448 <p class="IndentText">No errors will be reported from an
17449 <span class="Annot"><span style=
17450 'font-size:10.0pt'>/*@i<i><n></i>@*/</span></span> (e.g.,
17451 <span class="Annot"><span style=
17452 'font-size:10.0pt'>/*@i3@*/</span></span>) comment to the end of
17453 the line. If there are not exactly <i>n</i> errors suppressed
17454 from the comment point to the end of the line, Splint will report
17455 an error. This is more robust than <span class=
17456 "Annot"><span style='font-size:10.0pt'>i</span></span> or
17457 <span class="Annot"><span style=
17458 'font-size:10.0pt'>ignore</span></span> since a message is
17459 generated if the expected number errors is not present. Since
17460 errors are not necessarily detected until after this file is
17461 processed (for example, and unused variable error), suppress count
17462 errors are reported after all files have been processed. The
17463 <span class="Flag"><span style=
17464 'font-size: 10.0pt'>‑supcounts</span></span> flag may be used
17465 to suppress these errors. This is useful when a system if
17466 being rechecked with different flag settings.</p>
17467 <p class="TextFontCX"><span class="Annot"><span style=
17468 'font-size:10.0pt'>t</span></span></p>
17469 <p class="TextFontCX"><span class="Flag"><span style=
17470 'font-size:10.0pt'>t<i><n></i></span></span></p>
17471 <p class="IndentText">Like <span class="Annot"><span style=
17472 'font-size:10.0pt'>i</span></span> and <span class=
17473 "Annot"><span style=
17474 'font-size:10.0pt'>i<i><n></i></span></span>, except
17475 controlled by <span class="Flag"><span style=
17476 'font-size:10.0pt'>+tmpcomments</span></span> flag. These can
17477 be used to temporarily suppress certain errors. Then,
17478 <span class="Flag"><span style=
17479 'font-size:10.0pt'>-tmpcomments</span></span> can be set to find
17481 <p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
17482 <a name="_Toc534975064">Syntactic Annotations</a></p>
17483 <p class="TextFontCX">The grammar below is the C syntax from
17484 [K&R,A13] modified to show the syntax of syntactic
17485 comments. Only productions effected by Splint annotations are
17486 shown. In the annotations, the <span class=
17487 "Annot"><span style='font-size:10.0pt'>@</span></span> represents
17488 the comment marker char, set by <span class=
17489 "Flag"><span style='font-size:10.0pt'>-commentchar</span></span> (default
17490 is <span class="Annot"><span style=
17491 'font-size:10.0pt'>@</span></span>).</p>
17492 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
17493 <a name="_Toc534975065">Functions</a></p>
17494 <p class="TextFontCX"><i>direct-declarator</i> <span style=
17495 'font-family:Symbol'>Þ</span></p>
17496 <p class="TextFontCX" style='text-indent:.5in'><i>
17497 direct-declarator</i> <span class="Annot"><span style=
17498 'font-size:10.0pt'>(</span></span><i>parameter-type-list<sub>opt</sub></i>
17499 <span class="Annot"><span style='font-size: 10.0pt'>)</span></span>
17500 <i>stateClause*<sub>opt</sub> globals<sub>opt</sub>
17501 modifies<sub>opt</sub></i></p>
17502 <p class="TextFontCX" style='text-indent:.5in'><i>|
17503 direct-declarator</i> <span class="Annot"><span style=
17504 'font-size:10.0pt'>(</span></span><i>identifier-list<sub>opt</sub></i>
17505 <span class="Annot"><span style='font-size: 10.0pt'>)</span></span>
17506 <i>stateClause*<sub>opt</sub> globals<sub>opt</sub>
17507 modifies<sub>opt</sub></i></p>
17508 <p class="TextFontCX"><i> </i></p>
17509 <p class="TextFontCX"><i>stateClause</i> <span style=
17510 'font-family:Symbol'>Þ</span> <span class=
17511 "Annot"><span style='font-size:10.0pt'>/*@</span></span> (
17512 <span class="Annot"><span style=
17513 'font-size:10.0pt'>uses</span></span> <i>|</i> <span class=
17514 "Annot"><span style='font-size:10.0pt'>sets</span></span>
17515 <i>|</i> <span class="Annot"><span style=
17516 'font-size:10.0pt'>defines</span></span> <i>|</i>
17517 <span class="Annot"><span style=
17518 'font-size:10.0pt'>allocates</span></span> <i>|</i>
17519 <span class="Annot"><span style=
17520 'font-size:10.0pt'>releases</span></span>)
17521 <i>reference,<sup>+</sup></i> <span class=
17522 "Annot"><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
17523 <span class="Annot"><span style=
17524 'font-size:10.0pt'>@*/</span></span></p>
17525 <p class="TextFontCX" align="right" style='text-align: right'>
17526 <i>
17527 |</i> <span class="Annot"><span style=
17528 'font-size:10.0pt'>/*@</span></span> ( <span class=
17529 "Annot"><span style='font-size:10.0pt'>ensures</span></span> |
17530 <span class="Annot"><span style=
17531 'font-size:10.0pt'>requires</span></span> ) <i>stateTag</i>
17532 <i>reference,<sup>+</sup></i> <span class=
17533 "Annot"><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
17534 <span class="Annot"><span style=
17535 'font-size:10.0pt'>@*/ </span></span>
17537 <p class="TextFontCX"><i> </i></p>
17538 <p class="TextFontCX"><i>stateTag</i> <span style=
17539 'font-family:Symbol'>Þ</span> <span class=
17540 "Annot"><span style='font-size: 10.0pt'>only</span></span>
17541 <i>|</i> <span class="Annot"><span style=
17542 'font-size: 10.0pt'>shared</span></span> <i>|</i>
17543 <span class="Annot"><span style=
17544 'font-size: 10.0pt'>owned</span></span> <i>|</i> <span class=
17545 "Annot"><span style=
17546 'font-size: 10.0pt'>dependent</span></span> <i>|</i>
17547 <span class="Annot"><span style=
17548 'font-size:10.0pt'>observer</span></span> <i>|</i>
17549 <span class="Annot"><span style=
17550 'font-size:10.0pt'>exposed</span></span> <i>|</i>
17551 <span class="Annot"><span style=
17552 'font-size:10.0pt'>isnull</span></span> <i>|</i> <span class=
17553 "Annot"><span style=
17554 'font-size:10.0pt'>notnull</span></span></p>
17555 <p class="TextFontCX" align="right" style=
17556 'text-align: right;text-indent:.5in'><i> |
17557 identifier </i>
17558 (Annotation defined by metastate definition, Section 10)</p>
17559 <p class="TextFontCX" style='text-indent:.5in'>
17560 <i> </i></p>
17561 <p class="TextFontCX"><i>globals</i> <span style=
17562 'font-family:Symbol'>Þ</span> <span class=
17563 "Annot"><span style='font-size: 10.0pt'>/*@globals</span></span>
17564 <i>globitem,<sup>+</sup></i> <span class="Annot"><span style=
17565 'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
17566 <span class="Annot"><span style=
17567 'font-size:10.0pt'>@*/</span></span> <i>|</i> <span class=
17568 "Annot"><span style=
17569 'font-size:10.0pt'>/*@globals</span></span><i>declaration-list<sub>opt </sub></i>
17570 <span class="Annot"><span style=
17571 'font-size: 10.0pt'>;</span></span><i><sub>opt</sub></i><span class="Annot">
17572 <span style='font-size:10.0pt'>@*/</span></span><span class=
17573 "Keyword"><span style='font-size:10.0pt'> </span></span></p>
17574 <p class="TextFontCX"><i>globitem</i> <span style=
17575 'font-family:Symbol'>Þ</span> [ ( <span class=
17576 "Annot"><span style='font-size:10.0pt'>undef</span></span> |
17577 <span class="Annot"><span style=
17578 'font-size:10.0pt'>killed</span></span> )* ] <span class=
17579 "Keyword"><i><sub><span style=
17580 'font-size:10.5pt;font-family:"Times New Roman"'> </span></sub></i></span><i>
17581 identifier | </i> <span class="Annot"><span style=
17582 'font-size:10.0pt'>internalState</span></span><i>| </i>
17583 <span class="Annot"><span style=
17584 'font-size:10.0pt'>fileSystem</span></span></p>
17585 <p class="TextFontCX"><i> </i></p>
17586 <p class="TextFontCX"><i>modifies</i> <span style=
17587 'font-family:Symbol'>Þ</span> <span class=
17588 "Annot"><span style='font-size:10.0pt'>/*@modifies</span></span>
17589 (<span class="Annot"><span style=
17590 'font-size:10.0pt'>nothing</span></span> <i>|</i>
17591 (<i>expression</i> | <span class="Annot"><span style=
17592 'font-size:10.0pt'>internalState</span></span> | <span class=
17593 "Annot"><span style=
17594 'font-size:10.0pt'>fileSystem</span></span>)<i><sup>+</sup></i><span class="Annot">
17596 'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>)
17597 <span class="Annot"><span style=
17598 'font-size:10.0pt'>@*/</span></span><span class=
17599 "Keyword"><span style=
17600 'font-size:10.0pt'> </span></span></p>
17601 <p class="TextFontCX" align="right" style='text-align: right'>
17602 <span class="Keyword"><span style=
17603 'font-size:10.0pt'> </span></span> <i>|</i>
17604 <span class="Annot"><span style=
17605 'font-size:10.0pt'>/*@*/</span></span><span class=
17606 "Keyword"><span style='font-size:10.0pt'>
17607
17608 </span></span>(Abbreviation for
17609 no globals and modifies nothing.)</p>
17610 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
17611 <a name="_Toc534975066">Iterators</a> <span class=
17612 "TextFontCXChar"><span style=
17613 'font-size:11.0pt; font-weight:normal'>(Section
17614 11.4)</span></span></p>
17615 <p class="beforelist">The globals and modifies clauses for an
17616 iterator are the same as those for a function, except they are not
17617 enclosed by a comment, since the iterator is already a comment.</p>
17618 <p class="TextFontCX"><i>direct-declarator</i></p>
17619 <p class="TextFontCX" style='text-indent:.5in'><span style=
17620 'font-family:Symbol'>Þ</span> <span class=
17621 "Annot"><span style='font-size: 10.0pt'>/*@iter</span></span>
17622 <i>identifier</i> <span class="Annot"><span style=
17623 'font-size:10.0pt'>(</span></span><i>parameter-type-list<sub>opt</sub></i>
17624 <span class="Annot"><span style=
17625 'font-size:10.0pt'>)</span></span>
17626 <i>iterGlobals<sub>opt</sub> iterModifies<sub>opt</sub></i>
17627 <span class="Annot"><span style=
17628 'font-size:10.0pt'>@*/</span></span></p>
17629 <p class="TextFontCX"><i> </i></p>
17630 <p class="TextFontCX"><i>iter-globals</i> <span style=
17631 'font-family:Symbol'>Þ</span> <span class=
17632 "Annot"><span style='font-size: 10.0pt'>globals</span></span>
17633 <i>declaration-list<sub>opt</sub></i> <span class=
17634 "Annot"><span style=
17635 'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>
17636 <p class="TextFontCX"><i>iter-modifies</i> <span style=
17637 'font-family:Symbol'>Þ</span> <span class=
17638 "Annot"><span style='font-size: 10.0pt'>modifies</span></span><i>
17639 moditem,+</i><span class="Annot"><span style=
17640 'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><i>|</i>
17641 <span class="Annot"><span style=
17642 'font-size:10.0pt'> modifies
17643 nothing</span></span><span class="Annot"><span style=
17644 'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>
17645 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
17646 <a name="_Toc534975067">Constants</a> <span class=
17647 "TextFontCXChar"><span style=
17648 'font-size:11.0pt; font-weight:normal'>(Section
17649 11.1)</span></span></p>
17650 <p class="TextFontCX"><i>external-declaration</i>
17651 <span style='font-family:Symbol'>Þ</span> <span class=
17652 "Annot"><span style=
17653 'font-size: 10.0pt'>/*@constant</span></span> <i>declaration
17654 <sub> </sub></i><span class="Annot"><span style=
17655 'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><span class="Annot">
17656 <span style='font-size:10.0pt'>@*/</span></span></p>
17657 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
17658 <a name="_Toc534975068"></a><a name="_Ref344807420">Alternate
17659 Types</a> <span class="TextFontCXChar"><span style=
17660 'font-size:11.0pt; font-weight:normal'>(Section
17661 4.4)</span></span></p>
17662 <p class="beforelist">Alternate types may be used in the type
17663 specification of parameters and return values.</p>
17664 <p class="TextFontCX" align="left" style='text-align: left'>
17665 <i>extended-type</i><span style='font-family:Symbol'>Þ</span>
17666 <i>type-specifier alt-type <sub>opt</sub></i></p>
17667 <p class="TextFontCX"><i>alt-type</i> <span style=
17668 'font-family:Symbol'>Þ</span> <span class=
17669 "Annot"><span style='font-size: 10.0pt'>/*@alt</span></span>
17670 <i>basic-type,<sup>+</sup></i> <span class=
17671 "Annot"><span style='font-size:10.0pt'>@*/</span></span></p>
17672 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
17673 <a name="_Toc534975069">Declarator Annotations</a></p>
17674 <p class="TextFontCX">General annotations appear after
17675 <i>storage-class-specifier</i>s and before
17676 <i>type-specifier</i>s. Multiple annotations may be used in
17677 any order. Here, annotations are without the surrounding
17678 comment. In a declaration, the annotation would be surrounded
17679 by <span class="Annot"><span style=
17680 'font-size:10.0pt'>/*@</span></span> and <span class=
17681 "Annot"><span style='font-size:10.0pt'>@*/</span></span>. In
17682 a globals or modifies clause or iterator or constant declaration,
17683 no surrounding comments would be used since they are within a
17685 <p class="Heading10" align="left" style='text-align:left'>Type
17686 Definitions <span class="TextFontCXChar"><span style=
17687 'font-size:11.0pt; font-weight:normal'>(Section
17688 4.3)</span></span></p>
17689 <p class="beforelist">A type definition may use any either
17690 <span class="Annot"><span style=
17691 'font-size:10.0pt'>abstract</span></span> or <span class=
17692 "Annot"><span style='font-size:10.0pt'>concrete</span></span>,
17693 either <span class="Annot"><span style=
17694 'font-size:10.0pt'>mutable</span></span> or <span class=
17695 "Annot"><span style='font-size:10.0pt'>immutable</span></span>, and
17696 <span class="Annot"><span style=
17697 'font-size:10.0pt'>refcounted</span></span>. Only a pointer
17698 to a <span class="Annot"><span style=
17699 'font-size:10.0pt'>struct</span></span> may be declared with
17700 <span class="Annot"><span style=
17701 'font-size:10.0pt'>refcounted</span></span>. Mutability
17702 annotations may not be used with concrete types since concrete
17703 types inherit their mutability from the actual type.</p>
17704 <p class="TextFontCX"><span class="Annot"><span style=
17705 'font-size:10.0pt'>abstract</span></span></p>
17706 <p class="MsoNormal" style='margin-left:13.5pt'>Type is abstraction
17707 (representation is hidden from clients.)</p>
17708 <p class="TextFontCX"><span class="Annot"><span style=
17709 'font-size:10.0pt'>concrete</span></span></p>
17710 <p class="MsoNormal" style='margin-left:13.5pt'>Type is concrete
17711 (representation is visible to clients.)</p>
17712 <p class="TextFontCX"><span class="Annot"><span style=
17713 'font-size:10.0pt'>immutable</span></span></p>
17714 <p class="MsoNormal" style='margin-left:13.5pt'>Instances of the
17715 type cannot change value.</p>
17716 <p class="TextFontCX"><span class="Annot"><span style=
17717 'font-size:10.0pt'>mutable</span></span></p>
17718 <p class="MsoNormal" style='margin-left:13.5pt'>Instances of the
17719 type can change value.</p>
17720 <p class="TextFontCX"><span class="Annot"><span style=
17721 'font-size:10.0pt'>refcounted</span></span></p>
17722 <p class="IndentText">Reference counted (Section 5.4).</p>
17723 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
17724 <a name="_Toc534975070">Type Access</a></p>
17725 <p class="TextFontCX">Control comments may also be used to override
17726 type access settings.</p>
17727 <p class="TextFontCX"><span class="Annot"><span style=
17728 'font-size:10.0pt'> </span></span></p>
17729 <p class="TextFontCX"><span class="Annot"><span style=
17730 'font-size:10.0pt'>/*@access
17731 <i><type></i>,<sup>+</sup>@*/</span></span><span class=
17732 "Annot"><span style='font-size:10.0pt'> </span></span></p>
17733 <p class="IndentText">Allows the following code to access the
17734 representation of <span class="Annot"><i><span style=
17735 'font-size:10.0pt'><type></span></i></span>. Type
17736 access applies from the point of the comment to the end of the file
17737 or the next access control comment for this type.</p>
17738 <p class="TextFontCX"><span class="Annot"><span style=
17739 'font-size:10.0pt'>/*@noaccess</span></span> <span class=
17740 "Annot"><span style=
17741 'font-size:10.0pt'><i><type></i>,<sup>+</sup>@*/</span></span></p>
17742 <p class="IndentText">Restricts access to the representation of
17743 <span class="Annot"><i><span style=
17744 'font-size:10.0pt'><type></span></i></span>. The type
17745 in a <span class="Annot"><span style=
17746 'font-size:10.0pt'>noaccess</span></span> comment must have been
17747 declared as an abstract type. </p>
17748 <p class="Heading10">Global Variables <span class=
17749 "HeadingNote"><span style=
17750 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
17751 <span class="HeadingNote"><span style=
17752 'font-size:10.5pt;font-weight:normal;font-style: normal'>7.2</span></span><span class="HeadingNote">
17754 'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
17755 <p class="beforelist">One check annotation may be used on a global
17756 or file-static variable declaration.</p>
17757 <p class="TextFontCX"><span class="Annot"><span style=
17758 'font-size:10.0pt'>unchecked</span></span></p>
17759 <p class="IndentText"><span class="Annot"><span style=
17760 'font-size:10.0pt;font-family: "Times New Roman"'>Weakest checking
17761 for global use.</span></span></p>
17762 <p class="TextFontCX"><span class="Annot"><span style=
17763 'font-size:10.0pt'>checkmod</span></span></p>
17764 <p class="IndentText"><span class="Annot"><span style=
17765 'font-size:10.0pt;font-family: "Times New Roman"'>Check
17766 modification by not use of global.</span></span></p>
17767 <p class="TextFontCX"><span class="Annot"><span style=
17768 'font-size:10.0pt'>checked</span></span></p>
17769 <p class="IndentText"><span class="Annot"><span style=
17770 'font-size:10.0pt;font-family: "Times New Roman"'>Check use and
17771 modification of global.</span></span></p>
17772 <p class="TextFontCX"><span class="Annot"><span style=
17773 'font-size:10.0pt'>checkedstrict</span></span></p>
17774 <p class="IndentText"><span class="Annot"><span style=
17775 'font-size:10.0pt;font-family: "Times New Roman"'>Check use of
17776 global, even in functions with no global list.</span></span></p>
17777 <p class="Heading10">Memory Management <span class=
17778 "HeadingNote"><span style=
17779 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
17780 <span class="HeadingNote"><span style=
17781 'font-size:10.5pt;font-weight:normal;font-style: normal'>3</span></span><span class="HeadingNote">
17783 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
17784 <p class="TextFontCX"><span class="Annot"><span style=
17785 'font-size:10.0pt'>dependent</span></span></p>
17786 <p class="IndentText"><span class="Annot"><span style=
17787 'font-size:10.0pt;font-family: "Times New Roman"'>A reference to
17788 externally-owned storage. (Section</span></span>
17789 <span class="Annot"><span style=
17790 'font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span class="Annot">
17792 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17793 <p class="TextFontCX"><span class="Annot"><span style=
17794 'font-size:10.0pt'>keep</span></span></p>
17795 <p class="IndentText"><span class="Annot"><span style=
17796 'font-size:10.0pt;font-family: "Times New Roman"'>A parameter that
17797 is kept by the called function. The caller may use the
17798 storage after the call, but the called function is responsible for
17799 making sure it is deallocated. (Section</span></span>
17800 <span class="Annot"><span style=
17801 'font-size:10.0pt;font-family:"Times New Roman"'>5.2.4</span></span><span class="Annot">
17803 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17804 <p class="TextFontCX"><span class="Annot"><span style=
17805 'font-size:10.0pt'>killref</span></span></p>
17806 <p class="IndentText">A <span class="Annot"><span style=
17807 'font-size:10.0pt'>refcounted</span></span> parameter. This
17808 reference is killed by the call. (Section 5.4)</p>
17809 <p class="TextFontCX"><span class="Annot"><span style=
17810 'font-size:10.0pt'>only</span></span></p>
17811 <p class="IndentText"><span class="Annot"><span style=
17812 'font-size:10.0pt;font-family: "Times New Roman"'>An unshared
17813 reference. Associated memory must be released before
17814 reference is lost.
17815 (Section </span></span><span class="Annot"><span style=
17816 'font-size:10.0pt;font-family:"Times New Roman"'>5.2</span></span><span class="Annot">
17818 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17819 <p class="TextFontCX"><span class="Annot"><span style=
17820 'font-size:10.0pt'>owned</span></span></p>
17821 <p class="IndentText"><span class="Annot"><span style=
17822 'font-size:10.0pt;font-family: "Times New Roman"'>Storage may be
17823 shared by dependent references, but associated memory must be
17824 released before this reference is lost.
17825 (Section</span></span> <span class="Annot"><span style=
17826 'font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span class="Annot">
17828 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17829 <p class="TextFontCX"><span class="Annot"><span style=
17830 'font-size:10.0pt'>shared</span></span></p>
17831 <p class="IndentText"><span class="Annot"><span style=
17832 'font-size:10.0pt;font-family: "Times New Roman"'>Shared reference
17833 that is never deallocated. (Section</span></span>
17834 <span class="Annot"><span style=
17835 'font-size:10.0pt;font-family:"Times New Roman"'>5.2.5</span></span><span class="Annot">
17837 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17838 <p class="TextFontCX"><span class="Annot"><span style=
17839 'font-size:10.0pt'>temp</span></span></p>
17840 <p class="IndentText">A temporary parameter. May not be
17841 released, and new aliases to it may not be created. (Section
17843 <p class="Heading10">Aliasing <span class=
17844 "HeadingNote"><span style=
17845 'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
17846 <span class="HeadingNote"><span style=
17847 'font-size:10.5pt;font-weight:normal;font-style: normal'>6</span></span><span class="HeadingNote">
17849 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
17850 <p class="beforelist">Both alias annotations may be used on a
17851 parameter declaration.</p>
17852 <p class="TextFontCX"><span class="Annot"><span style=
17853 'font-size:10.0pt'>unique</span></span></p>
17854 <p class="IndentText"><span class="Annot"><span style=
17855 'font-size:10.0pt;font-family: "Times New Roman"'>Parameter that
17856 may not be aliased by any other reference visible to the function.
17857 (Section </span></span><span class="Annot"><span style=
17858 'font-size:10.0pt;font-family:"Times New Roman"'>6.1.1</span></span><span class="Annot">
17860 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17861 <p class="TextFontCX"><span class="Annot"><span style=
17862 'font-size:10.0pt'>returned</span></span></p>
17863 <p class="IndentText"><span class="Annot"><span style=
17864 'font-size:10.0pt;font-family: "Times New Roman"'>Parameter that
17865 may be aliased by the return value. (Section</span></span>
17866 <span class="Annot"><span style=
17867 'font-size:10.0pt;font-family:"Times New Roman"'>6.1.2</span></span><span class="Annot">
17869 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17870 <p class="Heading10">Exposure <span class=
17871 "HeadingNote"><span style=
17872 'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
17873 <span class="HeadingNote"><span style=
17874 'font-size:10.5pt;font-weight:normal;font-style: normal'>6.2</span></span><span class="HeadingNote">
17876 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
17877 <p class="TextFontCX"><span class="Annot"><span style=
17878 'font-size:10.0pt'>observer</span></span></p>
17879 <p class="IndentText"><span class="Annot"><span style=
17880 'font-size:10.0pt;font-family: "Times New Roman"'>Reference that
17881 cannot be modified. (Section</span></span> <span class=
17882 "Annot"><span style=
17883 'font-size:10.0pt;font-family:"Times New Roman"'>6.2.1</span></span><span class="Annot">
17885 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17886 <p class="TextFontCX"><span class="Annot"><span style=
17887 'font-size:10.0pt'>exposed</span></span></p>
17888 <p class="IndentText"><span class="Annot"><span style=
17889 'font-size:10.0pt;font-family: "Times New Roman"'>Exposed reference
17890 to storage in another object. (Section</span></span>
17891 <span class="Annot"><span style=
17892 'font-size:10.0pt;font-family:"Times New Roman"'>6.2</span></span><span class="Annot">
17894 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
17895 <p class="Heading10">Definition State <span class=
17896 "HeadingNote"><span style=
17897 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
17898 <span class="HeadingNote"><span style=
17899 'font-size:10.5pt;font-weight:normal;font-style: normal'>3</span></span><span class="HeadingNote">
17901 'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
17902 <p class="TextFontCX"><span class="Annot"><span style=
17903 'font-size:10.0pt'>out</span></span></p>
17904 <p class="IndentText"><span class="Annot"><span style=
17905 'font-size:10.0pt;font-family: "Times New Roman"'>Storage reachable
17906 from reference need not be defined.</span></span></p>
17907 <p class="TextFontCX"><span class="Annot"><span style=
17908 'font-size:10.0pt'>in</span></span></p>
17909 <p class="IndentText"><span class="Annot"><span style=
17910 'font-size:10.0pt;font-family: "Times New Roman"'>All storage
17911 reachable from reference must be defined.</span></span></p>
17912 <p class="TextFontCX"><span class="Annot"><span style=
17913 'font-size:10.0pt'>partial</span></span></p>
17914 <p class="IndentText"><span class="Annot"><span style=
17915 'font-size:10.0pt;font-family: "Times New Roman"'>Partially
17916 defined. A structure may have undefined fields. No
17917 errors reported when fields are used.</span></span></p>
17918 <p class="TextFontCX"><span class="Annot"><span style=
17919 'font-size:10.0pt'>reldef</span></span></p>
17920 <p class="IndentText"><span class="Annot"><span style=
17921 'font-size:10.0pt;font-family: "Times New Roman"'>Relax definition
17922 checking. No errors when reference is not defined, or when it
17923 is used.</span></span></p>
17924 <p class="Heading10">Global State <span class=
17925 "TextFontCXChar"><span style=
17926 'font-size:11.0pt; font-weight:normal'>(Section
17927 7.2.2)</span></span></p>
17928 <p class="TextFontCX">These annotations may only be used in globals
17929 lists. Both annotations may be used for the same variable, to
17930 mean the variable is undefined before and after the call.</p>
17931 <p class="TextFontCX"> </p>
17932 <p class="TextFontCX"><span class="Annot"><span style=
17933 'font-size:10.0pt'>undef</span></span></p>
17934 <p class="IndentText"><span class="Annot"><span style=
17935 'font-size:10.0pt;font-family: "Times New Roman"'>Variable is
17936 undefined before the call.</span></span></p>
17937 <p class="TextFontCX"><span class="Annot"><span style=
17938 'font-size:10.0pt'>killed</span></span></p>
17939 <p class="IndentText"><span class="Annot"><span style=
17940 'font-size:10.0pt;font-family: "Times New Roman"'>Variable is
17941 undefined after the call.</span></span></p>
17942 <p class="Heading10">Null State <span class=
17943 "HeadingNote"><span style=
17944 'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
17945 <span class="HeadingNote"><span style=
17946 'font-size:10.5pt;font-weight:normal;font-style: normal'>2</span></span><span class="HeadingNote">
17948 'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
17949 <p class="TextFontCX"><span class="Annot"><span style=
17950 'font-size:10.0pt'>null</span></span></p>
17951 <p class="IndentText"><span class="Annot"><span style=
17952 'font-size:10.0pt;font-family: "Times New Roman"'>Possibly null
17953 pointer.</span></span></p>
17954 <p class="TextFontCX"><span class="Annot"><span style=
17955 'font-size:10.0pt'>notnull</span></span><span class=
17956 "Annot"><span style=
17957 'font-size:10.0pt'> </span></span></p>
17958 <p class="IndentText"><span class="Annot"><span style=
17959 'font-size:10.0pt;font-family: "Times New Roman"'>Non-null
17960 pointer.</span></span></p>
17961 <p class="TextFontCX"><span class="Annot"><span style=
17962 'font-size:10.0pt'>relnull</span></span></p>
17963 <p class="IndentText"><span class="Annot"><span style=
17964 'font-size:10.0pt;font-family: "Times New Roman"'>Relax null
17965 checking. No errors when</span></span> <span class=
17966 "CodeText"><span style=
17967 'font-size:10.0pt'>NULL</span></span><span class=
17968 "Annot"><span style=
17969 'font-size:10.0pt;font-family:"Times New Roman"'>is assigned to it,
17970 or when it is used as a non-null pointer.</span></span></p>
17971 <p class="Heading10">Null Predicates <span class=
17972 "HeadingNote"><span style=
17973 'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
17974 <span class="HeadingNote"><span style=
17975 'font-size:10.5pt;font-weight:normal;font-style: normal'>2.1.1</span></span><span class="HeadingNote">
17977 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
17978 <p class="beforelist">A null predicate annotation may be used of
17979 the return value of a function returning a Boolean type, taking a
17980 possibly-null pointer for its first argument.</p>
17981 <p class="TextFontCX"><span class="Annot"><span style=
17982 'font-size:10.0pt'>nullwhentrue</span></span></p>
17983 <p class="IndentText"><span class="Annot"><span style=
17984 'font-size:10.0pt;font-family: "Times New Roman"'>If result is
17985 true, first parameter is</span></span> <span class=
17986 "CodeText"><span style=
17987 'font-size:10.0pt'>NULL</span></span><span class=
17988 "Annot"><span style=
17989 'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
17990 <p class="TextFontCX"><span class="Annot"><span style=
17991 'font-size:10.0pt'>falsewhennull</span></span></p>
17992 <p class="IndentText"><span class="Annot"><span style=
17993 'font-size:10.0pt;font-family: "Times New Roman"'>If result
17994 is</span></span> <span class="CodeText"><span style=
17995 'font-size:10.0pt'>TRUE</span></span><span class=
17996 "Annot"><span style=
17997 'font-size:10.0pt;font-family:"Times New Roman"'>, first parameter
17998 is not</span></span> <span class="CodeText"><span style=
17999 'font-size:10.0pt'>NULL</span></span><span class=
18000 "Annot"><span style=
18001 'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
18002 <p class="Heading10">Execution <span class=
18003 "HeadingNote"><span style=
18004 'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
18005 <span class="HeadingNote"><span style=
18006 'font-size:10.5pt;font-weight:normal;font-style: normal'>8.1</span></span><span class="HeadingNote">
18008 'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
18009 <p class="beforelist">The <span class="Annot"><span style=
18010 'font-size:10.0pt'>noreturn</span></span>, <span class=
18011 "Annot"><span style='font-size:10.0pt'>maynotreturn</span></span>
18012 and <span class="Annot"><span style=
18013 'font-size:10.0pt'>alwaysreturn</span></span> annotations may be
18014 used on any function. The <span class=
18015 "Annot"><span style='font-size:10.0pt'>noreturnwhentrue</span></span>
18016 and <span class="Annot"><span style=
18017 'font-size:10.0pt'>noreturnwhenfalse</span></span>
18018 annotations may only be used on functions whose first
18019 argument is a Boolean. </p>
18020 <p class="TextFontCX"><span class="Annot"><span style=
18021 'font-size:10.0pt'>noreturn</span></span><span class=
18022 "Annot"><span style=
18023 'font-size:10.0pt'> </span></span></p>
18024 <p class="IndentText"><span class="Annot"><span style=
18025 'font-size:10.0pt;font-family: "Times New Roman"'>Function never
18026 returns.</span></span></p>
18027 <p class="TextFontCX"><span class="Annot"><span style=
18028 'font-size:10.0pt'>maynotreturn</span></span></p>
18029 <p class="IndentText"><span class="Annot"><span style=
18030 'font-size:10.0pt;font-family: "Times New Roman"'>Function may or
18031 may not return.</span></span></p>
18032 <p class="TextFontCX"><span class="Annot"><span style=
18033 'font-size:10.0pt'>noreturnwhentrue</span></span></p>
18034 <p class="IndentText"><span class="Annot"><span style=
18035 'font-size:10.0pt;font-family: "Times New Roman"'>Function does not
18036 return if first parameter is</span></span> <span class=
18037 "Keyword"><span style=
18038 'font-size:10.0pt'>TRUE</span></span><span class=
18039 "Annot"><span style=
18040 'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
18041 <p class="TextFontCX"><span class="Annot"><span style=
18042 'font-size:10.0pt'>noreturnwhenfalse</span></span></p>
18043 <p class="IndentText"><span class="Annot"><span style=
18044 'font-size:10.0pt;font-family: "Times New Roman"'>Function does not
18045 return if first parameter if</span></span> <span class=
18046 "Keyword"><span style=
18047 'font-size:10.0pt'>FALSE</span></span><span class=
18048 "Annot"><span style=
18049 'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
18050 <p class="TextFontCX"><span class="Annot"><span style=
18051 'font-size:10.0pt'>alwaysreturn</span></span></p>
18052 <p class="IndentText"><span class="Annot"><span style=
18053 'font-size:10.0pt;font-family: "Times New Roman"'>Function always
18054 returns.</span></span></p>
18055 <p class="Heading10">Side Effects <span style=
18056 'font-size:10.5pt;font-weight: normal'>(Section 11.2.1)</span></p>
18057 <p class="TextFontCX"><span class="Annot"><span style=
18058 'font-size:10.0pt'>sef</span></span></p>
18059 <p class="IndentText"><span class="Annot"><span style=
18060 'font-size:10.0pt;font-family:"Times New Roman"'>Corresponding
18061 actual parameter has no side effects.</span></span></p>
18062 <p class="Heading10">Declarations</p>
18063 <p class="beforelist">These annotations can be used on a
18064 declaration to control unused or undefined error reporting.</p>
18065 <p class="TextFontCX"><span class="Annot"><span style=
18066 'font-size:10.0pt'>unused</span></span></p>
18067 <p class="IndentText"><span class="Annot"><span style=
18068 'font-size:10.0pt;font-family: "Times New Roman"'>Identifier need
18069 not be used (no unused errors reported.)
18070 (Section</span></span> <span class="Annot"><span style=
18071 'font-size:10.0pt;font-family:"Times New Roman"'>13.1</span></span><span class="Annot">
18073 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
18074 <p class="TextFontCX"><span class="Annot"><span style=
18075 'font-size:10.0pt'>external</span></span></p>
18076 <p class="IndentText"><span class="Annot"><span style=
18077 'font-size:10.0pt;font-family: "Times New Roman"'>Identifier is
18078 defined externally (no undefined error reported.)
18079 (Section</span></span> <span class="Annot"><span style=
18080 'font-size:10.0pt;font-family:"Times New Roman"'>13.2</span></span><span class="Annot">
18082 'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
18083 <p class="Heading10">Switch Statements</p>
18084 <p class="TextFontCX"><span class="Annot"><span style=
18085 'font-size:10.0pt'>fallthrough</span></span></p>
18086 <p class="IndentText"><span class="Annot"><span style=
18087 'font-size:10.0pt;font-family:"Times New Roman"'>Fall through
18088 case. No message is reported if the previous case may fall
18089 through into the one immediately after the</span></span>
18090 <span class="Annot"><span style=
18091 'font-size:10.0pt'>fallthrough</span></span><span class=
18092 "Annot"><span style=
18093 'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
18094 <p class="Heading10">Break and Continue Statements
18095 <span class="TextFontCXChar"><span style=
18096 'font-size:11.0pt; font-weight:normal'>(Section
18097 8.3.3)</span></span></p>
18098 <p class="beforelist">These annotations are used before a
18099 <span class="CodeText"><span style=
18100 'font-size:10.0pt'>break</span></span> or <span class=
18101 "CodeText"><span style='font-size:10.0pt'>continue</span></span>
18103 <p class="TextFontCX"><span class="Annot"><span style=
18104 'font-size:10.0pt'>innerbreak</span></span></p>
18105 <p class="IndentText"><span class="Annot"><span style=
18106 'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
18107 an inner loop or switch.</span></span></p>
18108 <p class="TextFontCX"><span class="Annot"><span style=
18109 'font-size:10.0pt'>loopbreak</span></span></p>
18110 <p class="IndentText"><span class="Annot"><span style=
18111 'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
18112 a loop.</span></span></p>
18113 <p class="TextFontCX"><span class="Annot"><span style=
18114 'font-size:10.0pt'>switchbreak</span></span></p>
18115 <p class="IndentText"><span class="Annot"><span style=
18116 'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
18117 a switch.</span></span></p>
18118 <p class="TextFontCX"><span class="Annot"><span style=
18119 'font-size:10.0pt'>innercontinue</span></span><span class=
18120 "Annot"><span style=
18121 'font-size:10.0pt'><i> </i></span></span></p>
18122 <p class="IndentText"><span class="Annot"><span style=
18123 'font-size:10.0pt;font-family: "Times New Roman"'>Continue is
18124 continuing an inner loop.</span></span></p>
18125 <p class="Heading10">Unreachable Code</p>
18126 <p class="beforelist">This annotation is used before a statement to
18127 prevent unreachable code errors.</p>
18128 <p class="TextFontCX"><span class="Annot"><span style=
18129 'font-size:10.0pt'>notreached</span></span></p>
18130 <p class="IndentText"><span class="Annot"><span style=
18131 'font-size:10.0pt;font-family: "Times New Roman"'>Statement may be
18132 unreachable.</span></span></p>
18133 <p class="Heading10">Format String Arguments </p>
18134 <p class="beforelist">These annotations are used immediately before
18135 a function declaration.</p>
18136 <p class="TextFontCX"><span class="Annot"><span style=
18137 'font-size:10.0pt'>printflike</span></span></p>
18138 <p class="IndentText"><span class="Annot"><span style=
18139 'font-size:10.0pt;font-family: "Times New Roman"'>Check variable
18140 arguments like</span></span> <span class=
18141 "CodeText"><span style='font-size:10.0pt'>printf</span></span><span class="Annot">
18143 'font-size:10.0pt;font-family:"Times New Roman"'>library
18144 function. </span></span></p>
18145 <p class="TextFontCX"><span class="Annot"><span style=
18146 'font-size:10.0pt'>scanflike</span></span></p>
18147 <p class="IndentText"><span class="Annot"><span style=
18148 'font-size:10.0pt;font-family: "Times New Roman"'>Check variable
18149 arguments like</span></span> <span class=
18150 "CodeText"><span style='font-size:10.0pt'>scanf</span></span><a name="_Toc344355453">
18151 </a><a name="_Ref343091002"></a><a name=
18152 "_Ref343065628"><span class="Annot"><span style=
18153 'font-size:10.0pt;font-family:"Times New Roman"'>library
18154 function.</span></span></a></p>
18155 <p class="Heading10"><a name="_Ref348789839">Use Warnings</a></p>
18156 <p class="beforelist">These annotations are used immediately before
18157 a function, variable or type declaration.</p>
18158 <p class="TextFontCX"><span class="Annot"><span style=
18159 'font-size:10.0pt'>warn <i><flag-specifier></i>
18160 <i><message></i></span></span></p>
18161 <p class="IndentText">Issue a warning (controlled by
18162 <span class="Flag"><span style=
18163 'font-size:10.0pt'>flag-specifier</span></span>) where this
18164 declarator is used.</p>
18165 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
18166 <a name="_Toc534975071">Macro Expansion</a></p>
18167 <p class="TextFontCX"><a href=
18168 "mailto:/*@notfunction@*/"><span class="Annot"><span style=
18169 'font-size:10.0pt'>/*@notfunction@*/</span></span></a></p>
18170 <p class="IndentText">The next macro definition is not intended to
18171 be a function, and should be expanded in line instead of checked as
18172 a macro function definition.</p>
18173 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
18174 <a name="_Toc534975072">Arbitrary Integral Types</a></p>
18175 <p class="TextFontCX">These annotations are used to represent
18176 arbitrary integral types. Syntactically, they replace the
18177 implicit <span class="Flag"><span style=
18178 'font-size:10.0pt'>int</span></span> type.</p>
18179 <p class="TextFontCX"> </p>
18180 <p class="TextFontCX"><span class="Annot"><span style=
18181 'font-size:10.0pt'>/*@integraltype@*/</span></span></p>
18182 <p class="IndentText">An arbitrary integral type. The actual
18183 type may be any one of <span class="CodeText"><span style=
18184 'font-size:10.0pt'>short</span></span>, <span class=
18185 "CodeText"><span style='font-size:10.0pt'>int</span></span>,
18186 <span class="CodeText"><span style=
18187 'font-size:10.0pt'>long</span></span>, <span class=
18188 "CodeText"><span style='font-size:10.0pt'>unsigned
18189 short</span></span>, <span class="CodeText"><span style=
18190 'font-size:10.0pt'>unsigned</span></span>, or <span class=
18191 "CodeText"><span style='font-size:10.0pt'>unsigned
18192 long</span></span>.</p>
18193 <p class="TextFontCX"><span class="Annot"><span style=
18194 'font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>
18195 <p class="IndentText">An arbitrary unsigned integral type.
18196 The actual type may be any one of <span class=
18197 "CodeText"><span style='font-size:10.0pt'>unsigned
18198 short</span></span>, <span class="CodeText"><span style=
18199 'font-size:10.0pt'>unsigned</span></span>, or <span class=
18200 "CodeText"><span style='font-size:10.0pt'>unsigned
18201 long</span></span>.</p>
18202 <p class="TextFontCX"><span class="Annot"><span style=
18203 'font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>
18204 <p class="IndentText">An arbitrary signed integral type. The
18205 actual type may be any one of <span class=
18206 "CodeText"><span style='font-size:10.0pt'>short</span></span>,
18207 <span class="CodeText"><span style=
18208 'font-size:10.0pt'>int</span></span>, or <span class=
18209 "CodeText"><span style=
18210 'font-size:10.0pt'>long</span></span>.</p>
18211 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
18212 <a name="_Toc534975073"></a><a name="_Ref347471625">Traditional
18213 Lint Comments</a></p>
18214 <p class="TextFontCX">Some of the control comments supported by
18215 most standard UNIX lints are supported by Splint so legacy systems
18216 can be checked more easily. These comments are not lexically
18217 consistent with Splint comments, and their meanings are less
18218 precise (and may vary between different lint programs), so we
18219 recommend that Splint comments are used instead except for checking
18220 legacy systems already containing standard lint comments.</p>
18221 <p class="TextFontCX"> </p>
18222 <p class="beforelist">These standard lint comments supported by
18224 <p class="TextFontCX"><span class="Annot"><span style=
18225 'font-size:10.0pt'>/*FALLTHROUGH*/</span></span> (alternate
18226 misspelling, <span class="Annot"><span style=
18227 'font-size:10.0pt'>/*FALLTHRU*/</span></span>)</p>
18228 <p class="IndentText">Prevents errors for fall through cases.
18229 Same meaning as <span class="Annot"><span style=
18230 'font-size:10.0pt'>/*@fallthrough@*/</span></span>.</p>
18231 <p class="MsoListBullet"><span class="Annot"><span style=
18232 'font-size:10.0pt'>/*NOTREACHED*/</span></span></p>
18233 <p class="IndentText">Prevents errors about unreachable code (until
18234 the end of the function). Same meaning as <span class=
18235 "Annot"><span style=
18236 'font-size:10.0pt'>/*@notreached@*/</span></span>. </p>
18237 <p class="MsoListBullet"><span class="Annot"><span style=
18238 'font-size:10.0pt'>/*PRINTFLIKE*/</span></span></p>
18239 <p class="indentbefore">Arguments similar to the <span class=
18240 "CodeText"><span style='font-size:10.0pt'>printf</span></span>
18241 library function (there didn’t seem to be much of a consensus
18242 among standard lints as to exactly what this means). Splint
18244 <p class="IndentText"><span class="Annot"><span style=
18245 'font-size:10.0pt'>/*@printflike@*/</span></span></p>
18246 <p class="IndentText" style='margin-left:.5in'>Function takes zero
18247 or more arguments of any type, an unmodified <span class=
18248 "CodeText"><span style='font-size:10.0pt'>char *</span></span>
18249 format string argument and zero of more arguments of type and
18250 number dictated by the format string. Format codes are
18251 interpreted identically to the <span class=
18252 "CodeText"><span style='font-size:10.0pt'>printf</span></span>
18253 standard library function. May return a result of any
18254 type. (Splint interprets <span class=
18255 "Annot"><span style=
18256 'font-size:10.0pt'>/*PRINTFLIKE*/</span></span> as
18257 <span class="Annot"><span style=
18258 'font-size:10.0pt'>/*@printflike@*/</span></span>.)</p>
18259 <p class="IndentText"><span class="Annot"><span style=
18260 'font-size:10.0pt'>/*@scanflike@*/</span></span></p>
18261 <p class="IndentText" style='margin-left:.5in'>Like
18262 <span class="Annot"><span style=
18263 'font-size:10.0pt'>printflike</span></span>, except format
18264 codes are interpreted as in the <span class=
18265 "CodeText"><span style='font-size:10.0pt'>scanf</span></span>
18266 library function.</p>
18267 <p class="IndentText"> </p>
18268 <p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
18269 <span class="Annot"><span style=
18270 'font-size:10.0pt'>/*ARGSUSED*/</span></span></p>
18271 <p class="IndentText">Turns off unused parameter messages for this
18272 function. The control comment, <span class=
18273 "Annot"><span style=
18274 'font-size:10.0pt'>/*@‑paramuse</span></span><span class="Annot">
18275 <span style='font-size:10.0pt'>@*/</span></span> can be used to the
18276 same effect, or <span class="Annot"><span style=
18277 'font-size:10.0pt'>/*@unused@*/</span></span> can be used in
18278 individual parameter declarations.</p>
18279 <p class="IndentText"> </p>
18280 <p class="TextFontCX">Splint will ignore standard lint comments if
18281 <span class="Flag"><span style=
18282 'font-size:10.0pt'>-lint-comments</span></span> is used. If
18283 <span class="Flag"><span style=
18284 'font-size:10.0pt'>+warn-lint-comments</span></span> is used,
18285 Splint generates a message for standard lint comments and suggest
18286 replacements<a name="_Ref348801565">.</a></p>
18287 <p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
18288 <a name="_Toc534975074">Metastate Definitions</a></p>
18289 <p class="TextFontCX">The grammar for <span class=
18290 "ProgramNameChar">.mts</span> files is shown below.</p>
18291 <p class="MsoNormal"> </p>
18292 <p class="TextFontCX" align="left" style=
18293 'margin-left: .25in;text-align:left'><i><span lang=
18294 "FR">metastate</span></i> <span lang="FR"> </span>
18295 <span style='font-family:Symbol'>Þ</span> <span lang=
18296 "FR">[</span> <span class="Annot"><span style=
18297 'font-size:10.0pt'>global</span></span> <span lang="FR">]</span>
18298 <span class="Annot"><span style=
18299 'font-size:10.0pt'>attribute</span></span> <i><span lang=
18300 "FR">identifier clause*</span></i> <span class=
18301 "Annot"><span style='font-size: 10.0pt'>end</span></span></p>
18302 <p class="TextFontCX" align="left" style=
18303 'margin-left: .25in;text-align:left'><i><span lang=
18304 "FR">clause</span></i> <span lang=
18305 "FR"> </span> <span style=
18306 'font-family:Symbol'>Þ</span> <i><span lang=
18307 "FR">contextClause</span></i> <span lang="FR">| <i>valuesClause</i>
18308 | <i>defaultClause | defaultsClause</i></span></p>
18309 <p class="TextFontCX" align="left" style=
18310 'margin-left: .75in;text-align:left;text-indent:.25in'>
18311 <i><span lang="FR"> </span></i>
18312 <span lang="FR">| <i>annotationsClause</i> | <i>mergeClause |
18313 transfersClause | loserefClause</i></span></p>
18314 <p class="TextFontCX" align="left" style=
18315 'margin-left: 1.25in;text-align:left'><i><span lang="FR">|
18316 preconditionsClause | postconditionsClause</span></i></p>
18317 <p class="TextFontCX" align="left" style=
18318 'margin-left: .25in;text-align:left'><i><span lang=
18319 "FR">contextClause</span></i><span style=
18320 'font-family:Symbol'>Þ</span> <span class=
18321 "Annot"><span style='font-size: 10.0pt'>context</span></span>
18322 <i><span lang="FR">contextSelector</span></i></p>
18323 <p class="TextFontCX" align="left" style=
18324 'margin-left: .25in;text-align:left'><i><span lang=
18325 "FR">contextSelector</span></i> <span style=
18326 'font-family:Symbol'>Þ</span> <span lang="FR">(</span>
18327 <span class="Annot"><span style=
18328 'font-size:10.0pt'>parameter</span></span> <span lang="FR">|</span>
18329 <span class="Annot"><span style=
18330 'font-size:10.0pt'>reference</span></span> <span lang="FR">|</span>
18331 <span class="Annot"><span style=
18332 'font-size:10.0pt'>result</span></span> <span lang="FR">|</span>
18333 <span class="Annot"><span style=
18334 'font-size:10.0pt'>clause</span></span> <span lang="FR">|</span>
18335 <span class="Annot"><span style=
18336 'font-size:10.0pt'>literal</span></span> <span lang="FR">|</span>
18337 <span class="Annot"><span style=
18338 'font-size:10.0pt'>null</span></span> <span lang="FR">) [
18339 <i>type</i> ]</span></p>
18340 <p class="TextFontCX" align="left" style=
18341 'margin-left: .25in;text-align:left'><i><span lang=
18342 "FR">valuesClause</span></i><span style=
18343 'font-family:Symbol'>Þ</span> <span class=
18344 "Annot"><span style='font-size: 10.0pt'>oneof</span></span>
18345 <i>valueChoice</i>,*</p>
18346 <p class="TextFontCX" align="left" style=
18347 'margin-left: .25in;text-align:left'> </p>
18348 <p class="TextFontCX" align="left" style=
18349 'margin-left: .25in;text-align:left'><i><span lang=
18350 "FR">defaultClause</span></i> <span style=
18351 'font-family:Symbol'>Þ</span> <span class=
18352 "Annot"><span style='font-size: 10.0pt'>default</span></span>
18353 <i>valueChoide</i></p>
18354 <p class="TextFontCX" align="left" style=
18355 'margin-left: .25in;text-align:left'><i><span lang=
18356 "FR">defaultsClause</span></i><span style=
18357 'font-family:Symbol'>Þ</span> <span class=
18358 "Annot"><span style='font-size: 10.0pt'>defaults</span></span>
18359 <span lang="FR">( <i>contextSelector</i></span> <span class=
18360 "Annot"><span style='font-size:10.0pt'>==></span></span>
18361 <i>valueChoice</i> <span lang="FR">)*</span></p>
18362 <p class="TextFontCX" align="left" style=
18363 'margin-left: .25in;text-align:left'><i><span lang=
18364 "FR"> </span></i></p>
18365 <p class="TextFontCX" align="left" style=
18366 'margin-left: .25in;text-align:left'><i><span lang=
18367 "FR">annotationsClause</span></i><span style=
18368 'font-family:Symbol'>Þ</span> <span class=
18369 "Annot"><span style='font-size: 10.0pt'>annotations</span></span>
18370 ( <i>identifier</i> [ <i><span lang=
18371 "FR">contextSelector</span></i> <span lang="FR">]</span>
18372 <span class="Annot"><span style=
18373 'font-size: 10.0pt'>==></span></span> <i>valueChoice</i>
18374 )<i><span lang="FR">*</span></i></p>
18375 <p class="TextFontCX" align="left" style=
18376 'margin-left: .25in;text-align:left'><i><span lang=
18377 "FR"> </span></i></p>
18378 <p class="TextFontCX" align="left" style=
18379 'margin-left: .25in;text-align:left'><i><span lang=
18380 "FR">mergeClause</span></i><span style=
18381 'font-family:Symbol'>Þ</span> <span class=
18382 "Annot"><span style='font-size: 10.0pt'>merge</span></span> (
18383 <i>mergeItem</i> <span class="Annot"><span style=
18384 'font-size:10.0pt'>+</span></span> <i>mergeItem</i>
18385 <span class="Annot"><span style=
18386 'font-size:10.0pt'>==></span></span> <i>transferAction</i>
18387 )<i><span lang="FR">*</span></i></p>
18388 <p class="TextFontCX" align="left" style=
18389 'margin-left: .25in;text-align:left'><i><span lang=
18390 "FR">mergeItem</span></i><span style=
18391 'font-family:Symbol'>Þ</span> <i>valueChoice |</i>
18392 <span class="Annot"><span style=
18393 'font-size:10.0pt'>*</span></span></p>
18394 <p class="TextFontCX" align="left" style=
18395 'margin-left: .25in;text-align:left'><i><span lang=
18396 "FR"> </span></i></p>
18397 <p class="TextFontCX" align="left" style=
18398 'margin-left: .25in;text-align:left'><i><span lang=
18399 "FR">transfersClause</span></i><span style=
18400 'font-family:Symbol'>Þ</span> <span class=
18401 "Annot"><span style='font-size: 10.0pt'>transfers</span></span>
18402 ( <i>valueChoice</i> <span class="Annot"><span style=
18403 'font-size:10.0pt'>as</span></span>
18404 <i>valueChoice</i><span class="Annot"><span style=
18405 'font-size:10.0pt'>==></span></span> <i>transferAction</i>
18406 )<i><span lang="FR">*</span></i></p>
18407 <p class="TextFontCX" align="left" style=
18408 'margin-left: .25in;text-align:left'><i><span lang=
18409 "FR">loserefClause</span></i><span style=
18410 'font-family:Symbol'>Þ</span> <span class=
18411 "Annot"><span style='font-size: 10.0pt'>losereference</span></span>
18412 ( <i>valueChoice</i> <span class="Annot"><span style=
18413 'font-size:10.0pt'>==></span></span> <i>errorAction</i>
18414 )<i><span lang="FR">*</span></i></p>
18415 <p class="TextFontCX" align="left" style=
18416 'margin-left: .25in;text-align:left'><i><span lang=
18417 "FR"> </span></i></p>
18418 <p class="TextFontCX" align="left" style=
18419 'margin-left: .25in;text-align:left'><i><span lang=
18420 "FR">transferAction</span></i><span style=
18421 'font-family:Symbol'>Þ</span> <i>valueChoice |
18422 errorAction</i></p>
18423 <p class="TextFontCX" align="left" style=
18424 'margin-left: .25in;text-align:left'>
18425 <i>errorAction</i><span style='font-family:Symbol'>Þ</span>
18426 <span class="Annot"><span style=
18427 'font-size:10.0pt'>error</span></span> [ <i>stringLiteral</i>
18429 <p class="TextFontCX" align="left" style=
18430 'margin-left: .25in;text-align:left'><i><span lang=
18431 "FR"> </span></i></p>
18432 <p class="TextFontCX" align="left" style=
18433 'margin-left: .25in;text-align:left'><i><span lang=
18434 "FR">valueChoice</span></i><span style=
18435 'font-family:Symbol'>Þ</span>
18436 <i>identifier</i> </p>
18437 <p class="TextFontCX"> </p>
18438 <p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
18439 <a name="_Toc534975075"></a><a name="_Ref397875216"></a><a name=
18440 "_Ref350066976"></a><a name="_Ref348788300">Appendix
18441 D<span style='font:7.0pt "Times New Roman"'> </span>
18442 <a id="specifications" name="specifications">
18446 <p class="TextFontCX">Another way of providing more information
18447 about programs is to use formal specifications. Although this
18448 document has largely ignored specifications, Splint was originally
18449 designed to use the information in LCL specifications instead of
18450 source-code annotations. This document focuses on annotations
18451 since it takes less effort to add annotations to source code than
18452 to maintain an additional specification file. Annotations can
18453 express everything that can be expressed in LCL specifications that
18454 is relevant to Splint checking. However, LCL specifications
18455 can provide more precise documentation on program interfaces than
18456 is possible with Splint annotations. This appendix (extracted
18457 from [Evans94]) is a very brief introduction to LCL
18458 Specifications. For more information, consult
18459 [GH93]. </p>
18460 <p class="TextFontCX"> </p>
18461 <p class="TextFontCX">The Larch family of languages is a two-tiered
18462 approach to formal specification. A specification is built using
18463 two languages — the <i>Larch Shared Language</i> (LSL), which
18464 is independent of the implementation language, and a <i>Larch
18465 Interface Language</i> designed for the specific implementation
18466 language. An LSL specification defines <i>sorts</i>,
18467 analogous to abstract types in a programming language, and
18468 <i>operators</i>, analogous to procedures. It expresses the
18469 underlying semantics of an abstraction.</p>
18470 <p class="TextFontCX"> </p>
18471 <p class="TextFontCX">The interface language specifies an interface
18472 to an abstraction in a particular programming language. It
18473 captures the details of the interface needed by a client using the
18474 abstraction and places constraints on both correct implementations
18475 and uses of the module. The semantics of the interface are
18476 described using primitives and sorts and operators defined in LSL
18477 specifications. Interface languages have been designed for
18478 several programming languages.</p>
18479 <p class="TextFontCX"> </p>
18480 <p class="TextFontCX">LCL [GH93, Tan95] is a Larch interface
18481 language for Standard C. LCL uses a C-like syntax.
18482 Traditionally, a C module <span class=
18483 "Keyword"><i><span style='font-size:10.0pt;font-family:Arial; color:windowtext'>
18484 M</span></i></span> consists of a source file, <span class=
18485 "Keyword"><i><span style=
18486 'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18488 'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>,
18489 and a header file, <span class="Keyword"><i><span style=
18490 'font-size:10.0pt; font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18492 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.
18493 The header file contains prototype declarations for functions,
18494 variables and constants exported by <span class=
18495 "Keyword"><i><span style=
18496 'font-size:10.0pt; font-family:Arial;color:windowtext'>M</span></i></span>,
18497 as well as those macro definitions that implement exported
18498 functions or constants, and definitions of exported types. When
18499 using LCL, a module includes two additional files —
18500 <span class="Keyword"><i><span style=
18501 'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18503 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>,
18504 a formal specification of <span class=
18505 "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
18506 M</span></i></span>, and <span class=
18507 "Keyword"><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>
18508 M</span></i></span><span class="Keyword"><span style=
18509 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>,
18510 which is derived by Splint (if the <span class=
18511 "Flag"><span style='font-size:10.0pt'>lh</span></span> flag
18512 is on) from <span class="Keyword"><i><span style=
18513 'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18515 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>.
18516 Clients use <span class="Keyword"><i><span style=
18517 'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18519 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
18520 for documentation, and should not need to look at any
18521 implementation file. The derived file, <span class=
18522 "Keyword"><i><span style=
18523 'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18525 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>,
18526 contains include directives (if <span class=
18527 "Keyword"><i><span style=
18528 'font-size: 10.0pt;font-family:Arial;color:windowtext'>M</span></i></span>
18529 depends on other specified modules), prototypes of functions and
18530 declarations of variables as specified in <span class=
18531 "Keyword"><i><span style=
18532 'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18534 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>.
18535 The file <span class="Keyword"><i><span style=
18536 'font-size:10.0pt;font-family:Arial; color:windowtext'>M</span></i></span><span class="Keyword">
18538 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
18539 should include <span class="Keyword"><i><span style=
18540 'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18542 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>
18543 and retain the implementation aspects of the old <span class=
18544 "Keyword"><i><span style=
18545 'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
18547 'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>,
18548 but is no longer used for c<a name="_Ref348845779">lient
18549 documentation.</a></p>
18550 <p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
18551 <a name="_Toc534975076">Specification Flags</a></p>
18552 <p class="TextFontCX">These flags are relevant only when Splint is
18553 used with LCL specifications.</p>
18554 <p class="Heading10">Global Flags</p>
18555 <p class="TextFontCX"><span class="Flag"><span style=
18556 'font-size:10.0pt'>lcs</span></span></p>
18557 <p class="IndentText">Generate <span class=
18558 "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
18559 .lcs</span></span> files containing symbolic state of
18560 <span class="Keyword"><span style=
18561 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
18562 files (used for imports). By default <span class=
18563 "Keyword"><span style=
18564 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcs</span></span>
18565 files are generated for each <span class=
18566 "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
18567 .lcl</span></span> file processed. Use <span class=
18568 "Flag"><span style='font-size:10.0pt'>-lcs</span></span> to prevent
18569 generation of <span class="Keyword"><span style=
18570 'font-size:10.0pt;font-family: Arial;color:windowtext'>.lcs</span></span>
18572 <p class="TextFontCX"><span class="Flag"><span style=
18573 'font-size:10.0pt'>lh</span></span></p>
18574 <p class="IndentText">Generate <span class=
18575 "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
18576 .lh</span></span> files. By default, <span class=
18577 "Flag"><span style='font-size:10.0pt'>-lh</span></span> is set and
18578 no <span class="Keyword"><span style=
18579 'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>
18580 files are generated. Use <span class=
18581 "Flag"><span style='font-size:10.0pt'>+lh</span></span> to
18582 enable <span class="Flag"><span style=
18583 'font-size:10.0pt'>.lh</span></span> file
18584 generation. </p>
18585 <p class="TextFontCX"><span class="Flag"><span style=
18586 'font-size:10.0pt'>i</span></span> <span class=
18587 "Flag"><span style='font-size:10.0pt'><file></span></span></p>
18588 <p class="IndentText">Set LCL initialization file to
18589 <span class="Flag"><i><span style=
18590 'font-size:10.0pt'><file></span></i></span>. The
18591 LCL initialization file is read if any <span class=
18592 "Keyword"><span style=
18593 'font-size: 10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
18594 files are listed on the command line. The default file
18595 is <span class="Keyword"><span style=
18596 'font-size:10.0pt;font-family:Arial;color:windowtext'>lclinit.lci</span></span>,
18597 found on the <span class="Keyword"><span style=
18598 'font-size:10.0pt;font-family: Arial;color:windowtext'>LARCH_PATH</span></span>.</p>
18599 <p class="TextFontCX"><span class="Flag"><span style=
18600 'font-size:10.0pt'>lclexpect</span></span> <span class=
18601 "Flag"><span style=
18602 'font-size:10.0pt'><i><number></i></span></span></p>
18603 <p class="IndentText">Exactly <span class=
18604 "Flag"><i><span style='font-size:10.0pt'><number></span></i></span>
18605 specification errors are expected. Specification errors
18606 are errors detected when checking the specifications.
18607 They do not depend on the source code.</p>
18608 <p class="Heading10">Implicit Globals Checking Qualifiers</p>
18610 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18611 height="14" align="left">
18613 <td valign="top" align="left" height="14" style=
18614 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18615 <p class="TextFontCX" align="center" style=
18616 'text-align:center;background:#CCCCCC'><span style=
18617 'font-size:10.0pt'>m:</span><span class=
18618 "Keyword"><span style='font-size:10.0pt'>-++-</span></span></p></td></tr></table></div>
18619 <p class="TextFontCX"><span class="Flag"><span style=
18620 'font-size:10.0pt'>imp-checked-spec-globs</span></span></p>
18621 <p class="IndentText">Implicit <span class=
18622 "Annot"><span style='font-size:10.0pt'>checked</span></span>
18623 qualifier on global variables specified in an LCL file with
18624 no checking annotation.</p>
18626 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18627 height="14" align="left">
18629 <td valign="top" align="left" height="14" style=
18630 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18631 <p class="TextFontCX" align="center" style=
18632 'text-align:center;background:#CCCCCC'><span style=
18633 'font-size:10.0pt'>m:</span><span class=
18634 "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
18635 <p class="TextFontCX"><span class="Flag"><span style=
18636 'font-size:10.0pt'>imp-checkmod-spec-globs</span></span></p>
18638 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18639 height="14" align="left">
18641 <td valign="top" align="left" height="14" style=
18642 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18643 <p class="TextFontCX" align="center" style=
18644 'text-align:center;background:#CCCCCC'><span style=
18645 'font-size:10.0pt'>m:</span><span class=
18646 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
18647 <p class="IndentText">Implicit <span class=
18648 "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
18649 qualifier on global variables specified in an LCL file with
18650 no checking annotation.</p>
18651 <p class="TextFontCX"><span class="Flag"><span style=
18652 'font-size:10.0pt'>imp-checkedstrict-spec-globs</span></span></p>
18653 <p class="IndentText">Implicit <span class=
18654 "Annot"><span style='font-size:10.0pt'>checked</span></span>
18655 qualifier on global variables specified in an LCL file with
18656 no checking annotation.</p>
18658 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18659 height="14" align="left">
18661 <td valign="top" align="left" height="14" style=
18662 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18663 <p class="TextFontCX" align="center" style=
18664 'text-align:center;background:#CCCCCC'><span style=
18665 'font-size:10.0pt'>P:</span> <span class=
18666 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
18667 <p class="Heading10">Implicit Annotations</p>
18668 <p class="TextFontCX"><span class="Flag"><span style=
18669 'font-size:10.0pt'>spec-glob-imp-only</span></span></p>
18670 <p class="IndentText">Implicit <span class=
18671 "Annot"><span style='font-size:10.0pt'>only</span></span>
18672 annotation on global variable declaration in an LCL file with
18673 no allocation annotation.</p>
18675 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18676 height="14" align="left">
18678 <td valign="top" align="left" height="14" style=
18679 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18680 <p class="TextFontCX" align="center" style=
18681 'text-align:center;background:#CCCCCC'><span style=
18682 'font-size:10.0pt'>P:</span> <span class=
18683 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
18684 <p class="TextFontCX"><span class="Flag"><span style=
18685 'font-size:10.0pt'>spec-ret-imp-only</span></span></p>
18686 <p class="IndentText">Implicit <span class=
18687 "Annot"><span style='font-size:10.0pt'>only</span></span>
18688 annotation on return value declaration in an LCL file with no
18689 allocation annotation.</p>
18691 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18692 height="14" align="left">
18694 <td valign="top" align="left" height="14" style=
18695 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18696 <p class="TextFontCX" align="center" style=
18697 'text-align:center;background:#CCCCCC'><span style=
18698 'font-size:10.0pt'>P:</span> <span class=
18699 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
18700 <p class="TextFontCX"><span class="Flag"><span style=
18701 'font-size:10.0pt'>spec-struct-imp-only</span></span></p>
18702 <p class="IndentText">Implicit <span class=
18703 "Annot"><span style='font-size:10.0pt'>only</span></span>
18704 annotation on structure field declarations in an LCL file
18705 with no allocation annotation.</p>
18707 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18708 height="14" align="left">
18710 <td valign="top" align="left" height="14" style=
18711 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18712 <p class="TextFontCX" align="center" style=
18713 'text-align:center;background:#CCCCCC'><span style=
18714 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
18715 <p class="TextFontCX"><span class="Flag"><span style=
18716 'font-size:10.0pt'>spec-imp-only</span></span></p>
18717 <p class="IndentText">Sets <span class="Flag"><span style=
18718 'font-size:10.0pt'>spec-glob-imp-only</span></span>,
18719 <span class="Flag"><span style=
18720 'font-size:10.0pt'>spec-ret-imp-only</span></span> and
18721 <span class="Flag"><span style=
18722 'font-size:10.0pt'>spec-struct-imp-only</span></span>.</p>
18723 <p class="Heading10">Macro Expansion</p>
18725 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18726 height="14" align="left">
18728 <td valign="top" align="left" height="14" style=
18729 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18730 <p class="TextFontCX" align="center" style=
18731 'text-align:center;background:#CCCCCC'><span style=
18732 'font-size:10.0pt'>P:</span> <span class=
18733 "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
18734 <p class="TextFontCX"><span class="Flag"><span style=
18735 'font-size:10.0pt'>spec-macros</span></span></p>
18736 <p class="IndentText">Macros defining specified identifiers are not
18737 expanded and are checked according to the
18738 specification.<span class="Flag"><span style=
18739 'font-size:10.0pt'> </span></span></p>
18741 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18742 height="14" align="left">
18744 <td valign="top" align="left" height="14" style=
18745 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18746 <p class="TextFontCX" align="center" style=
18747 'text-align:center;background:#CCCCCC'><span style=
18748 'font-size:10.0pt'>m:</span><span class=
18749 "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
18750 <p class="Heading10">Complete Programs and Specifications</p>
18751 <p class="TextFontCX"><span class="Flag"><span style=
18752 'font-size:10.0pt'>spec-undef</span></span></p>
18753 <p class="IndentText">Function, variable, iterator or constant
18754 specified but never defined.</p>
18756 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18757 height="14" align="left">
18759 <td valign="top" align="left" height="14" style=
18760 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18761 <p class="TextFontCX" align="center" style=
18762 'text-align:center;background:#CCCCCC'><span style=
18763 'font-size:10.0pt'>P:</span> <span class=
18764 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
18765 <p class="TextFontCX"><span class="Flag"><span style=
18766 'font-size:10.0pt'>spec-undecl</span></span></p>
18767 <p class="IndentText">Function, variable, iterator or constant
18768 specified but never declared.</p>
18770 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18771 height="14" align="left">
18773 <td valign="top" align="left" height="14" style=
18774 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18775 <p class="TextFontCX" align="center" style=
18776 'text-align:center;background:#CCCCCC'><span style=
18777 'font-size:10.0pt'>P:</span> <span class=
18778 "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
18779 <p class="TextFontCX"><span class="Flag"><span style=
18780 'font-size:10.0pt'>need-spec</span></span></p>
18782 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18783 height="14" align="left">
18785 <td valign="top" align="left" height="14" style=
18786 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18787 <p class="TextFontCX" align="center" style=
18788 'text-align:center;background:#CCCCCC'><span style=
18789 'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
18790 <p class="IndentText">There is information in the specification
18791 that is not duplicated in syntactic comments. Normally, this
18792 is not an error, but it may be useful to detect it to make sure
18793 checking incomplete systems without the specifications will still
18794 use this information.</p>
18795 <p class="TextFontCX"><span class="Flag"><span style=
18796 'font-size:10.0pt'>export-any</span></span></p>
18798 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18799 height="14" align="left">
18801 <td valign="top" align="left" height="14" style=
18802 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18803 <p class="TextFontCX" align="center" style=
18804 'text-align:center;background:#CCCCCC'><span style=
18805 'font-size:10.0pt'>m:</span><span class=
18806 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
18807 <p class="IndentText">An error is reported for any identifier that
18808 is exported but not specified. (Sets all export flags
18810 <p class="TextFontCX"><span class="Flag"><span style=
18811 'font-size:10.0pt'>export-const</span></span></p>
18812 <p class="IndentText">Constant exported but not specified.</p>
18814 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18815 height="14" align="left">
18817 <td valign="top" align="left" height="14" style=
18818 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18819 <p class="TextFontCX" align="center" style=
18820 'text-align:center;background:#CCCCCC'><span style=
18821 'font-size:10.0pt'>m:</span><span class=
18822 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
18823 <p class="TextFontCX"><span class="Flag"><span style=
18824 'font-size:10.0pt'>export-var</span></span></p>
18825 <p class="IndentText">Variable exported but not specified.</p>
18827 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18828 height="14" align="left">
18830 <td valign="top" align="left" height="14" style=
18831 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18832 <p class="TextFontCX" align="center" style=
18833 'text-align:center;background:#CCCCCC'><span style=
18834 'font-size:10.0pt'>m:</span><span class=
18835 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
18836 <p class="TextFontCX"><span class="Flag"><span style=
18837 'font-size:10.0pt'>export-fcn</span></span></p>
18838 <p class="IndentText">Function exported but not specified.</p>
18840 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18841 height="14" align="left">
18843 <td valign="top" align="left" height="14" style=
18844 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18845 <p class="TextFontCX" align="center" style=
18846 'text-align:center;background:#CCCCCC'><span style=
18847 'font-size:10.0pt'>m:</span><span class=
18848 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
18849 <p class="TextFontCX"><span class="Flag"><span style=
18850 'font-size:10.0pt'>export-iter</span></span></p>
18851 <p class="IndentText">Iterator exported but not specified.</p>
18853 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18854 height="14" align="left">
18856 <td valign="top" align="left" height="14" style=
18857 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18858 <p class="TextFontCX" align="center" style=
18859 'text-align:center;background:#CCCCCC'><span style=
18860 'font-size:10.0pt'>m:</span><span class=
18861 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
18862 <p class="TextFontCX"><span class="Flag"><span style=
18863 'font-size:10.0pt'>export-macro</span></span></p>
18864 <p class="IndentText">An expanded macro exported but not
18867 <table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
18868 height="14" align="left">
18870 <td valign="top" align="left" height="14" style=
18871 'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
18872 <p class="TextFontCX" align="center" style=
18873 'text-align:center;background:#CCCCCC'><span style=
18874 'font-size:10.0pt'>m:</span><span class=
18875 "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
18876 <p class="TextFontCX"><span class="Flag"><span style=
18877 'font-size:10.0pt'>export-type</span></span></p>
18878 <p class="IndentText">Type definition exported but not
18880 <p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
18881 <a name="_Toc534975077"></a><a name="_Ref534642451"></a><a name=
18882 "_Toc344355450">Appendix E<span style=
18883 'font:7.0pt "Times New Roman"'> </span>
18884 <a id="annotated" name="annotated">
18885 Annotated Bibliography</a></a></p>
18886 <h4 style='margin-left:0in;text-indent:0in'>Splint</h4>
18887 <p class="TextFontCX">All of these papers are available at
18888 <span style='font-size:10.0pt;font-family:Arial'><a href=
18889 "http://www.splint.org/publications/">http://www.splint.org/publications/</a></span>. </p>
18890 <p class="TextFontCX"> </p>
18891 <p class="TextFontCX" align="left" style='text-align: left'>
18892 [Barker01] Chris Barker. <i>Static Error Checking of C Applications
18893 Ported from UNIX to WIN32 Systems Using LCLint</i>. Senior Thesis,
18894 University of Virginia Deptartment of Computer Science. May
18896 <p class="TextFontCX" align="left" style='text-align: left'>
18898 <p class="IndentText">Describes annotations and checks useful for
18899 porting applications.</p>
18900 <p class="TextFontCX" align="left" style='text-align: left'>
18902 <p class="TextFontCX" align="left" style='text-align: left'>
18903 [Evans94] David Evans. <i>Using specifications to check source
18904 code</i>. MIT/LCS/TR 628, Laboratory for Computer Science,
18905 MIT, June 1994.</p>
18906 <p class="TextFontCX" align="left" style='text-align: left'>
18908 <p class="IndentText">MIT SM Thesis. Describes research
18909 behind Splint, focusing on how specifications can be exploited to
18910 do lightweight checking. Includes case studies using
18912 <p class="TextFontCX" align="left" style='text-align: left'>
18914 <p class="TextFontCX" align="left" style='text-align: left'>
18915 [EGHT94] David Evans, John Guttag, Jim Horning and Yang Meng
18916 Tan. <i>LCL</i><i>int: A tool for using specifications to
18917 check code</i>. SIGSOFT Symposium on the Foundations of
18918 Software Engineering, December 1994.</p>
18919 <p class="TextFontCX" align="left" style='text-align: left'>
18921 <p class="IndentText">Somewhat obsolete introduction to
18922 LCLint. Shows how LCLint is used to find errors in a sample
18924 <p class="TextFontCX" align="left" style='text-align: left'>
18926 <p class="TextFontCX" align="left" style='text-align: left'>
18927 [Evans96] David Evans. <i>Static Detection of Dynamic Memory
18928 Errors</i>. SIGPLAN Conference on Programming Language Design
18929 and Implementation (PLDI ’96), Philadelphia, PA., May
18931 <p class="TextFontCX" align="left" style='text-align: left'>
18933 <p class="IndentText">Describes approach for exploiting annotations
18934 added to code to detect a wide class of errors. Focuses on
18935 memory management checks described in Section 5 of this
18937 <p class="TextFontCX" align="left" style='text-align: left'>
18939 <p class="TextFontCX" align="left" style='text-align: left'>
18940 [Evans00] David Evans. <i>Annotation-Assisted Lightweight
18941 Static Checking. </i> First International Workshop on
18942 Automated Program Analysis, Testing and Verification.
18943 February, 2000.</p>
18944 <p class="IndentText"> </p>
18945 <p class="IndentText">Short position paper describing research
18946 agenda behind Splint.</p>
18947 <p class="IndentText" style='margin-left:0in'> </p>
18948 <p class="IndentText" style='margin-left:0in'>[Evans02] David Evans
18949 and David Larochelle. <i>Improving Security Using Extensible
18950 Lightweight Static Analysis</i>. IEEE Software, Jan/Feb
18952 <p class="IndentText" style='margin-left:0in'> </p>
18953 <p class="IndentText">Most security attacks exploit instances of
18954 well-known classes of implementations flaws. This article
18955 describes how Splint can be used to detect common security
18956 vulnerabilities (including buffer overflows and format string
18957 vulnerabilities).</p>
18958 <p class="IndentText"> </p>
18959 <p class="IndentText" style='margin-left:0in'>[Larochelle01] David
18960 Larochelle and David Evans. Statically Detecting Likely
18961 Buffer Overflow Vulnerabilities. 2001 USENIX Security
18962 Symposium, Washington, D. C., August 13-17, 2001. </p>
18963 <p class="IndentText"> </p>
18964 <p class="IndentText">Buffer overflow attacks may be today's single
18965 most important security threat. This paper describes how Splint can
18966 be used to detect likely vulnerabilities through an analysis of the
18967 program source code and presents experience using our approach to
18968 detect buffer overflow vulnerabilities in two security-sensitive
18970 <p class="IndentText"> </p>
18971 <h4 style='margin-left:0in;text-indent:0in'>C</h4>
18972 <p class="TextFontCX" align="left" style='text-align: left'>[ISO99]
18973 International Standard ISO/IEC 9899. <i>Programming languages
18974 – C.</i> Second edition. December 1999.</p>
18975 <p class="IndentText"> </p>
18976 <p class="IndentText">International standard specification for C
18977 programming language. Approved by ANSI May 2000.</p>
18978 <p class="TextFontCX" align="left" style='text-align: left'>
18980 <p class="TextFontCX" align="left" style='text-align: left'>[KR88]
18981 Brian W. Kernighan and Dennis M. Ritchie. <i>The C
18982 Programming Language</i>, second edition. Prentice Hall, New
18984 <p class="TextFontCX" align="left" style='text-align: left'>
18986 <p class="IndentText">Standard reference for ANSI C. If you
18987 haven’t heard of this one, you probably didn’t get this
18988 far (unless you started at the back).</p>
18989 <p class="TextFontCX" align="left" style='text-align: left'>
18991 <p class="TextFontCX" align="left" style='text-align: left'>[vdL94]
18992 Peter van der Linden. <i>Expert C Programming: Deep C
18993 Secrets</i>. SunSoft Press, Prentice Hall, New Jersey,
18995 <p class="TextFontCX" align="left" style='text-align: left'>
18997 <p class="IndentText">Filled with useful information on the darker
18998 corners of C, as well as lots of industry anecdotes and
18999 humor. Splint’s reserved name checking is loosely based
19000 on the list of reserved names in this book.</p>
19001 <h4 style='margin-left:0in;text-indent:0in'>Methodology</h4>
19002 <p class="TextFontCX" align="left" style='text-align: left'>[GH93]
19003 John Guttag and James Horning with Stephen J. Garland, Kevin D.
19004 Jones, Andrés Modet, and Jeannette M. Wing. <i>Larch:
19005 Languages and Tools for Formal Specification</i>. Springer-Verlag,
19006 Texts and Monographs in Computer Science, 1993.</p>
19007 <p class="IndentText"> </p>
19008 <p class="IndentText">Overview of the Larch family of specification
19009 languages and related tools. Includes a chapter on LCL, the
19010 Larch C interface language, on which Splint is based.</p>
19011 <p class="IndentText" style='margin-left:0in'> </p>
19012 <p class="TextFontCX" align="left" style='text-align: left'>[LG86]
19013 Barbara Liskov and John Guttag. <i>Abstraction and
19014 Specification in Program Development</i>, MIT Press, Cambridge, MA,
19016 <p class="IndentText"> </p>
19017 <p class="IndentText">Describes a programming methodology using
19018 abstract types and specified interfaces. Much of the
19019 methodology upon which Splint is based comes from this book.
19020 Uses the CLU programming language. </p>
19021 <p class="IndentText"> </p>
19022 <p class="TextFontCX" align="left" style='text-align: left'>
19023 [Liskov01] Barbara Liskov with John Guttag. <i>Program
19024 Development in Java</i>, Addison Wesley, 2001.</p>
19025 <p class="IndentText"> </p>
19026 <p class="IndentText">An updated version of [LG86] for the Java
19027 programming language. </p>
19028 <p class="IndentText"> </p>
19029 <p class="TextFontCX" align="left" style='text-align: left'>[Tan95]
19030 Yang Meng Tan. <i>Formal Specification Techniques for
19031 Engineering Modular C</i>. Kluwer International Series in
19032 Software Engineering, Volume 1, Kluwer Academic Publishers, Boston,
19034 <p class="MsoNormal" align="left" style='text-align:left'>
19036 <p class="IndentText">Modified and updated version of MIT Ph D
19037 thesis, previously published as MIT/LCS/TR-619, 1994.
19038 Includes presentation of the semantics of LCL and a case study
19040 <p class="IndentText" style='margin-left:0in'> </p>
19041 <h4 style='margin-left:0in;text-indent:0in'>Secure Programming</h4>
19042 <p class="TextFontCX" align="left" style='text-align: left'>[Hat95]
19043 Les Hatton. <i>Safer C: Developing Software for
19044 High-integrity and Safety-critical Systems</i>. McGraw-Hill
19045 International Series in Software Engineering, 1995.</p>
19046 <p class="TextFontCX" align="left" style='text-align: left'>
19048 <p class="IndentText">A broad work on all aspects of developing
19049 safety-critical software, focusing on the C language.
19050 Provides good justification for the use of C in safety-critical
19051 systems, and the necessity of tool-supported programming
19052 standards. Splint users will be interested to see how many of
19053 the errors listed as only being dynamically detectable can be
19054 detected statically by Splint.</p>
19055 <p class="IndentText" style='margin-left:0in'> </p>
19056 <p class="IndentText" style='margin-left:0in'>[VM02] John Viega and
19057 Gary McGraw. <i>Building Secure Software: How to Avoid
19058 Security Problems the</i> <i>Right Way</i><i>.</i>
19059 Addison-Wesley, 2002.</p>
19060 <p class="IndentText">A comprehensive survey of techniques and
19061 principles for building secure programs.</p>
19062 <p class="IndentText" style='margin-left:0in'> </p>
19063 <p class="IndentText" style='margin-left:0in'>See also [Evans02]
19065 [Larochelle01].</p></center></center></center></center></center></center></center></center></center></center></center></div>
19067 'font-size:11.0pt;font-family:"Times New Roman"'><br clear="all"
19068 style='page-break-before:right'></span>
19071 'font-size:11.0pt;font-family:"Times New Roman"'><br clear="all"
19072 style='page-break-before:auto'></span>
19073 <div class="Section8">
19074 <p class="IndentText"> </p></div>
19075 <div><br clear="all">
19077 <hr align="left" size="1" width="33%">
19079 <p class="MsoFootnoteText"><a href="#_ftnref1" name="_ftn1"
19080 title=""><span class="MsoFootnoteReference"><span class=
19081 "MsoFootnoteReference"><span style=
19082 'font-size:10.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>
19083 Lint is a common programming tool for detecting anomalies in C
19084 programs. S. C. Johnson developed the original lint in the
19085 late seventies, mainly because early versions of C did not
19086 support function prototypes. Splint was originally named
19087 LCLint because it was originally intended to check for
19088 inconsistencies between LCL specifications and C
19089 implementations. To reflect divergence from LCL and
19090 increased focus on detecting security vulnerabilities, the name
19091 was changed to Splint, short for “Specification
19092 Lint” and “Secure Programming Lint”.</p></div>
19094 <p class="MsoFootnoteText"><a href="#_ftnref2" name="_ftn2"
19095 title=""><span class="MsoFootnoteReference"><span class=
19096 "MsoFootnoteReference"><span style=
19097 'font-size:10.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>
19098 The meta-notation, <span class="Annot">item,<sup>+</sup></span>
19099 is used to denote a comma separated list of items. For
19101
19102 <span class="Annot">/*@access mstring, intSet@*/</span></p>
19103 <p class="MsoFootnoteText">allows access to the representations of
19104 both <span class="CodeText">mstring</span> and <span class=
19105 "CodeText">intSet</span>.) </p></div>
19107 <p class="MsoFootnoteText"><a href="#_ftnref3" name="_ftn3"
19108 title=""><span class="MsoFootnoteReference"><span class=
19109 "MsoFootnoteReference"><span style=
19110 'font-size:10.0pt;font-family:"Times New Roman"'>[3]</span></span></span></a>
19111 This section is largely based on [Evans96]. It
19112 semi-formally defines some of the terms needed to describe
19113 memory management checking; if you are satisfied with an
19114 intuitive understanding of these terms, this section may be
19117 <p class="MsoFootnoteText"><a href="#_ftnref4" name="_ftn4"
19118 title=""><span class="MsoFootnoteReference"><span class=
19119 "MsoFootnoteReference"><span style=
19120 'font-size:10.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>
19121 This is similar to the LISP storage model, except that objects
19122 are typed.</p></div>
19124 <p class="TextFontCX"><a href="#_ftnref5" name="_ftn5" title=
19125 ""><span class="MsoFootnoteReference"><span class=
19126 "MsoFootnoteReference"><span style=
19127 'font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>
19128 <span style='font-size:10.0pt'>Except</span> <span class=
19129 "CodeText"><span style=
19130 'font-size:10.0pt'>sizeof</span></span><span style=
19131 'font-size:10.0pt'>, which does not need the value of its
19132 argument.</span></p></div>
19134 <p class="TextFontCX"><a href="#_ftnref6" name="_ftn6" title=
19135 ""><span class="MsoFootnoteReference"><span class=
19136 "MsoFootnoteReference"><span style=
19137 'font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>
19138 If the storage is not assigned to a reference, an internal
19139 reference is created to track the storage.</p></div>
19141 <p class="MsoFootnoteText"><a href="#_ftnref7" name="_ftn7"
19142 title=""><span class="MsoFootnoteReference"><span class=
19143 "MsoFootnoteReference"><span style=
19144 'font-size:10.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a>
19145 The declaration of <span class="CodeText">free</span> has a
19146 <span class="Annot">null</span> annotation on the parameter
19147 to indicate that the argument may be <span class=
19148 "CodeText">NULL</span>. According to [ISO, 7.20.3.2],
19149 <span class="CodeText">NULL</span> may be passed to
19150 <span class="CodeText">free</span> without no action.
19151 On some UNIX platforms, passing <span class=
19152 "CodeText">NULL</span> to free causes a program crash so the
19153 UNIX version of the standard library specifies <span class=
19154 "CodeText">free</span> without the <span class=
19155 "Annot">null</span> annotation on its parameter. To check
19156 that allocated objects are completely destroyed (e.g., all
19157 unshared objects inside a structure are deallocated before
19158 the structure is deallocated), Splint checks that any
19159 parameter passed as an <span class="CodeText">out only void
19160 *</span> does not contain references to live, unshared
19161 objects. This makes sense, since such a parameter could
19162 not be used sensibly in any way other than deallocating its
19165 <p class="MsoFootnoteText"><a href="#_ftnref8" name="_ftn8"
19166 title=""><span class="MsoFootnoteReference"><span class=
19167 "MsoFootnoteReference"><span style=
19168 'font-size:10.0pt;font-family:"Times New Roman"'>[8]</span></span></span></a>
19169 In versions of Splint before 3.0, the <span class=
19170 "Annot">noreturn</span> annotation was named <span class=
19171 "Annot">exits</span>. The <span class=
19172 "Annot">noreturn</span> annotation means the same thing, but is
19173 a more appropriate name. For legacy code, Splint still
19174 supports the <span class="Annot">exits</span> annotations.
19175 Similarly, <span class="Annot">maynotreturn</span> replaces
19176 <span class="Annot">mayexit</span>, <span class=
19177 "Annot">noreturnwhentrue</span> replaces <span class=
19178 "Annot">truexit</span> and <span class=
19179 "Annot">noreturnwhenfalse</span> replaces <span class=
19180 "Annot">falseexit</span>.</p></div>
19182 <p class="MsoFootnoteText"><a href="#_ftnref9" name="_ftn9"
19183 title=""><span class="MsoFootnoteReference"><span class=
19184 "MsoFootnoteReference"><span style=
19185 'font-size:10.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>The
19186 <span class="Annot">sef</span> annotation denotes a parameter as
19187 side effect free (see Section 11.2.1). We use
19188 <span class="CodeText">bool /*@alt int@*/</span> as the type
19189 of the parameter, to indicate that it may be either a Boolean
19190 or an integer.</p></div>
19192 <p class="MsoFootnoteText"><a href="#_ftnref10" name="_ftn10"
19193 title=""><span class="MsoFootnoteReference"><span class=
19194 "MsoFootnoteReference"><span style=
19195 'font-size:10.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>
19196 Peter van der Linden estimates that default fall through is the
19197 wrong behavior 97% of the time. [vdL95, p. 37]</p></div>
19199 <p class="MsoFootnoteText"><a href="#_ftnref11" name="_ftn11"
19200 title=""><span class="MsoFootnoteReference"><span class=
19201 "MsoFootnoteReference"><span style=
19202 'font-size:10.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>
19203 “Software Glitch Cripples AT&T Network”,
19204 Telephony, 22 January 1990.</p></div>
19206 <p class="MsoFootnoteText"><a href="#_ftnref12" name="_ftn12"
19207 title=""><span class="MsoFootnoteReference"><span class=
19208 "MsoFootnoteReference"><span style=
19209 'font-size:10.0pt;font-family:"Times New Roman"'>[12]</span></span></span></a>
19210 See [Larochelle01] for information on internal aspects of the
19211 checking.</p></div>
19213 <p class="MsoFootnoteText"><a href="#_ftnref13" name="_ftn13"
19214 title=""><span class="MsoFootnoteReference"><span class=
19215 "MsoFootnoteReference"><span style=
19216 'font-size:10.0pt;font-family:"Times New Roman"'>[13]</span></span></span></a>
19217 This section is largely based on [Evans02].</p></div>
19219 <p class="MsoFootnoteText"><a href="#_ftnref14" name="_ftn14"
19220 title=""><span class="MsoFootnoteReference"><span class=
19221 "MsoFootnoteReference"><span style=
19222 'font-size:10.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>
19223 C. Cowan et al., <i>FormatGuard: Automatic Protection from
19224 printf Format String Vulnerabilities</i>. 10th Usenix
19225 Security Symposium, 2001.</p></div>
19227 <p class="MsoFootnoteText"><a href="#_ftnref15" name="_ftn15"
19228 title=""><span class="MsoFootnoteReference"><span class=
19229 "MsoFootnoteReference"><span style=
19230 'font-size:10.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>
19231 To be completely correct, all the macro parameters should be
19232 evaluated before the macro has any side effects. Splint
19233 does not check this.</p></div>
19235 <p class="MsoFootnoteText"><a href="#_ftnref16" name="_ftn16"
19236 title=""><span class="MsoFootnoteReference"><span class=
19237 "MsoFootnoteReference"><span style=
19238 'font-size:10.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>
19239 Functions that do not produce to the same result each time they
19240 are called with the same arguments should be declared to modify
19241 <span class="Annot">internalState</span> so they will lead to
19242 errors if they are passed as <span class="Annot">sef</span>
19243 parameters.</p></div>
19245 <p class="MsoFootnoteText"><a href="#_ftnref17" name="_ftn17"
19246 title=""><span class="MsoFootnoteReference"><span class=
19247 "MsoFootnoteReference"><span style=
19248 'font-size:10.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>
19249 The most renowned C naming convention is the Hungarian naming
19250 convention, introduced by Charles Simonyi [Simonyi, Charles, and
19251 Martin Heller. “The Hungarian
19252 Revolution.” <i>BYTE</i>, August 1991, p.
19253 131-38]. The names for Splint naming conventions follow
19254 the tradition of using Central European nationalities as
19255 mnemonics for naming conventions. The Splint conventions
19256 are similar to the Hungarian naming convention in that they
19257 encode type information in names, except that the Splint
19258 conventions encode the names of accessible abstract
19259 types instead of the type of the declaration of return
19260 value. Prefixes used in the Hungarian naming convention
19261 are not supported by Splint.</p>
19262 <p class="MsoFootnoteText"> </p></div>
19264 <p class="MsoFootnoteText"><a href="#_ftnref18" name="_ftn18"
19265 title=""><span class="MsoFootnoteReference"><span class=
19266 "MsoFootnoteReference"><span style=
19267 'font-size:10.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>
19268 Of course, namespace prefixes should really be described by
19269 regular expressions. If there is sufficient interest (that
19270 is, someone volunteers to program it), regular expressions will
19271 be supported in a future version of Splint.</p></div>
19273 <p class="MsoFootnoteText"><a href="#_ftnref19" name="_ftn19"
19274 title=""><span class="MsoFootnoteReference"><span class=
19275 "MsoFootnoteReference"><span style=
19276 'font-size:10.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>
19277 POSIX library was contributed by Jens
19278 Schweikhardt.</p></div></div>
19279 <!--#include virtual="footer.html"-->
andersk / splint.git / blob