3 <link rel="stylesheet" type="text/css" href="http://www.splint.org/manual.css" title="style1">
\r
4 <title>Splint Manual</title>
\r
7 <!--#include virtual="header.html"-->
\r
11 /* Font Definitions */
\r
13 {font-family:Helvetica;
\r
14 panose-1:2 11 5 4 2 2 2 2 2 4;}
\r
16 {font-family:Courier;
\r
17 panose-1:2 7 4 9 2 2 5 2 4 4;}
\r
19 {font-family:"Tms Rmn";
\r
20 panose-1:2 2 6 3 4 5 5 2 3 4;}
\r
23 panose-1:2 11 6 4 2 2 2 3 2 4;}
\r
25 {font-family:"New York";
\r
26 panose-1:2 4 5 3 6 5 6 2 3 4;}
\r
28 {font-family:System;
\r
29 panose-1:0 0 0 0 0 0 0 0 0 0;}
\r
31 {font-family:Wingdings;
\r
32 panose-1:5 0 0 0 0 0 0 0 0 0;}
\r
34 {font-family:"MS Mincho";
\r
35 panose-1:2 2 6 9 4 2 5 8 3 4;}
\r
37 {font-family:Batang;
\r
38 panose-1:2 3 6 0 0 1 1 1 1 1;}
\r
40 {font-family:SimSun;
\r
41 panose-1:2 1 6 0 3 1 1 1 1 1;}
\r
43 {font-family:PMingLiU;
\r
44 panose-1:2 1 6 1 0 1 1 1 1 1;}
\r
46 {font-family:"MS Gothic";
\r
47 panose-1:2 11 6 9 7 2 5 8 2 4;}
\r
50 panose-1:2 11 6 0 0 1 1 1 1 1;}
\r
52 {font-family:SimHei;
\r
53 panose-1:2 1 6 0 3 1 1 1 1 1;}
\r
55 {font-family:MingLiU;
\r
56 panose-1:2 1 6 9 0 1 1 1 1 1;}
\r
58 {font-family:Mincho;
\r
59 panose-1:2 2 6 9 4 3 5 8 3 5;}
\r
62 panose-1:2 11 6 0 0 1 1 1 1 1;}
\r
64 {font-family:Century;
\r
65 panose-1:2 4 6 3 5 7 5 2 3 3;}
\r
67 {font-family:"Angsana New";
\r
68 panose-1:2 2 6 3 5 4 5 2 3 4;}
\r
70 {font-family:"Cordia New";
\r
71 panose-1:2 11 3 4 2 2 2 2 2 4;}
\r
73 {font-family:Mangal;
\r
74 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
77 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
79 {font-family:Sylfaen;
\r
80 panose-1:1 10 5 2 5 3 6 3 3 3;}
\r
82 {font-family:Vrinda;
\r
83 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
86 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
88 {font-family:Shruti;
\r
89 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
91 {font-family:Sendnya;
\r
92 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
94 {font-family:Gautami;
\r
95 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
98 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
100 {font-family:"Estrangella Edessa";
\r
101 panose-1:0 0 0 0 0 0 0 0 0 0;}
\r
103 {font-family:"Arial Unicode MS";
\r
104 panose-1:0 0 0 0 0 0 0 0 0 0;}
\r
106 {font-family:Tahoma;
\r
107 panose-1:2 11 6 4 3 5 4 4 2 4;}
\r
109 {font-family:"Book Antiqua";
\r
110 panose-1:2 4 6 2 5 3 5 3 3 4;}
\r
112 {font-family:"Arial Narrow";
\r
113 panose-1:2 11 5 6 2 2 2 3 2 4;}
\r
115 {font-family:Times;
\r
116 panose-1:0 0 0 0 0 0 0 0 0 0;}
\r
118 {font-family:Marlett;
\r
119 panose-1:0 0 0 0 0 0 0 0 0 0;}
\r
121 {font-family:"News Gothic MT";
\r
122 panose-1:2 11 5 4 2 2 3 2 2 4;}
\r
124 {font-family:"Lucida Sans Unicode";
\r
125 panose-1:2 11 6 2 3 5 4 2 2 4;}
\r
127 {font-family:"Century Gothic";
\r
128 panose-1:2 11 5 2 2 2 2 2 2 4;}
\r
130 {font-family:"Abadi MT Condensed Light";
\r
131 panose-1:2 11 3 6 3 1 1 1 1 3;}
\r
133 {font-family:"Matisse ITC";
\r
134 panose-1:4 4 4 3 3 13 2 2 7 4;}
\r
136 {font-family:Westminster;
\r
137 panose-1:4 4 5 6 3 15 2 2 7 2;}
\r
139 {font-family:"Lucida Console";
\r
140 panose-1:2 11 6 9 4 5 4 2 2 4;}
\r
142 {font-family:"Arial Black";
\r
143 panose-1:2 11 10 4 2 1 2 2 2 4;}
\r
145 {font-family:"Comic Sans MS";
\r
146 panose-1:3 15 7 2 3 3 2 2 2 4;}
\r
148 {font-family:Verdana;
\r
149 panose-1:2 11 6 4 3 5 4 4 2 4;}
\r
151 {font-family:Webdings;
\r
152 panose-1:5 3 1 2 1 5 9 6 7 3;}
\r
154 {font-family:"Verdana Ref";
\r
155 panose-1:2 11 6 4 3 5 4 4 2 4;}
\r
157 {font-family:"Georgia Ref";
\r
158 panose-1:2 4 5 2 5 4 5 2 3 3;}
\r
160 {font-family:RefSpecialty;
\r
161 panose-1:2 0 5 0 0 0 0 0 0 0;}
\r
163 {font-family:"MS Reference 1";
\r
164 panose-1:5 0 0 0 0 0 0 0 0 0;}
\r
166 {font-family:"MS Reference 2";
\r
167 panose-1:0 0 0 0 0 0 0 0 0 0;}
\r
169 {font-family:Money;
\r
170 panose-1:0 0 4 0 0 0 0 0 0 0;}
\r
172 {font-family:"Mediascape OSD Icon";
\r
173 panose-1:2 11 6 3 5 3 2 2 2 4;}
\r
175 {font-family:Pronto;
\r
176 panose-1:2 11 7 3 3 0 0 0 0 7;}
\r
178 {font-family:"Agency FB";
\r
179 panose-1:0 1 6 6 4 0 0 4 0 3;}
\r
181 {font-family:Algerian;
\r
182 panose-1:4 2 7 5 4 10 2 6 7 2;}
\r
184 {font-family:"Arial Rounded MT Bold";
\r
185 panose-1:2 15 7 4 3 5 4 3 2 4;}
\r
187 {font-family:"Baskerville Old Face";
\r
188 panose-1:2 2 6 2 8 5 5 2 3 3;}
\r
190 {font-family:"Bauhaus 93";
\r
191 panose-1:4 3 9 5 2 11 2 2 12 2;}
\r
193 {font-family:"Bell MT";
\r
194 panose-1:2 2 5 3 6 3 5 2 3 3;}
\r
196 {font-family:"Berlin Sans FB";
\r
197 panose-1:2 14 6 2 2 5 2 2 3 6;}
\r
199 {font-family:"Bernard MT Condensed";
\r
200 panose-1:2 5 8 6 6 9 5 2 4 4;}
\r
202 {font-family:"Blackadder ITC";
\r
203 panose-1:4 2 5 5 5 16 7 2 13 2;}
\r
205 {font-family:"Bookman Old Style";
\r
206 panose-1:2 5 6 4 5 5 5 2 2 4;}
\r
208 {font-family:"Bradley Hand ITC";
\r
209 panose-1:3 7 4 2 5 3 2 3 2 3;}
\r
211 {font-family:"Britannic Bold";
\r
212 panose-1:2 11 9 3 6 7 3 2 2 4;}
\r
214 {font-family:Broadway;
\r
215 panose-1:4 4 9 5 8 11 2 2 5 2;}
\r
217 {font-family:"Brush Script MT";
\r
218 panose-1:3 6 8 2 4 4 6 7 3 4;}
\r
220 {font-family:"Californian FB";
\r
221 panose-1:2 7 4 3 6 8 11 3 2 4;}
\r
223 {font-family:"Calisto MT";
\r
224 panose-1:2 4 6 3 5 5 5 3 3 4;}
\r
226 {font-family:Castellar;
\r
227 panose-1:2 10 4 2 6 4 6 1 3 1;}
\r
229 {font-family:Centaur;
\r
230 panose-1:2 3 5 4 5 2 5 2 3 4;}
\r
232 {font-family:"Century Schoolbook";
\r
233 panose-1:2 4 6 4 5 5 5 2 3 4;}
\r
235 {font-family:Chiller;
\r
236 panose-1:4 2 4 4 3 16 7 2 6 2;}
\r
238 {font-family:"Colonna MT";
\r
239 panose-1:4 2 8 5 6 2 2 3 2 3;}
\r
241 {font-family:"Cooper Black";
\r
242 panose-1:2 8 9 4 4 3 11 2 4 4;}
\r
244 {font-family:"Copperplate Gothic Bold";
\r
245 panose-1:2 14 7 5 2 2 6 2 4 4;}
\r
247 {font-family:"Copperplate Gothic Light";
\r
248 panose-1:2 14 5 7 2 2 6 2 4 4;}
\r
250 {font-family:"Curlz MT";
\r
251 panose-1:4 4 4 4 5 7 2 2 2 2;}
\r
253 {font-family:"Edwardian Script ITC";
\r
254 panose-1:3 3 3 2 4 7 7 13 8 4;}
\r
256 {font-family:Elephant;
\r
257 panose-1:2 2 9 4 9 5 5 2 3 3;}
\r
259 {font-family:"Engravers MT";
\r
260 panose-1:2 9 7 7 8 5 5 2 3 4;}
\r
262 {font-family:"Eras Bold ITC";
\r
263 panose-1:2 11 9 7 3 5 4 2 2 4;}
\r
265 {font-family:"Eras Demi ITC";
\r
266 panose-1:2 11 8 5 3 5 4 2 8 4;}
\r
268 {font-family:"Eras Light ITC";
\r
269 panose-1:2 11 4 2 3 5 4 2 8 4;}
\r
271 {font-family:"Eras Medium ITC";
\r
272 panose-1:2 11 6 2 3 5 4 2 8 4;}
\r
274 {font-family:"Felix Titling";
\r
275 panose-1:4 6 5 5 6 2 2 2 10 4;}
\r
277 {font-family:"Footlight MT Light";
\r
278 panose-1:2 4 6 2 6 3 10 2 3 4;}
\r
280 {font-family:Forte;
\r
281 panose-1:3 6 9 2 4 5 2 7 2 3;}
\r
283 {font-family:"Franklin Gothic Book";
\r
284 panose-1:2 11 5 3 2 1 2 2 2 4;}
\r
286 {font-family:"Franklin Gothic Demi";
\r
287 panose-1:2 11 7 3 2 1 2 2 2 4;}
\r
289 {font-family:"Franklin Gothic Demi Cond";
\r
290 panose-1:2 11 7 6 3 4 2 2 2 4;}
\r
292 {font-family:"Franklin Gothic Heavy";
\r
293 panose-1:2 11 9 3 2 1 2 2 2 4;}
\r
295 {font-family:"Franklin Gothic Medium";
\r
296 panose-1:2 11 6 3 2 1 2 2 2 4;}
\r
298 {font-family:"Franklin Gothic Medium Cond";
\r
299 panose-1:2 11 6 6 3 4 2 2 2 4;}
\r
301 {font-family:"Freestyle Script";
\r
302 panose-1:3 8 4 2 3 2 5 11 4 4;}
\r
304 {font-family:"French Script MT";
\r
305 panose-1:3 2 4 2 4 6 7 4 6 5;}
\r
307 {font-family:Garamond;
\r
308 panose-1:2 2 4 4 3 3 1 1 8 3;}
\r
311 panose-1:4 4 5 4 6 16 7 2 13 2;}
\r
313 {font-family:"Gill Sans MT";
\r
314 panose-1:2 11 5 2 2 1 4 2 2 3;}
\r
316 {font-family:"Gill Sans MT Condensed";
\r
317 panose-1:2 11 5 6 2 1 4 2 2 3;}
\r
319 {font-family:"Gill Sans Ultra Bold";
\r
320 panose-1:2 11 10 2 2 1 4 2 2 3;}
\r
322 {font-family:"Gill Sans Ultra Bold Condensed";
\r
323 panose-1:2 11 10 6 2 1 4 2 2 3;}
\r
325 {font-family:"Gill Sans MT Ext Condensed Bold";
\r
326 panose-1:2 11 9 2 2 1 4 2 2 3;}
\r
328 {font-family:"Gloucester MT Extra Condensed";
\r
329 panose-1:2 3 8 8 2 6 1 1 1 1;}
\r
331 {font-family:"Goudy Old Style";
\r
332 panose-1:2 2 5 2 5 3 5 2 3 3;}
\r
334 {font-family:"Goudy Stout";
\r
335 panose-1:2 2 9 4 7 3 11 2 4 1;}
\r
337 {font-family:Haettenschweiler;
\r
338 panose-1:2 11 7 6 4 9 2 6 2 4;}
\r
340 {font-family:"Harlow Solid Italic";
\r
341 panose-1:4 3 6 4 2 15 2 2 13 2;}
\r
343 {font-family:Harrington;
\r
344 panose-1:4 4 5 5 5 10 2 2 7 2;}
\r
346 {font-family:"High Tower Text";
\r
347 panose-1:2 4 5 2 5 5 6 3 3 3;}
\r
349 {font-family:"Imprint MT Shadow";
\r
350 panose-1:4 2 6 5 6 3 3 3 2 2;}
\r
352 {font-family:Jokerman;
\r
353 panose-1:4 9 6 5 6 13 6 2 7 2;}
\r
355 {font-family:"Juice ITC";
\r
356 panose-1:4 4 4 3 4 10 2 2 2 2;}
\r
358 {font-family:"Kristen ITC";
\r
359 panose-1:3 5 5 2 4 2 2 3 2 2;}
\r
361 {font-family:"Kunstler Script";
\r
362 panose-1:3 3 4 2 2 6 7 13 13 6;}
\r
364 {font-family:"Lucida Bright";
\r
365 panose-1:2 4 6 2 5 5 5 2 3 4;}
\r
367 {font-family:"Lucida Calligraphy";
\r
368 panose-1:3 1 1 1 1 1 1 1 1 1;}
\r
370 {font-family:"Lucida Fax";
\r
371 panose-1:2 6 6 2 5 5 5 2 2 4;}
\r
373 {font-family:"Lucida Handwriting";
\r
374 panose-1:3 1 1 1 1 1 1 1 1 1;}
\r
376 {font-family:"Lucida Sans";
\r
377 panose-1:2 11 6 2 3 5 4 2 2 4;}
\r
379 {font-family:"Lucida Sans Typewriter";
\r
380 panose-1:2 11 5 9 3 5 4 3 2 4;}
\r
382 {font-family:Magneto;
\r
383 panose-1:4 3 8 5 5 8 2 2 13 2;}
\r
385 {font-family:"Maiandra GD";
\r
386 panose-1:2 14 5 2 3 3 8 2 2 4;}
\r
388 {font-family:"Matura MT Script Capitals";
\r
389 panose-1:3 2 8 2 6 6 2 7 2 2;}
\r
391 {font-family:Mistral;
\r
392 panose-1:3 9 7 2 3 4 7 2 4 3;}
\r
394 {font-family:"Modern No\. 20";
\r
395 panose-1:2 7 7 4 7 5 5 2 3 3;}
\r
397 {font-family:"Niagara Engraved";
\r
398 panose-1:4 2 5 2 7 7 3 3 2 2;}
\r
400 {font-family:"Niagara Solid";
\r
401 panose-1:4 2 5 2 7 7 2 2 2 2;}
\r
403 {font-family:"OCR A Extended";
\r
404 panose-1:2 1 5 9 2 1 2 1 3 3;}
\r
406 {font-family:"Old English Text MT";
\r
407 panose-1:3 4 9 2 4 5 8 3 8 6;}
\r
410 panose-1:4 5 6 2 8 7 2 2 2 3;}
\r
412 {font-family:"Palace Script MT";
\r
413 panose-1:3 3 3 2 2 6 7 12 11 5;}
\r
415 {font-family:Papyrus;
\r
416 panose-1:3 7 5 2 6 5 2 3 2 5;}
\r
418 {font-family:Parchment;
\r
419 panose-1:3 4 6 2 4 7 8 4 8 4;}
\r
421 {font-family:Perpetua;
\r
422 panose-1:2 2 5 2 6 4 1 2 3 3;}
\r
424 {font-family:"Perpetua Titling MT";
\r
425 panose-1:2 2 5 2 6 5 5 2 8 4;}
\r
427 {font-family:Playbill;
\r
428 panose-1:4 5 6 3 10 6 2 2 2 2;}
\r
430 {font-family:"Poor Richard";
\r
431 panose-1:2 8 5 2 5 5 5 2 7 2;}
\r
433 {font-family:Pristina;
\r
434 panose-1:3 6 4 2 4 4 6 8 2 4;}
\r
436 {font-family:"Rage Italic";
\r
437 panose-1:3 7 5 2 4 5 7 7 3 4;}
\r
439 {font-family:Ravie;
\r
440 panose-1:4 4 8 5 5 8 9 2 6 2;}
\r
442 {font-family:Rockwell;
\r
443 panose-1:2 6 6 3 2 2 5 2 4 3;}
\r
445 {font-family:"Rockwell Condensed";
\r
446 panose-1:2 6 6 3 5 4 5 2 1 4;}
\r
448 {font-family:"Rockwell Extra Bold";
\r
449 panose-1:2 6 9 3 4 5 5 2 4 3;}
\r
451 {font-family:"Informal Roman";
\r
452 panose-1:3 6 4 2 3 4 6 11 2 4;}
\r
454 {font-family:"Script MT Bold";
\r
455 panose-1:3 4 6 2 4 6 7 8 9 4;}
\r
457 {font-family:"Showcard Gothic";
\r
458 panose-1:4 2 9 4 2 1 2 2 6 4;}
\r
460 {font-family:"Snap ITC";
\r
461 panose-1:4 4 10 7 6 10 2 2 2 2;}
\r
463 {font-family:Stencil;
\r
464 panose-1:4 4 9 5 13 8 2 2 4 4;}
\r
466 {font-family:"Tempus Sans ITC";
\r
467 panose-1:4 2 4 4 3 13 7 2 2 2;}
\r
469 {font-family:"Trebuchet MS";
\r
470 panose-1:2 11 6 3 2 2 2 2 2 4;}
\r
472 {font-family:"Tw Cen MT";
\r
473 panose-1:2 11 6 2 2 1 4 2 6 3;}
\r
475 {font-family:"Tw Cen MT Condensed";
\r
476 panose-1:2 11 6 6 2 1 4 2 2 3;}
\r
478 {font-family:"Viner Hand ITC";
\r
479 panose-1:3 7 5 2 3 5 2 2 2 3;}
\r
481 {font-family:Vivaldi;
\r
482 panose-1:3 2 6 2 5 5 6 9 8 4;}
\r
484 {font-family:"Vladimir Script";
\r
485 panose-1:3 5 4 2 4 4 7 7 3 5;}
\r
487 {font-family:"Wide Latin";
\r
488 panose-1:2 10 10 7 5 5 5 2 4 4;}
\r
490 {font-family:"Wingdings 2";
\r
491 panose-1:5 2 1 2 1 5 7 7 7 7;}
\r
493 {font-family:"Wingdings 3";
\r
494 panose-1:5 4 1 2 1 8 7 7 7 7;}
\r
496 {font-family:"Berlin Sans FB Demi";
\r
497 panose-1:2 14 8 2 2 5 2 2 3 6;}
\r
499 {font-family:"Tw Cen MT Condensed Extra Bold";
\r
500 panose-1:2 11 8 3 2 0 0 0 0 4;}
\r
502 {font-family:"Almanac MT";
\r
503 panose-1:5 1 1 1 1 1 1 1 1 1;}
\r
505 {font-family:"Beesknees ITC";
\r
506 panose-1:4 4 10 5 5 13 2 2 5 2;}
\r
508 {font-family:"Holidays MT";
\r
509 panose-1:5 1 1 1 1 1 1 1 1 1;}
\r
511 {font-family:"Monotype Sorts";
\r
512 panose-1:1 1 6 1 1 1 1 1 1 1;}
\r
514 {font-family:"Monotype Sorts 2";
\r
515 panose-1:5 2 1 2 1 2 8 2 8 8;}
\r
517 {font-family:"Pepita MT";
\r
518 panose-1:3 6 4 2 4 5 2 7 8 4;}
\r
520 {font-family:"Vacation MT";
\r
521 panose-1:5 1 1 1 1 1 1 1 1 1;}
\r
523 {font-family:"Map Symbols";
\r
524 panose-1:0 5 1 2 1 7 6 2 5 7;}
\r
526 {font-family:"Bookshelf Symbol 3";
\r
527 panose-1:5 5 1 2 1 7 6 2 5 7;}
\r
529 {font-family:Georgia;
\r
530 panose-1:2 4 5 2 5 4 5 2 3 3;}
\r
532 {font-family:"MS Outlook";
\r
533 panose-1:5 0 0 0 0 0 0 0 0 0;}
\r
535 {font-family:"Berling Antiqua";
\r
536 panose-1:2 2 6 2 6 4 5 3 4 2;}
\r
538 {font-family:Bookdings;
\r
539 panose-1:5 0 0 0 0 0 0 0 0 0;}
\r
541 {font-family:"Frutiger Linotype";
\r
542 panose-1:2 11 6 4 3 5 4 4 2 4;}
\r
544 {font-family:"Andale Mono";
\r
545 panose-1:2 11 5 9 0 0 0 0 0 4;}
\r
547 {font-family:Impact;
\r
548 panose-1:2 11 8 6 3 9 2 5 2 4;}
\r
550 {font-family:"Monotype Corsiva";
\r
551 panose-1:3 1 1 1 1 2 1 1 1 1;}
\r
553 {font-family:"MT Extra";
\r
554 panose-1:5 5 1 2 1 2 5 2 2 2;}
\r
556 {font-family:ProgramTwo;
\r
557 panose-1:0 0 0 0 0 0 0 0 0 0;}
\r
558 /* Style Definitions */
\r
559 p.MsoNormal, li.MsoNormal, div.MsoNormal
\r
561 margin-bottom:.0001pt;
\r
562 text-align:justify;
\r
564 font-family:"Times New Roman";}
\r
566 {margin-top:12.0pt;
\r
568 margin-bottom:3.0pt;
\r
570 text-align:justify;
\r
572 page-break-before:always;
\r
573 page-break-after:avoid;
\r
575 font-family:"Times New Roman";}
\r
577 {margin-top:12.0pt;
\r
579 margin-bottom:3.0pt;
\r
581 text-align:justify;
\r
583 page-break-after:avoid;
\r
585 font-family:"Times New Roman";}
\r
587 {margin-top:12.0pt;
\r
589 margin-bottom:3.0pt;
\r
591 text-align:justify;
\r
593 page-break-after:avoid;
\r
595 font-family:"Times New Roman";}
\r
597 {margin-top:12.0pt;
\r
599 margin-bottom:3.0pt;
\r
601 text-align:justify;
\r
603 page-break-after:avoid;
\r
605 font-family:"Times New Roman";}
\r
607 {margin-top:12.0pt;
\r
609 margin-bottom:3.0pt;
\r
611 text-align:justify;
\r
614 font-family:"Times New Roman";
\r
615 font-weight:normal;}
\r
617 {margin-top:12.0pt;
\r
619 margin-bottom:3.0pt;
\r
621 text-align:justify;
\r
624 font-family:"Times New Roman";
\r
625 font-weight:normal;
\r
626 font-style:italic;}
\r
627 p.MsoHeading7, li.MsoHeading7, div.MsoHeading7
\r
628 {margin-top:12.0pt;
\r
630 margin-bottom:3.0pt;
\r
632 text-align:justify;
\r
634 page-break-before:always;
\r
635 page-break-after:avoid;
\r
637 font-family:"Times New Roman";
\r
639 p.MsoHeading8, li.MsoHeading8, div.MsoHeading8
\r
640 {margin-top:12.0pt;
\r
642 margin-bottom:3.0pt;
\r
644 text-align:justify;
\r
646 page-break-after:avoid;
\r
648 font-family:"Times New Roman";
\r
650 p.MsoHeading9, li.MsoHeading9, div.MsoHeading9
\r
651 {margin-top:12.0pt;
\r
653 margin-bottom:3.0pt;
\r
655 text-align:justify;
\r
657 page-break-after:avoid;
\r
659 font-family:"Times New Roman";
\r
661 p.MsoIndex1, li.MsoIndex1, div.MsoIndex1
\r
665 margin-left:10.0pt;
\r
666 margin-bottom:.0001pt;
\r
667 text-align:justify;
\r
668 text-indent:-10.0pt;
\r
670 font-family:"Times New Roman";}
\r
671 p.MsoIndex2, li.MsoIndex2, div.MsoIndex2
\r
675 margin-left:20.0pt;
\r
676 margin-bottom:.0001pt;
\r
677 text-align:justify;
\r
678 text-indent:-10.0pt;
\r
680 font-family:"Times New Roman";}
\r
681 p.MsoIndex3, li.MsoIndex3, div.MsoIndex3
\r
685 margin-left:30.0pt;
\r
686 margin-bottom:.0001pt;
\r
687 text-align:justify;
\r
688 text-indent:-10.0pt;
\r
690 font-family:"Times New Roman";}
\r
691 p.MsoIndex4, li.MsoIndex4, div.MsoIndex4
\r
695 margin-left:40.0pt;
\r
696 margin-bottom:.0001pt;
\r
697 text-align:justify;
\r
698 text-indent:-10.0pt;
\r
700 font-family:"Times New Roman";}
\r
701 p.MsoIndex5, li.MsoIndex5, div.MsoIndex5
\r
705 margin-left:50.0pt;
\r
706 margin-bottom:.0001pt;
\r
707 text-align:justify;
\r
708 text-indent:-10.0pt;
\r
710 font-family:"Times New Roman";}
\r
711 p.MsoIndex6, li.MsoIndex6, div.MsoIndex6
\r
715 margin-left:60.0pt;
\r
716 margin-bottom:.0001pt;
\r
717 text-align:justify;
\r
718 text-indent:-10.0pt;
\r
720 font-family:"Times New Roman";}
\r
721 p.MsoIndex7, li.MsoIndex7, div.MsoIndex7
\r
725 margin-left:70.0pt;
\r
726 margin-bottom:.0001pt;
\r
727 text-align:justify;
\r
728 text-indent:-10.0pt;
\r
730 font-family:"Times New Roman";}
\r
731 p.MsoIndex8, li.MsoIndex8, div.MsoIndex8
\r
735 margin-left:80.0pt;
\r
736 margin-bottom:.0001pt;
\r
737 text-align:justify;
\r
738 text-indent:-10.0pt;
\r
740 font-family:"Times New Roman";}
\r
741 p.MsoIndex9, li.MsoIndex9, div.MsoIndex9
\r
745 margin-left:1.25in;
\r
746 margin-bottom:.0001pt;
\r
747 text-align:justify;
\r
748 text-indent:-10.0pt;
\r
750 font-family:"Times New Roman";}
\r
751 p.MsoToc1, li.MsoToc1, div.MsoToc1
\r
754 margin-bottom:4.0pt;
\r
756 text-align:justify;
\r
758 font-family:"Times New Roman";
\r
760 p.MsoToc2, li.MsoToc2, div.MsoToc2
\r
765 margin-bottom:.0001pt;
\r
766 text-align:justify;
\r
768 font-family:"Times New Roman";}
\r
769 p.MsoToc3, li.MsoToc3, div.MsoToc3
\r
773 margin-left:22.3pt;
\r
774 margin-bottom:.0001pt;
\r
775 text-align:justify;
\r
777 font-family:"Times New Roman";}
\r
778 p.MsoToc4, li.MsoToc4, div.MsoToc4
\r
782 margin-left:30.0pt;
\r
783 margin-bottom:.0001pt;
\r
784 text-align:justify;
\r
786 font-family:"Times New Roman";}
\r
787 p.MsoToc5, li.MsoToc5, div.MsoToc5
\r
791 margin-left:40.0pt;
\r
792 margin-bottom:.0001pt;
\r
793 text-align:justify;
\r
795 font-family:"Times New Roman";}
\r
796 p.MsoToc6, li.MsoToc6, div.MsoToc6
\r
800 margin-left:50.0pt;
\r
801 margin-bottom:.0001pt;
\r
802 text-align:justify;
\r
804 font-family:"Times New Roman";}
\r
805 p.MsoToc7, li.MsoToc7, div.MsoToc7
\r
809 margin-left:60.0pt;
\r
810 margin-bottom:.0001pt;
\r
811 text-align:justify;
\r
813 font-family:"Times New Roman";}
\r
814 p.MsoToc8, li.MsoToc8, div.MsoToc8
\r
818 margin-left:70.0pt;
\r
819 margin-bottom:.0001pt;
\r
820 text-align:justify;
\r
822 font-family:"Times New Roman";}
\r
823 p.MsoToc9, li.MsoToc9, div.MsoToc9
\r
827 margin-left:80.0pt;
\r
828 margin-bottom:.0001pt;
\r
829 text-align:justify;
\r
831 font-family:"Times New Roman";}
\r
832 p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText
\r
834 margin-bottom:.0001pt;
\r
835 text-align:justify;
\r
837 font-family:"Times New Roman";}
\r
838 p.MsoCommentText, li.MsoCommentText, div.MsoCommentText
\r
840 margin-bottom:.0001pt;
\r
841 text-align:justify;
\r
843 font-family:"Times New Roman";}
\r
844 p.MsoHeader, li.MsoHeader, div.MsoHeader
\r
846 margin-bottom:.0001pt;
\r
847 text-align:justify;
\r
849 font-family:"Times New Roman";
\r
851 font-style:italic;}
\r
852 p.MsoFooter, li.MsoFooter, div.MsoFooter
\r
854 margin-bottom:.0001pt;
\r
855 text-align:justify;
\r
857 font-family:"Times New Roman";}
\r
858 p.MsoIndexHeading, li.MsoIndexHeading, div.MsoIndexHeading
\r
860 margin-bottom:.0001pt;
\r
861 text-align:justify;
\r
863 font-family:"Times New Roman";}
\r
864 p.MsoCaption, li.MsoCaption, div.MsoCaption
\r
867 margin-bottom:6.0pt;
\r
871 font-family:"Times New Roman";
\r
873 p.MsoTof, li.MsoTof, div.MsoTof
\r
877 margin-left:22.0pt;
\r
878 margin-bottom:.0001pt;
\r
879 text-align:justify;
\r
880 text-indent:-22.0pt;
\r
882 font-family:"Times New Roman";}
\r
883 span.MsoFootnoteReference
\r
884 {vertical-align:super;}
\r
886 {vertical-align:baseline;}
\r
887 p.MsoListBullet, li.MsoListBullet, div.MsoListBullet
\r
891 margin-left:12.95pt;
\r
892 margin-bottom:.0001pt;
\r
893 text-align:justify;
\r
894 text-indent:-12.95pt;
\r
896 font-family:"Times New Roman";}
\r
897 p.MsoTitle, li.MsoTitle, div.MsoTitle
\r
898 {margin-top:12.0pt;
\r
900 margin-bottom:3.0pt;
\r
906 p.MsoSubtitle, li.MsoSubtitle, div.MsoSubtitle
\r
909 margin-bottom:3.0pt;
\r
913 font-family:Arial;}
\r
914 p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
\r
916 margin-bottom:.0001pt;
\r
919 font-family:"Times New Roman";}
\r
922 margin-bottom:.0001pt;
\r
924 font-family:"Courier New";}
\r
925 p.TextFontCX, li.TextFontCX, div.TextFontCX
\r
927 margin-bottom:.0001pt;
\r
928 text-align:justify;
\r
930 font-family:"Times New Roman";}
\r
931 p.Appendix, li.Appendix, div.Appendix
\r
932 {margin-top:12.0pt;
\r
934 margin-bottom:3.0pt;
\r
936 text-align:justify;
\r
937 page-break-after:avoid;
\r
939 font-family:"Times New Roman";
\r
941 p.Heading10, li.Heading10, div.Heading10
\r
942 {margin-top:12.0pt;
\r
944 margin-bottom:3.0pt;
\r
946 text-align:justify;
\r
947 page-break-after:avoid;
\r
949 font-family:"Times New Roman";
\r
950 letter-spacing:-.4pt;
\r
952 p.Heading11, li.Heading11, div.Heading11
\r
953 {margin-top:12.0pt;
\r
955 margin-bottom:3.0pt;
\r
957 text-align:justify;
\r
958 page-break-after:avoid;
\r
960 font-family:"Times New Roman";
\r
961 letter-spacing:-.4pt;
\r
963 font-style:italic;}
\r
965 {font-family:Tahoma;
\r
968 {font-family:Tahoma;
\r
971 {font-family:"Courier New";}
\r
973 {font-family:"Courier New";
\r
976 {font-family:Arial;
\r
977 font-style:italic;}
\r
979 {font-family:"Courier New";
\r
981 font-style:italic;}
\r
983 {font-family:"Times New Roman";
\r
984 font-style:italic;}
\r
985 p.Author, li.Author, div.Author
\r
988 margin-bottom:3.0pt;
\r
993 font-style:italic;}
\r
994 p.Verbatim, li.Verbatim, div.Verbatim
\r
996 margin-bottom:.0001pt;
\r
998 font-family:"Courier New";
\r
1000 p.lclintrun, li.lclintrun, div.lclintrun
\r
1002 margin-bottom:.0001pt;
\r
1004 font-family:"Arial Narrow";}
\r
1005 p.IndentText, li.IndentText, div.IndentText
\r
1007 margin-right:.2in;
\r
1008 margin-bottom:0in;
\r
1010 margin-bottom:.0001pt;
\r
1013 font-family:"Times New Roman";}
\r
1014 p.beforelist, li.beforelist, div.beforelist
\r
1017 margin-bottom:6.0pt;
\r
1019 text-align:justify;
\r
1021 font-family:"Times New Roman";}
\r
1022 p.example, li.example, div.example
\r
1023 {margin-top:6.0pt;
\r
1024 margin-right:.2in;
\r
1025 margin-bottom:6.0pt;
\r
1028 font-family:"Courier New";
\r
1030 p.skiplist, li.skiplist, div.skiplist
\r
1031 {margin-top:6.0pt;
\r
1033 margin-bottom:0in;
\r
1035 margin-bottom:.0001pt;
\r
1036 text-align:justify;
\r
1038 font-family:"Times New Roman";}
\r
1039 p.afterlist, li.afterlist, div.afterlist
\r
1040 {margin-top:6.0pt;
\r
1042 margin-bottom:0in;
\r
1044 margin-bottom:.0001pt;
\r
1045 text-align:justify;
\r
1047 font-family:"Times New Roman";}
\r
1048 p.betweenlists, li.betweenlists, div.betweenlists
\r
1049 {margin-top:6.0pt;
\r
1051 margin-bottom:6.0pt;
\r
1053 text-align:justify;
\r
1055 font-family:"Times New Roman";}
\r
1056 p.indentbefore, li.indentbefore, div.indentbefore
\r
1058 margin-right:.2in;
\r
1059 margin-bottom:6.0pt;
\r
1063 font-family:"Times New Roman";}
\r
1064 p.indentbefore0, li.indentbefore0, div.indentbefore0
\r
1066 margin-right:.2in;
\r
1067 margin-bottom:6.0pt;
\r
1071 font-family:"Times New Roman";}
\r
1073 {font-family:Arial;
\r
1075 p.Sidebar, li.Sidebar, div.Sidebar
\r
1077 margin-bottom:.0001pt;
\r
1079 font-family:"Times New Roman";}
\r
1080 p.URL, li.URL, div.URL
\r
1082 margin-bottom:.0001pt;
\r
1083 text-align:justify;
\r
1085 font-family:Arial;}
\r
1086 span.StyleKeywordBold
\r
1087 {font-family:"Courier New";
\r
1089 font-weight:bold;}
\r
1090 p.ProgramName, li.ProgramName, div.ProgramName
\r
1092 margin-bottom:.0001pt;
\r
1093 text-align:justify;
\r
1095 font-family:Arial;}
\r
1097 {font-family:"Courier New";}
\r
1098 span.ProgramNameChar
\r
1099 {font-family:Arial;}
\r
1101 {font-family:ProgramTwo;
\r
1103 p.fileName, li.fileName, div.fileName
\r
1105 margin-right:.2in;
\r
1106 margin-bottom:0in;
\r
1108 margin-bottom:.0001pt;
\r
1110 font-family:Arial;}
\r
1111 p.FileName0, li.FileName0, div.FileName0
\r
1113 margin-right:.2in;
\r
1114 margin-bottom:0in;
\r
1116 margin-bottom:.0001pt;
\r
1118 font-family:Arial;}
\r
1120 {font-family:Arial;}
\r
1122 {text-decoration:none;}
\r
1124 {text-decoration:underline;}
\r
1126 {text-decoration:line-through;
\r
1128 /* Page Definitions */
\r
1130 {size:8.5in 11.0in;
\r
1131 margin:1.0in 1.25in .75in 1.25in;}
\r
1135 {size:8.5in 11.0in;
\r
1136 margin:1.0in 1.25in 1.0in 99.35pt;}
\r
1140 {size:8.5in 11.0in;
\r
1141 margin:1.0in 1.25in 1.0in 99.35pt;}
\r
1145 {size:8.5in 11.0in;
\r
1146 margin:1.0in 1.25in 1.0in 99.0pt;}
\r
1150 {size:8.5in 11.0in;
\r
1151 margin:1.0in 1.25in 1.0in 1.25in;}
\r
1155 {size:8.5in 11.0in;
\r
1156 margin:1.0in 1.25in 1.0in 1.25in;}
\r
1160 {size:8.5in 11.0in;
\r
1161 margin:1.0in 1.25in 1.0in 1.25in;}
\r
1165 {size:8.5in 11.0in;
\r
1166 margin:1.0in 1.25in 1.0in 1.25in;}
\r
1169 /* List Definitions */
\r
1171 {margin-bottom:0in;}
\r
1173 {margin-bottom:0in;}
\r
1181 <div class=Section1>
\r
1183 <p class=MsoTitle>
\r
1184 <img width=189 height=219 src="manual-301_files/image001.jpg" hspace=12><a name="_Ref533872469"></a></p>
\r
1186 <p class=MsoTitle><a name="_Ref483663680"></a><span class=MsoCommentReference><span
\r
1187 style='font-size:20.0pt'> </span></span></p>
\r
1189 <p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;
\r
1190 font-family:"Book Antiqua"'> </span></span></p>
\r
1192 <p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;
\r
1193 font-family:"Book Antiqua"'> </span></span></p>
\r
1195 <p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;
\r
1196 font-family:"Book Antiqua"'> </span></span></p>
\r
1198 <p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;
\r
1199 font-family:"Book Antiqua"'>Splint Manual</span></span></p>
\r
1201 <p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;
\r
1202 font-family:"Book Antiqua"'> </span></span></p>
\r
1204 <p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:
\r
1205 18.0pt;font-family:"Book Antiqua"'>Version 3.0.1</span></span></p>
\r
1207 <p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:
\r
1208 18.0pt;font-family:"Book Antiqua"'>7 January 2002</span></span></p>
\r
1210 <p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:
\r
1211 15.5pt'> </span></span></p>
\r
1213 <p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:
\r
1214 15.5pt'> </span></span></p>
\r
1216 <p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:
\r
1217 15.5pt'> </span></span></p>
\r
1219 <p class=MsoNormal><span class=MsoCommentReference><span style='font-size:14.0pt;
\r
1220 font-family:"Book Antiqua"'> </span></span></p>
\r
1222 <p class=MsoNormal><span class=MsoCommentReference><span style='font-size:14.0pt;
\r
1223 font-family:"Book Antiqua"'> </span></span></p>
\r
1225 <p class=MsoNormal><span class=MsoCommentReference><span style='font-size:14.0pt;
\r
1226 font-family:"Book Antiqua"'> </span></span></p>
\r
1228 <p class=MsoNormal><span class=MsoCommentReference><span style='font-size:14.0pt;
\r
1229 font-family:"Book Antiqua"'> </span></span></p>
\r
1231 <p class=TextFontCX><span
\r
1232 class=MsoCommentReference><span style='font-size:15.5pt'> </span></span></p>
\r
1234 <p class=TextFontCX align=right style='margin-right:
\r
1235 -58.5pt;text-align:right'><img width=364 height=181
\r
1236 src="manual-301_files/image002.gif" align=left hspace=12
\r
1237 alt="Text Box: Secure Programming Group University of Virginia Department of Computer Science "></p>
\r
1239 <p class=TextFontCX style='margin-left:28.35pt;
\r
1240 text-indent:-14.15pt'><span class=MsoCommentReference><span style='font-size:
\r
1241 15.5pt'> </span></span></p>
\r
1243 <p class=TextFontCX align=right style='margin-right:
\r
1244 9.0pt;text-align:right'><span class=MsoCommentReference><i><span
\r
1245 style='font-size:14.0pt'> </span></i></span></p>
\r
1249 <span class=MsoCommentReference><b><i><span style='font-size:14.0pt;font-family:
\r
1250 Arial'><br clear=all style='page-break-before:auto'>
\r
1251 </span></i></b></span>
\r
1253 <div class=Section2><span class=MsoCommentReference><span style='font-size:
\r
1254 15.5pt;font-family:"Times New Roman"'><br clear=all style='page-break-before:
\r
1258 <p class=TextFontCX><span
\r
1259 class=MsoCommentReference><b><span style='font-size:14.0pt;font-family:Arial'> </span></b></span></p>
\r
1261 <h4 style='margin-left:0in;text-indent:0in'><span class=MsoCommentReference><span
\r
1262 style='font-size:14.0pt'>Authors</span></span></h4>
\r
1264 <p class=TextFontCX>This manual was written by
\r
1265 David Evans, except for Section 9, which was written by David Larochelle and David Evans.</p>
\r
1267 <h4 style='margin-left:0in;text-indent:0in'><span class=MsoCommentReference><span
\r
1268 style='font-size:14.0pt'>Credits</span></span></h4>
\r
1270 <p class=TextFontCX>Splint is developed and maintained
\r
1271 by the Secure Programming Group at the University of Virginia Department of
\r
1272 Computer Science. David Evans is the project leader and the primary developer
\r
1275 <p class=TextFontCX> </p>
\r
1277 <p class=TextFontCX>David Larochelle developed
\r
1278 the memory bounds checking. University of Virginia students Chris Barker,
\r
1279 David Friedman, Mike Lanouette and Hien Phan all contributed significantly to
\r
1280 the development of Splint.</p>
\r
1282 <p class=TextFontCX> </p>
\r
1284 <p class=TextFontCX>Splint is the successor to
\r
1285 LCLint, a tool originally developed as a joint research project between the
\r
1286 Massachusetts Institute of Technology and Digital Equipment Corporation
\92s System
\r
1287 Research Center. David Evans was the primary designed and developer of LCLint.
\r
1288 John Guttag and Jim Horning had the original idea for a static checking tool
\r
1289 for detecting inconsistencies between LCL specifications and their C
\r
1290 implementations. They provided valuable advice on its functionality and design
\r
1291 and were instrumental in its development. </p>
\r
1293 <p class=TextFontCX> </p>
\r
1295 <p class=TextFontCX>Splint incorporates the
\r
1296 original LCL checker developed by Yang Meng Tan. This was built on the DECspec
\r
1297 Project (Joe Wild, Gary Feldman, Steve Garland, and Bill McKeeman). The LSL
\r
1298 checker used by LCLint was developed by Steve Garland. The original C grammar
\r
1299 for LCLint was provided by Nate Osgood. This work has also benefited greatly
\r
1300 from discussions with Mike Burrows, Stephen Garland, Colin Godfrey, Steve
\r
1301 Harrison, Yanlin Huang, Daniel Jackson, John Knight, David Larochelle, Angelika
\r
1302 Leeb, Ulana Legedza, Anya Pogosyants, Avneesh Saxena, Seejo Sebastine, Navneet
\r
1303 Singh, Raymie Stata, Yang Meng Tan, and Mark Vandevoorde. I especially thank
\r
1304 Angelika Leeb for many constructive comments on improving an early version of
\r
1305 this document, Raymie Stata and Mark Vandevoorde for technical assistance, and
\r
1306 Dorothy Curtis, Paco Hope, Scott Ruffner, Christina Jackson, David Ladd, and
\r
1307 Jessica Greer for systems assistance.</p>
\r
1309 <p class=TextFontCX> </p>
\r
1311 <p class=TextFontCX>Much of Splint
\92s development
\r
1312 has been driven by feedback from users in academia and industry. Many more
\r
1313 people than I can mention here have made contributions by suggesting
\r
1314 improvements, reporting bugs, porting early versions of Splint to other
\r
1315 platforms. Particularly heroic contributions have been made by Nelson Beebe,
\r
1316 Eric Bloodworth, Jutta Degener, Rick Farnbach, Chris Flatters, Huver Hu,
\r
1317 Alexander Mai, John Gerard Malecki, Thomas G. McWilliams, Michael Meskes,
\r
1318 Richard O
\92Keefe, Jens Schweikhardt, Albert L. Ting and Jim Zelenka. Martin
\r
1319 \93Herbert
\94 Dietze and Mike Smith performed valiantly in producing the original
\r
1320 Win32 and OS2 ports. Tim Van Holder produced the <span class=Keyword><span
\r
1321 style='font-size:10.0pt;font-family:Arial;color:windowtext'>automake</span></span>
\r
1322 and <span class=Keyword><span style='font-size:10.0pt;font-family:Arial;
\r
1323 color:windowtext'>autoconf</span></span> distribution. </p>
\r
1325 <p class=TextFontCX> </p>
\r
1327 <p class=TextFontCX>Splint research at the University
\r
1328 of Virginia is currently funded in part by a grant from the NASA Langley Research
\r
1329 Center, an NSF CAREER Award for swarm programming, and an NSF CCLI Award for
\r
1330 using analysis to teach software engineering. David Larochelle is funded by a
\r
1331 USENIX student research grant. <span style='font-size:20.0pt'> </span></p>
\r
1335 <span class=MsoCommentReference><span style='font-size:15.5pt;font-family:"Times New Roman"'><br
\r
1336 clear=all style='page-break-before:right'>
\r
1339 <div class=Section3>
\r
1341 <p class=MsoToc1 align=center style='text-align:center'><span
\r
1342 class=MsoCommentReference><span style='font-size:15.5pt'>Contents</span></span></p>
\r
1344 <p class=MsoToc1>1<span
\r
1345 style='font-size:12.0pt;font-weight:normal'> </span>Operation................................................................................................................ 11</p>
\r
1347 <p class=MsoToc2>1.1<span style='font-size:12.0pt'> </span>Warnings............................................................................................................. 11</p>
\r
1349 <p class=MsoToc2>1.2<span style='font-size:12.0pt'> </span>Flags.................................................................................................................... 12</p>
\r
1351 <p class=MsoToc2>1.3<span style='font-size:12.0pt'> </span>Stylized
\r
1352 Comments............................................................................................... 12</p>
\r
1354 <p class=MsoToc3>1.3.1<span style='font-size:12.0pt'> </span>Annotations................................................................................................... 13</p>
\r
1356 <p class=MsoToc3>1.3.2<span style='font-size:12.0pt'> </span>Setting Flags.................................................................................................. 13</p>
\r
1358 <p class=MsoToc1>2<span style='font-size:12.0pt;font-weight:normal'> </span>Null
\r
1359 Dereferences................................................................................................... 14</p>
\r
1361 <p class=MsoToc3>2.1.1<span style='font-size:12.0pt'> </span>Predicate
\r
1362 Functions........................................................................................ 14</p>
\r
1364 <p class=MsoToc3>2.1.2<span style='font-size:12.0pt'> </span>Notnull
\r
1365 Annotations........................................................................................ 15</p>
\r
1367 <p class=MsoToc3>2.1.3<span style='font-size:12.0pt'> </span>Relaxing Null
\r
1368 Checking.................................................................................. 15</p>
\r
1370 <p class=MsoToc1>3<span style='font-size:12.0pt;font-weight:normal'> </span>Undefined
\r
1371 Values.................................................................................................... 17</p>
\r
1373 <p class=MsoToc3>3.1.1<span style='font-size:12.0pt'> </span>Undefined
\r
1374 Parameters................................................................................... 17</p>
\r
1376 <p class=MsoToc3>3.1.2<span style='font-size:12.0pt'> </span>Relaxing
\r
1377 Checking......................................................................................... 18</p>
\r
1379 <p class=MsoToc3>3.1.3<span style='font-size:12.0pt'> </span>Partially
\r
1380 Defined Structures............................................................................ 18</p>
\r
1382 <p class=MsoToc1>4<span style='font-size:12.0pt;font-weight:normal'> </span>Types....................................................................................................................... 19</p>
\r
1384 <p class=MsoToc2>4.1<span style='font-size:12.0pt'> </span>Built in C Types.................................................................................................... 19</p>
\r
1386 <p class=MsoToc3>4.1.1<span style='font-size:12.0pt'> </span>Characters.................................................................................................... 19</p>
\r
1388 <p class=MsoToc3>4.1.2<span style='font-size:12.0pt'> </span>Enumerators.................................................................................................. 19</p>
\r
1390 <p class=MsoToc3>4.1.3<span style='font-size:12.0pt'> </span>Numeric Types.............................................................................................. 19</p>
\r
1392 <p class=MsoToc3>4.1.4<span style='font-size:12.0pt'> </span>Arbitrary
\r
1393 Integral Types................................................................................. 19</p>
\r
1395 <p class=MsoToc2>4.2<span style='font-size:12.0pt'> </span>Boolean Types..................................................................................................... 20</p>
\r
1397 <p class=MsoToc2>4.3<span style='font-size:12.0pt'> </span>Abstract Types..................................................................................................... 21</p>
\r
1399 <p class=MsoToc3>4.3.1<span style='font-size:12.0pt'> </span>Controlling
\r
1400 Access......................................................................................... 22</p>
\r
1402 <p class=MsoToc3>4.3.2<span style='font-size:12.0pt'> </span>Mutability...................................................................................................... 23</p>
\r
1404 <p class=MsoToc2>4.4<span style='font-size:12.0pt'> </span>Polymorphism....................................................................................................... 24</p>
\r
1406 <p class=MsoToc1>5<span style='font-size:12.0pt;font-weight:normal'> </span>Memory
\r
1407 Management............................................................................................ 25</p>
\r
1409 <p class=MsoToc2>5.1<span style='font-size:12.0pt'> </span>Storage Model...................................................................................................... 25</p>
\r
1411 <p class=MsoToc2>5.2<span style='font-size:12.0pt'> </span>Deallocation
\r
1412 Errors............................................................................................... 26</p>
\r
1414 <p class=MsoToc3>5.2.1<span style='font-size:12.0pt'> </span>Unshared
\r
1415 References.................................................................................... 26</p>
\r
1417 <p class=MsoToc3>5.2.2<span style='font-size:12.0pt'> </span>Temporary
\r
1418 Parameters.................................................................................. 27</p>
\r
1420 <p class=MsoToc3>5.2.3<span style='font-size:12.0pt'> </span>Owned and
\r
1421 Dependent References................................................................. 27</p>
\r
1423 <p class=MsoToc3>5.2.4<span style='font-size:12.0pt'> </span>Keep
\r
1424 Parameters........................................................................................... 28</p>
\r
1426 <p class=MsoToc3>5.2.5<span style='font-size:12.0pt'> </span>Shared
\r
1427 References........................................................................................ 28</p>
\r
1429 <p class=MsoToc3>5.2.6<span style='font-size:12.0pt'> </span>Stack
\r
1430 References.......................................................................................... 28</p>
\r
1432 <p class=MsoToc3>5.2.7<span style='font-size:12.0pt'> </span>Inner Storage................................................................................................. 28</p>
\r
1434 <p class=MsoToc2>5.3<span style='font-size:12.0pt'> </span>Implicit Memory
\r
1435 Annotations................................................................................. 29</p>
\r
1437 <p class=MsoToc2>5.4<span style='font-size:12.0pt'> </span>Reference
\r
1438 Counting.............................................................................................. 30</p>
\r
1440 <p class=MsoToc1>6<span style='font-size:12.0pt;font-weight:normal'> </span>Sharing.................................................................................................................... 31</p>
\r
1442 <p class=MsoToc2>6.1<span style='font-size:12.0pt'> </span>Aliasing................................................................................................................ 31</p>
\r
1444 <p class=MsoToc3>6.1.1<span style='font-size:12.0pt'> </span>Unique
\r
1445 Parameters........................................................................................ 31</p>
\r
1447 <p class=MsoToc3>6.1.2<span style='font-size:12.0pt'> </span>Returned
\r
1448 Parameters..................................................................................... 31</p>
\r
1450 <p class=MsoToc2>6.2<span style='font-size:12.0pt'> </span>Exposure.............................................................................................................. 32</p>
\r
1452 <p class=MsoToc3>6.2.1<span style='font-size:12.0pt'> </span>Read-Only
\r
1453 Storage........................................................................................ 32</p>
\r
1455 <p class=MsoToc3>6.2.2<span style='font-size:12.0pt'> </span>Exposed
\r
1456 Storage............................................................................................ 33</p>
\r
1458 <p class=MsoToc1>7<span style='font-size:12.0pt;font-weight:normal'> </span>Function
\r
1459 Interfaces................................................................................................. 35</p>
\r
1461 <p class=MsoToc2>7.1<span style='font-size:12.0pt'> </span>Modifications........................................................................................................ 35</p>
\r
1463 <p class=MsoToc3>7.1.1<span style='font-size:12.0pt'> </span>State
\r
1464 Modifications........................................................................................ 36</p>
\r
1466 <p class=MsoToc3>7.1.2<span style='font-size:12.0pt'> </span>Missing
\r
1467 Modifies Clauses............................................................................... 36</p>
\r
1469 <p class=MsoToc2>7.2<span style='font-size:12.0pt'> </span>Global Variables................................................................................................... 37</p>
\r
1471 <p class=MsoToc3>7.2.1<span style='font-size:12.0pt'> </span>Controlling Globals
\r
1472 Checking.......................................................................... 37</p>
\r
1474 <p class=MsoToc3>7.2.2<span style='font-size:12.0pt'> </span>Definition
\r
1475 State.............................................................................................. 38</p>
\r
1477 <p class=MsoToc2>7.3<span style='font-size:12.0pt'> </span>Declaration
\r
1478 Consistency........................................................................................ 38</p>
\r
1480 <p class=MsoToc2>7.4<span style='font-size:12.0pt'> </span>State Clauses....................................................................................................... 39</p>
\r
1482 <p class=MsoToc2>7.5<span style='font-size:12.0pt'> </span>Requires and
\r
1483 Ensures Clauses............................................................................... 41</p>
\r
1485 <p class=MsoToc1>8<span style='font-size:12.0pt;font-weight:normal'> </span>Control
\r
1486 Flow........................................................................................................... 43</p>
\r
1488 <p class=MsoToc2>8.1<span style='font-size:12.0pt'> </span>Execution............................................................................................................. 43</p>
\r
1490 <p class=MsoToc2>8.2<span style='font-size:12.0pt'> </span>Undefined
\r
1491 Behavior.............................................................................................. 44</p>
\r
1493 <p class=MsoToc2>8.3<span style='font-size:12.0pt'> </span>Problematic
\r
1494 Control Structures.............................................................................. 45</p>
\r
1496 <p class=MsoToc3>8.3.1<span style='font-size:12.0pt'> </span>Likely
\r
1497 Infinite Loops...................................................................................... 45</p>
\r
1499 <p class=MsoToc3>8.3.2<span style='font-size:12.0pt'> </span>Switches....................................................................................................... 46</p>
\r
1501 <p class=MsoToc3>8.3.3<span style='font-size:12.0pt'> </span>Deep Breaks................................................................................................. 46</p>
\r
1503 <p class=MsoToc3>8.3.4<span style='font-size:12.0pt'> </span>Loop and If
\r
1504 Bodies........................................................................................ 47</p>
\r
1506 <p class=MsoToc3>8.3.5<span style='font-size:12.0pt'> </span>Complete Logic............................................................................................. 47</p>
\r
1508 <p class=MsoToc2>8.4<span style='font-size:12.0pt'> </span>Suspicious
\r
1509 Statements........................................................................................... 47</p>
\r
1511 <p class=MsoToc3>8.4.1<span style='font-size:12.0pt'> </span>Statements
\r
1512 with No Effects............................................................................ 47</p>
\r
1514 <p class=MsoToc3>8.4.2<span style='font-size:12.0pt'> </span>Ignored Return
\r
1515 Values................................................................................... 48</p>
\r
1517 <p class=MsoToc1>9<span style='font-size:12.0pt;font-weight:normal'> </span>Buffer
\r
1518 Sizes............................................................................................................. 49</p>
\r
1520 <p class=MsoToc2>9.1<span style='font-size:12.0pt'> </span>Checking Accesses.............................................................................................. 49</p>
\r
1522 <p class=MsoToc2>9.2<span style='font-size:12.0pt'> </span>Annotating
\r
1523 Buffer Sizes........................................................................................ 49</p>
\r
1525 <p class=MsoToc2>9.3<span style='font-size:12.0pt'> </span>Warnings............................................................................................................. 50</p>
\r
1527 <p class=MsoToc1>10<span style='font-size:12.0pt;font-weight:normal'> </span>Extensible
\r
1528 Checking............................................................................................ 52</p>
\r
1530 <p class=MsoToc2>10.1<span style='font-size:12.0pt'> </span>Defining
\r
1531 Attributes............................................................................................ 52</p>
\r
1533 <p class=MsoToc2>10.2<span style='font-size:12.0pt'> </span>Annotations...................................................................................................... 54</p>
\r
1535 <p class=MsoToc2>10.3<span style='font-size:12.0pt'> </span>Example........................................................................................................... 54</p>
\r
1537 <p class=MsoToc1>11<span style='font-size:12.0pt;font-weight:normal'> </span>Macros.................................................................................................................. 55</p>
\r
1539 <p class=MsoToc2>11.1<span style='font-size:12.0pt'> </span>Constant
\r
1540 Macros............................................................................................... 55</p>
\r
1542 <p class=MsoToc2>11.2<span style='font-size:12.0pt'> </span>Function-like
\r
1543 Macros......................................................................................... 55</p>
\r
1545 <p class=MsoToc3>11.2.1<span style='font-size:12.0pt'> </span>Side Effect
\r
1546 Free Parameters....................................................................... 56</p>
\r
1548 <p class=MsoToc2>11.3<span style='font-size:12.0pt'> </span>Controlling
\r
1549 Macro Checking............................................................................... 57</p>
\r
1551 <p class=MsoToc2>11.4<span style='font-size:12.0pt'> </span>Iterators........................................................................................................... 58</p>
\r
1553 <p class=MsoToc3>11.4.1<span style='font-size:12.0pt'> </span>Defining
\r
1554 Iterators....................................................................................... 58</p>
\r
1556 <p class=MsoToc3>11.4.2<span style='font-size:12.0pt'> </span>Using Iterators........................................................................................... 58</p>
\r
1558 <p class=MsoToc1>12<span style='font-size:12.0pt;font-weight:normal'> </span>Naming
\r
1559 Conventions............................................................................................ 60</p>
\r
1561 <p class=MsoToc2>12.1<span style='font-size:12.0pt'> </span>Type-Based
\r
1562 Naming Conventions...................................................................... 60</p>
\r
1564 <p class=MsoToc3>12.1.1<span style='font-size:12.0pt'> </span>Czech Names............................................................................................. 60</p>
\r
1566 <p class=MsoToc3>12.1.2<span style='font-size:12.0pt'> </span>Slovak
\r
1567 Names............................................................................................ 61</p>
\r
1569 <p class=MsoToc3>12.1.3<span style='font-size:12.0pt'> </span>Czechoslovak
\r
1570 Names.................................................................................. 61</p>
\r
1572 <p class=MsoToc2>12.2<span style='font-size:12.0pt'> </span>Namespace
\r
1573 Prefixes......................................................................................... 61</p>
\r
1575 <p class=MsoToc2>12.3<span style='font-size:12.0pt'> </span>Naming
\r
1576 Restrictions.......................................................................................... 63</p>
\r
1578 <p class=MsoToc3>12.3.1<span style='font-size:12.0pt'> </span>Reserved
\r
1579 Names........................................................................................ 63</p>
\r
1581 <p class=MsoToc3>12.3.2<span style='font-size:12.0pt'> </span>Distinct
\r
1582 Names........................................................................................... 63</p>
\r
1584 <p class=MsoToc1>13<span style='font-size:12.0pt;font-weight:normal'> </span>Completeness....................................................................................................... 65</p>
\r
1586 <p class=MsoToc2>13.1<span style='font-size:12.0pt'> </span>Unused
\r
1587 Declarations......................................................................................... 65</p>
\r
1589 <p class=MsoToc2>13.2<span style='font-size:12.0pt'> </span>Complete
\r
1590 Programs........................................................................................... 65</p>
\r
1592 <p class=MsoToc3>13.2.1<span style='font-size:12.0pt'> </span>Unnecessarily
\r
1593 External Names.................................................................... 65</p>
\r
1595 <p class=MsoToc3>13.2.2<span style='font-size:12.0pt'> </span>Declarations
\r
1596 Missing from Headers............................................................. 65</p>
\r
1598 <p class=MsoToc1>14<span style='font-size:12.0pt;font-weight:normal'> </span>Libraries
\r
1599 and Header File Inclusion.................................................................... 66</p>
\r
1601 <p class=MsoToc2>14.1<span style='font-size:12.0pt'> </span>Standard
\r
1602 Libraries............................................................................................. 66</p>
\r
1604 <p class=MsoToc3>14.1.1<span style='font-size:12.0pt'> </span>ISO
\r
1605 Standard Library.................................................................................. 66</p>
\r
1607 <p class=MsoToc3>14.1.2<span style='font-size:12.0pt'> </span>POSIX
\r
1608 Library........................................................................................... 66</p>
\r
1610 <p class=MsoToc3>14.1.3<span style='font-size:12.0pt'> </span>UNIX
\r
1611 Library............................................................................................ 66</p>
\r
1613 <p class=MsoToc3>14.1.4<span style='font-size:12.0pt'> </span>Strict
\r
1614 Libraries............................................................................................ 66</p>
\r
1616 <p class=MsoToc2>14.2<span style='font-size:12.0pt'> </span>Generating
\r
1617 Libraries.......................................................................................... 67</p>
\r
1619 <p class=MsoToc3>14.2.1<span style='font-size:12.0pt'> </span>Generating
\r
1620 the Standard Libraries................................................................ 67</p>
\r
1622 <p class=MsoToc2>14.3<span style='font-size:12.0pt'> </span>Header File
\r
1623 Inclusion......................................................................................... 68</p>
\r
1625 <p class=MsoToc3>14.3.1<span style='font-size:12.0pt'> </span>Preprocessing
\r
1626 Constants............................................................................. 68</p>
\r
1628 <p class=MsoToc1>Appendix A<span style='font-size:12.0pt;font-weight:normal'> </span>Availability............................................................................................... 71</p>
\r
1630 <p class=MsoToc1>Appendix B<span style='font-size:12.0pt;font-weight:normal'> </span>Flags........................................................................................................ 72</p>
\r
1632 <p class=MsoToc2>Global Flags................................................................................................................... 72</p>
\r
1634 <p class=MsoToc3>Help.......................................................................................................................... 72</p>
\r
1636 <p class=MsoToc3>Initialization................................................................................................................ 72</p>
\r
1638 <p class=MsoToc3>Pre-processor............................................................................................................ 73</p>
\r
1640 <p class=MsoToc3>Libraries.................................................................................................................... 73</p>
\r
1642 <p class=MsoToc3>Output....................................................................................................................... 74</p>
\r
1644 <p class=MsoToc3>Expected Errors......................................................................................................... 75</p>
\r
1646 <p class=MsoToc2>Message Format............................................................................................................ 75</p>
\r
1648 <p class=MsoToc2>Mode Selector Flags....................................................................................................... 75</p>
\r
1650 <p class=MsoToc2>Checking Flags............................................................................................................... 76</p>
\r
1652 <p class=MsoToc3>Key........................................................................................................................... 76</p>
\r
1654 <p class=MsoToc3>Types........................................................................................................................ 76</p>
\r
1656 <p class=MsoToc3>Function Interfaces..................................................................................................... 79</p>
\r
1658 <p class=MsoToc3>Memory Management................................................................................................ 81</p>
\r
1660 <p class=MsoToc3>Sharing...................................................................................................................... 84</p>
\r
1662 <p class=MsoToc3>Use Before Definition <i>(Section 3)</i>............................................................................... 85</p>
\r
1664 <p class=MsoToc3>Null Dereferences <i>(Section 2)</i>.................................................................................... 85</p>
\r
1666 <p class=MsoToc3>Macros <i>(Section 7)</i>.................................................................................................... 85</p>
\r
1668 <p class=MsoToc3>Iterators..................................................................................................................... 86</p>
\r
1670 <p class=MsoToc3>Naming Conventions................................................................................................... 86</p>
\r
1672 <p class=MsoToc3>Other Checks............................................................................................................. 90</p>
\r
1674 <p class=MsoToc2>Flag Name Abbreviations................................................................................................ 95</p>
\r
1676 <p class=MsoToc1>Appendix C<span style='font-size:12.0pt;font-weight:normal'> </span>Annotations............................................................................................. 97</p>
\r
1678 <p class=MsoToc3>Suppressing Warnings................................................................................................. 97</p>
\r
1680 <p class=MsoToc2>Syntactic Annotations..................................................................................................... 97</p>
\r
1682 <p class=MsoToc3>Functions................................................................................................................... 97</p>
\r
1684 <p class=MsoToc3>Iterators (Section 11.4)............................................................................................... 98</p>
\r
1686 <p class=MsoToc3>Constants (Section 11.1)............................................................................................. 98</p>
\r
1688 <p class=MsoToc3>Alternate Types (Section 4.4)...................................................................................... 98</p>
\r
1690 <p class=MsoToc3>Declarator Annotations............................................................................................... 98</p>
\r
1692 <p class=MsoToc3>Type Access.............................................................................................................. 98</p>
\r
1694 <p class=MsoToc3>Macro Expansion...................................................................................................... 101</p>
\r
1696 <p class=MsoToc3>Arbitrary Integral Types............................................................................................ 102</p>
\r
1698 <p class=MsoToc3>Traditional Lint Comments........................................................................................ 102</p>
\r
1700 <p class=MsoToc2>Metastate Definitions.................................................................................................... 103</p>
\r
1702 <p class=MsoToc1>Appendix D<span style='font-size:12.0pt;font-weight:normal'> </span>Specifications......................................................................................... 104</p>
\r
1704 <p class=MsoToc3>Specification Flags.................................................................................................... 104</p>
\r
1706 <p class=MsoToc1>Appendix E<span style='font-size:12.0pt;font-weight:normal'> </span>Annotated
\r
1707 Bibliography........................................................................ 107</p>
\r
1709 <p class=MsoToc1>Index............................................................................................................................. 111</p>
\r
1711 <p class=TextFontCX><span
\r
1712 class=MsoCommentReference><i><span style='font-size:15.5pt;text-transform:uppercase'><b> </b></span></i></span></p>
\r
1714 <p class=MsoToc1 align=center style='text-align:center'><span
\r
1715 class=MsoCommentReference><span style='font-size:15.5pt'>Figures</span></span></p>
\r
1717 <p class=MsoNormal> </p>
\r
1719 <p class=MsoTof>Figure 1. Typical Effort-Benefit Curve for Using Splint....................................................... 10</p>
\r
1721 <p class=MsoTof>Figure 2. Null Checking..................................................................................................... 14</p>
\r
1723 <p class=MsoTof>Figure 3. Use before Definition.......................................................................................... 18</p>
\r
1725 <p class=MsoTof>Figure 4. Boolean Checking............................................................................................... 21</p>
\r
1727 <p class=MsoTof>Figure 5. Information Hiding Violations............................................................................... 22</p>
\r
1729 <p class=MsoTof>Figure 6. Memory Management......................................................................................... 27</p>
\r
1731 <p class=MsoTof>Figure 7. Stack-Allocated Storage...................................................................................... 28</p>
\r
1733 <p class=MsoTof>Figure 8. Implicit Annotations............................................................................................ 29</p>
\r
1735 <p class=MsoTof>Figure 9. Reference Counting............................................................................................ 30</p>
\r
1737 <p class=MsoTof>Figure 10. Unique parameters............................................................................................ 31</p>
\r
1739 <p class=MsoTof>Figure 11. Exposure.......................................................................................................... 34</p>
\r
1741 <p class=MsoTof>Figure 12. Modification...................................................................................................... 36</p>
\r
1743 <p class=MsoTof>Figure 13. Global Variables................................................................................................ 37</p>
\r
1745 <p class=MsoTof>Figure 14. Annotated Globals Lists..................................................................................... 38</p>
\r
1747 <p class=MsoTof>Figure 15. State Clauses.................................................................................................... 41</p>
\r
1749 <p class=MsoTof>Figure 16. Evaluation Order............................................................................................... 44</p>
\r
1751 <p class=MsoTof>Figure 17. Infinite Loops.................................................................................................... 45</p>
\r
1753 <p class=MsoTof>Figure 18. Switch Cases.................................................................................................... 46</p>
\r
1755 <p class=MsoTof>Figure 19. Statements with No Effect................................................................................. 48</p>
\r
1757 <p class=MsoTof>Figure 20. Ignored Return Values...................................................................................... 48</p>
\r
1759 <p class=MsoTof>Figure 21. Prefix Character Codes..................................................................................... 65</p>
\r
1761 <p class=MsoTof>Figure 22. Distinct Names................................................................................................. 66</p>
\r
1763 <p class=MsoTof>Figure 23. Flag Name Abbreviations.................................................................................. 98</p>
\r
1765 <p class=TextFontCX></p>
\r
1769 <span class=MsoCommentReference><b><i><span style='font-size:15.5pt;font-family:
\r
1770 "Times New Roman";text-transform:uppercase'><br clear=all style='page-break-before:
\r
1772 </span></i></b></span>
\r
1774 <div class=Section4>
\r
1776 <p class=TextFontCX><span style='font-size:16.0pt'> </span></p>
\r
1778 <p class=MsoNormal align=center style='text-align:center'><b><span
\r
1779 style='font-size:16.0pt'>Splint User
\92s Manual</span></b></p>
\r
1781 <p class=MsoNormal align=center style='text-align:center'> </p>
\r
1783 <p class=MsoNormal align=center style='text-align:center'>Version 3.0.1</p>
\r
1785 <p class=MsoNormal align=center style='text-align:center'>7 January 2002</p>
\r
1787 <p class=TextFontCX> </p>
\r
1789 <p class=TextFontCX>Splint<a href="#_ftn1"
\r
1790 name="_ftnref1" title=""><span class=MsoFootnoteReference><span
\r
1791 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>
\r
1792 is a tool for statically checking C programs for security vulnerabilities and
\r
1793 programming mistakes. Splint does many of the traditional lint checks
\r
1794 including unused declarations, type inconsistencies, use before definition, unreachable code, ignored return values, execution paths with no return, likely
\r
1795 infinite loops, and fall through cases. More powerful checks are made possible
\r
1796 by additional information given in source code annotations. Annotations are stylized comments that document assumptions about functions, variables,
\r
1797 parameters and types. In addition to the checks specifically enabled by
\r
1798 annotations, many of the traditional lint checks are improved by exploiting
\r
1799 this additional information.</p>
\r
1801 <p class=TextFontCX> </p>
\r
1803 <p class=TextFontCX>As more effort is put into
\r
1804 annotating programs, better checking results. A representational effort-benefit
\r
1805 curve for using Splint is shown in Figure 1. Splint is designed to be flexible and allow programmers to select appropriate points on the effort-benefit curve for particular projects. As different checks are turned on and more information is given in code
\r
1806 annotations the number of bugs that can be detected increases dramatically.</p>
\r
1808 <p class=TextFontCX> </p>
\r
1810 <p class=beforelist>Problems detected by Splint include:</p>
\r
1812 <p class=TextFontCX style='margin-left:12.95pt;
\r
1813 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1814 </span></span>Dereferencing a possibly null pointer (Section 2);</p>
\r
1816 <p class=TextFontCX style='margin-left:12.95pt;
\r
1817 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1818 </span></span>Using possibly undefined storage or returning storage that is not
\r
1819 properly defined (Section 3);</p>
\r
1821 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
1822 style='font:7.0pt "Times New Roman"'> </span></span>Type
\r
1823 mismatches, with greater precision and flexibility than provided by C compilers
\r
1824 (Section 4.1
\964.2);</p>
\r
1826 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
1827 style='font:7.0pt "Times New Roman"'> </span></span>Violations
\r
1828 of information hiding (Section 4.3);</p>
\r
1830 <p class=TextFontCX style='margin-left:12.95pt;
\r
1831 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1832 </span></span>Memory management errors including uses of dangling references
\r
1833 and memory leaks (Section 5);</p>
\r
1835 <p class=TextFontCX style='margin-left:12.95pt;
\r
1836 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1837 </span></span>Dangerous aliasing (Section 6);</p>
\r
1839 <p class=TextFontCX style='margin-left:12.95pt;
\r
1840 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1841 </span></span>Modifications and global variable uses that are inconsistent with
\r
1842 specified interfaces (Section 7);</p>
\r
1844 <p class=TextFontCX style='margin-left:12.95pt;
\r
1845 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1846 </span></span>Problematic control flow such as likely infinite loops (Section 8.3.1), fall through cases or incomplete switches (Section 8.3.2), and suspicious statements (Section 8.4);</p>
\r
1848 <p class=TextFontCX style='margin-left:12.95pt;
\r
1849 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1850 </span></span>Buffer overflow vulnerabilities (Section 9);</p>
\r
1852 <p class=TextFontCX style='margin-left:12.95pt;
\r
1853 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1854 </span></span>Dangerous macro implementations or invocations (Section 11); and</p>
\r
1856 <p class=TextFontCX style='margin-left:12.95pt;
\r
1857 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
1858 </span></span>Violations of customized naming conventions. (Section 12).</p>
\r
1860 <p class=TextFontCX> </p>
\r
1862 <p class=MsoCaption>
\r
1863 <center><img width=572 height=350
\r
1864 src="manual-301_files/image003.gif"><center>
\r
1867 <p class=MsoCaption><a name="_Toc534824605"></a><a name="_Ref534821281">Figure </a>1. Typical Effort-Benefit Curve</p>
\r
1869 <p class=TextFontCX> </p>
\r
1871 <p class=TextFontCX>Splint checking can be
\r
1872 customized to select what classes of errors are reported using command line
\r
1873 flags and stylized comments in the code. In addition, users can define new annotations and associated checks to extend Splint
\92s checking or to enforce application
\r
1874 specific properties (Section 10).</p>
\r
1876 <p class=TextFontCX><a name="_Ref343085763"></a><a
\r
1877 name="_Ref343065516"> </a></p>
\r
1879 <p class=TextFontCX><b>About This Document</b></p>
\r
1881 <p class=TextFontCX>This document is a guide to
\r
1882 using Splint. Section 1 explains how to run Splint, interpret messages and
\r
1883 control checking. Sections 2
\9613 describe particular checks done by Splint. There are some minor dependencies between sections, but in general they can be read in any order. Section 14 covers issues involving libraries and header file inclusion important for running Splint on large systems.</p>
\r
1885 <p class=TextFontCX> </p>
\r
1887 <p class=TextFontCX>This document does not
\r
1888 describe technical details of the checking. For technical background and
\r
1889 analysis of Splint
\92s effectiveness in practice, see the papers available at <a
\r
1890 href="http://www.splint.org/"><span style='font-size:10.0pt;font-family:Arial'>http://www.splint.org</span></a>.
\r
1894 <table cellspacing=0 cellpadding=0 hspace=0 width="80%" style="border-collapse: collapse" bordercolor="#111111">
\r
1896 <td valign=top align=left style='padding-top:0in;padding-right:
\r
1897 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
1898 <p class=TextFontCX align=right
\r
1899 style='text-align:right'><a name="_Ref349497354"></a><a name="_Ref348079997"><i><span
\r
1900 style='font-size:9.0pt'>Since human beings themselves are not fully debugged
\r
1901 yet, there will be bugs in your code no matter what you do.</span></i></a></p>
\r
1902 <p class=TextFontCX align=right
\r
1903 style='margin-left:4.5pt;text-align:right'><span style='font-size:9.0pt'>Chris
\r
1904 Mason,</span><i><span style='font-size:9.0pt'> Zero-defects memo </span></i><span
\r
1905 style='font-size:9.0pt'>(quoted in <i>Microsoft Secrets</i>, Cusumano and Selby)</span></p>
\r
1911 <a name="Section1">
\r
1912 <h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534974932"></a><a
\r
1913 name="_Ref348785755">1<span style='font:7.0pt "Times New Roman"'>
\r
1914 </span>Operation</a></h1>
\r
1916 <p class=TextFontCX>Splint is invoked by listing
\r
1917 files to be checked. Initialization files, command line flags, and stylized comments may be used to customize checking globally and locally.</p>
\r
1919 <p class=TextFontCX> </p>
\r
1921 <p class=TextFontCX>The best way to learn to use
\r
1922 Splint, of course, is to actually use it (if you don
\92t already have Splint
\r
1923 installed on your system, see Appendix A). Before you read much further in
\r
1924 this document, I recommend finding a small C program. Then, try running:</p>
\r
1926 <p class=example align="left">splint *.c</p>
\r
1931 <p class=TextFontCX>For the most C programs, this
\r
1932 will produce a large number of warnings. To turn off reporting for some of the
\r
1933 warnings, try:<a name="_Ref347468509"></a><a name="_Ref345591726"></a><a
\r
1934 name="_Ref345568136"></a><a name="_Ref345515100"></a><a name="_Ref345497041"></a><a
\r
1935 name="_Ref345435155"></a><a name="_Ref345257971"></a><a name="_Ref344916723"></a><a
\r
1936 name="_Ref344907348"></a><a name="_Ref344891202"></a><a name="_Toc344355397"></a></p>
\r
1938 <p class=example align="left">splint -weak *.c</p>
\r
1942 <p class=TextFontCX>The <span class=Flag><span
\r
1943 style='font-size:10.0pt'>-weak</span></span> flag is a mode flag that sets many checking parameters to select weaker checking than is done in the
\r
1944 default mode. Other Splint flags will be introduced in the following sections;
\r
1945 a complete list is given in Appendix B.</p>
\r
1947 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974933"></a><a
\r
1948 name="_Toc344355435">1.1<span style='font:7.0pt "Times New Roman"'>
\r
1949 </span>Warnings</a></h2>
\r
1951 <p class=beforelist>A typical warning message is:</p>
\r
1953 <p class=IndentText align="left" style="margin-bottom: 0.0003pt"><span style='font-size:10.0pt;font-family:Arial'>sample.c:
\r
1954 (in function faucet)</span></p>
\r
1956 <p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'>sample.c:11:12</span><span style='font-size:10.0pt;
\r
1957 font-family:Arial'>: Fresh storage x not released before return</span></p>
\r
1959 <p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'> A memory
\r
1960 leak has been detected. Storage allocated locally is not released</span></p>
\r
1962 <p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'> before
\r
1963 the last reference to it is lost. (Use -mustfreefresh to inhibit</span></p>
\r
1965 <p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'> warning)</span></p>
\r
1967 <p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'>
\r
1968 sample.c:5:47: Fresh storage x allocated</span></p>
\r
1972 <p class=afterlist>The first line gives the name of the function in which the
\r
1973 error is found. This is printed before the first message reported for a
\r
1974 function. The second line is the text of the message. This message reports a
\r
1975 memory leak
\97storage allocated in a function is not deallocated before the
\r
1976 function returns. The file name, line and column number where the error is
\r
1977 located precedes the text. </p>
\r
1979 <p class=TextFontCX> </p>
\r
1981 <p class=TextFontCX>The next line is a hint
\r
1982 giving more information about the suspected error, including information on how
\r
1983 the warning message may be suppressed. For this message, using the <span
\r
1984 class=Flag><span style='font-size:10.0pt'>‑mustfreefresh</span></span> flag would prevent this warning from being reported. This flag can be set at the
\r
1985 command line, or more precisely just around the code point in question by using
\r
1986 annotations (see Section 1.3.2).</p>
\r
1988 <p class=TextFontCX> </p>
\r
1990 <p class=TextFontCX>The final line of the message
\r
1991 gives additional location information. For this message, it tells where the
\r
1992 leaking storage was allocated.</p>
\r
1994 <p class=TextFontCX> </p>
\r
1996 <p class=beforelist>The generic message format is (parts enclosed in square
\r
1997 brackets are optional):</p>
\r
1999 <p class=Verbatim align="left"><span style='font-family:Arial'> [<file>:<line>
\r
2000 (in <context>)]</span></p>
\r
2002 <p class=Verbatim align="left"><span style='font-family:Arial'>
\r
2003 <file>:<line>[,<column>]: <i>message</i></span></p>
\r
2005 <p class=Verbatim align="left"><span style='font-family:Arial'> [<i>hint</i>]</span></p>
\r
2007 <p class=Verbatim align="left"><span style='font-family:Arial'> <file>:<line>,<column>:
\r
2008 <i>extra location information, if appropriate</i></span></p>
\r
2013 <p class=afterlist>Users can customize the format and content of messages
\r
2014 printed by Splint. The function context is not printed if <span class=Flag><span
\r
2015 style='font-size:10.0pt'>-showfunc</span></span> is used. Column numbers are not printed if <span
\r
2016 class=Flag><span style='font-size:10.0pt'>‑showcol</span></span> is used. The <span
\r
2017 class=Flag><span style='font-size:10.0pt'>+parenfileformat</span></span> flag can be used to generate file locations in the format recognized by Microsoft Visual Studio. If <span class=Flag><span style='font-size:10.0pt'>+parenfileformat</span></span> is
\r
2018 set, the line number follows the file name in parentheses (e.g., <span
\r
2019 class=PlainText><span style='font-size:10.0pt;font-family:Arial'>sample.c(11)</span></span>.)
\r
2020 Messages are split into lines of length less than the value set using <span
\r
2021 class=Flag><span style='font-size:10.0pt'>-linelen <i><number></i></span></span>. The default line length is 80 characters. Splint attempts to split lines in a sensible place as near to the line length limit as possible. </p>
\r
2023 <p class=afterlist style='margin-top:0in'> </p>
\r
2025 <p class=afterlist style='margin-top:0in'>The <span class=Flag><span
\r
2026 style='font-size:10.0pt'>‑hints</span></span> prevents any hints from being printed. Normally, a hint is given only the first time a class of error is reported. To have Splint print a hint for every message regardless, use <span
\r
2027 class=Flag><span style='font-size:10.0pt'>+forcehints</span></span>.</p>
\r
2029 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974934"></a><a
\r
2030 name="_Ref348343333"></a><a name="_Ref348343330"></a><a name="_Ref348092990"></a><a
\r
2031 name="_Ref344882148"></a><a name="_Ref344870278"></a><a name="_Toc344355436">1.2<span
\r
2032 style='font:7.0pt "Times New Roman"'>
\r
2033 </span>Flags</a></h2>
\r
2035 <p class=TextFontCX>So that many programming
\r
2036 styles can be supported, Splint provides several hundred flags for controlling
\r
2037 checking and message reporting. Some of the flags are introduced in the body
\r
2038 of this document. Appendix B describes every flag. Modes and shortcut flags are provided for setting many flags at once. Individual flags can override the mode settings.</p>
\r
2040 <p class=TextFontCX> </p>
\r
2042 <p class=TextFontCX>Flags are preceded by <span
\r
2043 class=Flag><span style='font-size:10.0pt'>+</span></span> or <span class=Flag><span
\r
2044 style='font-size:10.0pt'>-</span></span>. When a flag is preceded by <span
\r
2045 class=Flag><span style='font-size:10.0pt'>+</span></span> we say it is <i>on</i>;
\r
2046 when it is preceded by <span class=Flag><span style='font-size:10.0pt'>-</span></span>
\r
2047 it is <i>off</i>. The precise meaning of on and off depends on the type of
\r
2050 <p class=TextFontCX> </p>
\r
2052 <p class=TextFontCX>The <span class=Flag><span
\r
2053 style='font-size:10.0pt'>+</span></span>/<span class=Flag><span
\r
2054 style='font-size:10.0pt'>-</span></span> flag settings are used for consistency
\r
2055 and clarity, but contradict standard UNIX usage and it is easy to accidentally
\r
2056 use the wrong one. To reduce the likelihood of using the wrong flag, Splint
\r
2057 issues warnings when a flag is set in an unusual way. Warnings are issued when
\r
2058 a flag is redundantly set to the value it already had (these errors are not
\r
2059 reported if the flag is set using a stylized comment), if a mode flag or
\r
2060 special flag is set after a more specific flag that will be set by the general
\r
2061 flag was already set, if value flags are given unreasonable values, of if flags
\r
2062 are set in an inconsistent way. The <span class=Flag><span style='font-size:
\r
2063 10.0pt'>-warnflags</span></span> flag suppresses these warnings.</p>
\r
2065 <p class=TextFontCX> </p>
\r
2067 <p class=TextFontCX>Default flag settings will be read from <span class=Keyword><span style='font-size:10.0pt;font-family:
\r
2068 Arial;color:windowtext'>~/.splintrc</span></span> if it is readable. If there is a <span
\r
2069 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span> file in the working directory, settings in this file will be read next and its settings will override those in <span class=Keyword><span style='font-size:10.0pt;font-family:Arial;
\r
2070 color:windowtext'>~/.splintrc</span></span>. Command-line flags override settings in either file. The syntax of the <span
\r
2071 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span> file is the same as that of command-line flags, except that flags may be on separate lines and the <span class=CodeText><span style='font-size:10.0pt'>#</span></span>
\r
2072 character may be used to indicate that the remainder of the line is a comment.
\r
2073 The <span class=Flag><span style='font-size:10.0pt'>-nof</span></span> flag prevents the <span class=Keyword><span style='font-size:10.0pt;font-family:
\r
2074 Arial;color:windowtext'>~/.splintrc</span></span> file from being loaded. The <span
\r
2075 class=Flag><span style='font-size:10.0pt'>-f </span></span><span
\r
2076 class=Flag><span style='font-size:10.0pt'><i><filename></i></span></span>
\r
2077 flag loads options from <i>filename</i>.</p>
\r
2079 <p class=TextFontCX> </p>
\r
2081 <p class=TextFontCX>To make flag names more
\r
2082 readable, hyphens (<span class=Flag><span style='font-size:10.0pt'>-</span></span>),
\r
2083 underscores (<span class=Flag><span style='font-size:10.0pt'>_</span></span>)
\r
2084 and spaces in flags at the command line are ignored. Hence, <span class=Flag><span
\r
2085 style='font-size:10.0pt'>warnflags</span></span>, <span class=Flag><span
\r
2086 style='font-size:10.0pt'>warn-flags</span></span> and <span class=Flag><span
\r
2087 style='font-size:10.0pt'>warn_flags</span></span> all select the <span
\r
2088 class=Flag><span style='font-size:10.0pt'>warnflags</span></span> option.</p>
\r
2090 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974935"></a><a
\r
2091 name="_Toc344355442"></a><a name="_Ref343086686">1.3<span style='font:7.0pt "Times New Roman"'>
\r
2092 </span>Stylized Comments</a></h2>
\r
2094 <p class=TextFontCX>Stylized comments are used to
\r
2095 provide extra information about a type, variable or function interface to
\r
2096 improve checking, or to control flag settings locally.</p>
\r
2098 <p class=TextFontCX> </p>
\r
2100 <p class=TextFontCX>All stylized comments begin
\r
2101 with <span class=CodeText><span style='font-size:10.0pt'>/*@</span></span> and
\r
2102 are closed by the end of the comment. The role of the <span class=CodeText><span
\r
2103 style='font-size:10.0pt'>@</span></span> may be played by any printable character. Use <span class=Flag><span style='font-size:10.0pt'>-commentchar</span></span><span
\r
2104 class=Flag><span style='font-size:10.0pt'> <i><char></i></span></span> to
\r
2105 select a different stylized comment marker.</p>
\r
2107 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974936">1.3.1<span
\r
2108 style='font:7.0pt "Times New Roman"'>
\r
2109 </span>Annotations</a></h3>
\r
2111 <p class=TextFontCX>Annotations are stylized comments that follow a definite syntax. Although they are comments,
\r
2112 they may only be used in fixed grammatical contexts (e.g., like a type qualifier).</p>
\r
2114 <p class=TextFontCX> </p>
\r
2116 <p class=TextFontCX>Sections 2
\966 describe annotations for expressing assumptions about variables, parameters, return values, structure fields and type definitions. For example, <span class=Annot><span style='font-size:10.0pt'>/*@null@*/</span></span>
\r
2117 is used to express an assumption that a parameter may be NULL. Section 7 describes annotations for describing function interfaces. Other annotations are
\r
2118 described in later sections and Section 10 describes mechanisms users can employ to define new annotations. A summary of annotations is found in Appendix C.</p>
\r
2120 <p class=TextFontCX> </p>
\r
2122 <p class=TextFontCX>Some annotations, known as
\r
2123 control comments, may appear between any two tokens in a C program (unlike
\r
2124 regular C comments, control comments should not be used within a single token
\r
2125 as they introduce new separators in the code). Syntactically, they are no
\r
2126 different from standard comments. Control comments are used to provide
\r
2127 source-level control of Splint checking. They may be used to suppress spurious
\r
2128 messages, set flags, and control checking locally in other ways.</p>
\r
2130 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974937"></a><a
\r
2131 name="_Ref534648584">1.3.2<span style='font:7.0pt "Times New Roman"'>
\r
2132 </span>Setting Flags</a></h3>
\r
2134 <p class=TextFontCX>Most flags (all except those
\r
2135 characterized as
\93global
\94 in Appendix B) can be set locally using control comments. A control comment can set flags locally to override the command line settings. The original flag settings are restored before processing the next file. The syntax for
\r
2136 setting flags in control comments is the same as that of the command line,
\r
2137 except that flags may also be preceded by <span class=CodeText><span
\r
2138 style='font-size:10.0pt'>=</span></span> to restore their setting to the
\r
2139 original command-line value. For instance,</p>
\r
2141 <p class=example><span class=Annot><span style='font-size:10.0pt'>/*@+charint </span></span><span
\r
2142 class=Annot><span style='font-size:10.0pt'>-modifies</span></span><span class=Annot><span style='font-size:10.0pt'> =showfunc</span></span><span
\r
2143 class=Annot><span style='font-size:10.0pt'>@*/</span></span></p>
\r
2145 <p class=TextFontCX>sets <span class=Flag><span
\r
2146 style='font-size:10.0pt'>charint</span></span> on (this makes <span
\r
2147 class=CodeText><span style='font-size:10.0pt'>char</span></span> and <span
\r
2148 class=CodeText><span style='font-size:10.0pt'>int</span></span>
\r
2149 indistinguishable types), sets <span class=Flag><span style='font-size:10.0pt'>modifies</span></span>
\r
2150 off (this prevents reporting of modification errors), and sets <span class=Flag><span style='font-size:10.0pt'>showfunc</span></span> to its original setting (this controls whether or not the name of a function <a name="_Toc344355449">is displayed before a message).</a><a name="_Ref348845205"></a><a
\r
2151 name="_Ref348845200"></a><a name="_Ref348785779"> </a></p>
\r
2153 <h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534974938"></a><a
\r
2154 name="_Ref534641443"></a><a name="_Ref534093860"></a><a name="_Ref534050017"></a><a
\r
2155 name="_Ref534008843">2<span style='font:7.0pt "Times New Roman"'>
\r
2156 </span>Null Dereferences</a></h1>
\r
2158 <p class=TextFontCX>A common cause of program
\r
2159 failures is when a null pointer is dereferenced. Splint detects these errors
\r
2160 by distinguishing possibly <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>
\r
2161 pointers at interface boundaries.</p>
\r
2163 <p class=TextFontCX> </p>
\r
2165 <p class=TextFontCX>The <span class=Annot><span
\r
2166 style='font-size:10.0pt'>null</span></span> annotation is used to indicate that a pointer value may be <span class=CodeText><span
\r
2167 style='font-size:10.0pt'>NULL</span></span>. A pointer declared with no <span
\r
2168 class=Annot><span style='font-size:10.0pt'>null</span></span> annotation, may
\r
2169 not be <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.
\r
2170 If null checking is turned on (controlled by <span class=Flag><span
\r
2171 style='font-size:10.0pt'>null</span></span>), Splint will report an error when
\r
2172 a possibly null pointer is passed as a parameter, returned as a result, or
\r
2173 assigned to an external reference with no <span class=Annot><span
\r
2174 style='font-size:10.0pt'>null</span></span> qualifier.</p>
\r
2176 <p class=TextFontCX> </p>
\r
2178 <p class=TextFontCX>If a pointer is declared with
\r
2179 the <span class=Annot><span style='font-size:10.0pt'>null</span></span> annotation, the code must check that it is not <span
\r
2180 class=CodeText><span style='font-size:10.0pt'>NULL</span></span> on all paths
\r
2181 leading to a dereference of the pointer (or the pointer being returned or
\r
2182 passed as a value with no <span class=Annot><span style='font-size:10.0pt'>null</span></span>
\r
2183 annotation). Dereferences of possibly null pointers may be protected by
\r
2184 conditional statements or <span class=CodeText><span style='font-size:10.0pt'>assert</span></span>ions
\r
2185 (to see how <span class=CodeText><span style='font-size:10.0pt'>assert</span></span>
\r
2186 is declared see Section 8.1) that check the pointer is not <span
\r
2187 class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.</p>
\r
2189 <p class=TextFontCX> </p>
\r
2191 <p class=TextFontCX>Consider two implementations
\r
2192 of <span class=CodeText><span style='font-size:10.0pt'>firstChar</span></span>
\r
2193 in Figure 2. For <span
\r
2194 class=CodeText><span style='font-size:10.0pt'>firstChar1</span></span>, Splint
\r
2195 reports an error since the pointer that is dereferenced is declared with a <span
\r
2196 class=Annot><span style='font-size:10.0pt'>null</span></span> annotation. For <span
\r
2197 class=CodeText><span style='font-size:10.0pt'>firstChar2</span></span>, no
\r
2198 error is reported since the true branch of the <span class=CodeText><span
\r
2199 style='font-size:10.0pt'>s == NULL</span></span> if statement returns, so the
\r
2200 dereference of <span class=CodeText><span style='font-size:10.0pt'>s</span></span>
\r
2201 is only reached if <span class=CodeText><span style='font-size:10.0pt'>s</span></span>
\r
2202 is not <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.</p>
\r
2206 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:5.4pt;border-collapse:collapse;
\r
2207 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
2209 <td valign=top style='width:207.0pt;border:solid black 1.5pt;
\r
2210 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
2211 <p class=TextFontCX align=center
\r
2212 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
2213 color:white'>null.c</span></b></span></p>
\r
2215 <td valign=top style='width:220.5pt;border-top:solid black 1.5pt;
\r
2216 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
2217 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
2218 <p class=TextFontCX align=center
\r
2219 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
2223 <td valign=top style='width:207.0pt;border:solid black 1.5pt;
\r
2224 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
2225 <p class=Verbatim><span style='font-size:9.0pt'> </span></p>
\r
2226 <p class=Verbatim><span style='font-size:9.0pt'>char firstChar1 (/*@null@*/
\r
2227 char *s)</span></p>
\r
2228 <p class=Verbatim><span style='font-size:9.0pt'>{<br>
\r
2229 </span><span class=Line><span style='font-size:8.0pt'>3</span></span><span
\r
2230 style='font-size:9.0pt'> return *s;</span></p>
\r
2231 <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>
\r
2232 <p class=Verbatim><span style='font-size:9.0pt'> </span></p>
\r
2233 <p class=Verbatim><span style='font-size:9.0pt'>char firstChar2 (/*@null@*/
\r
2234 char *s)</span></p>
\r
2235 <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>
\r
2236 <p class=Verbatim><span style='font-size:9.0pt'> if (s == NULL) return
\r
2238 </span><span class=Line><span style='font-size:8.0pt'>9</span></span><span
\r
2239 style='font-size:9.0pt'> return *s;</span></p>
\r
2240 <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>
\r
2242 <td valign=top style='width:220.5pt;border-top:none;border-left:
\r
2243 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
2244 padding:0in 5.4pt 0in 5.4pt'>
\r
2245 <p class=lclintrun>> splint null.c</p>
\r
2246 <p class=lclintrun>Splint 3.0.1</p>
\r
2247 <p class=lclintrun> </p>
\r
2248 <p class=lclintrun>null.c: (in function firstChar1)</p>
\r
2249 <p class=lclintrun>null.c:3:11: Dereference of possibly null pointer s: *s</p>
\r
2250 <p class=lclintrun> null.c:1:35: Storage s may become null</p>
\r
2251 <p class=lclintrun> </p>
\r
2252 <p class=lclintrun>Finished checking --- 1 code warning found</p>
\r
2253 <p class=TextFontCX> </p>
\r
2258 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 style="border-collapse: collapse" bordercolor="#111111">
\r
2260 <td valign=top align=left style='padding-top:6.5pt;padding-right:
\r
2261 9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>
\r
2262 <p class=MsoCaption><a name="_Ref534981289"></a><a name="_Toc534824606"></a><a
\r
2263 name="_Ref534981293">Figure 2</a>. Null Checking</p>
\r
2264 <p class=MsoNormal align=left style='margin-top:0in;margin-right:26.55pt;
\r
2265 margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-align:left;
\r
2266 background:white'><span style='font-size:10.0pt'>Output from running Splint
\r
2267 is displayed in </span><span style='font-size:10.0pt;font-family:"Arial Narrow"'>sans-serif</span><span
\r
2268 style='font-size:10.0pt'> font. The command line is preceded by </span><span
\r
2269 style='font-size:10.0pt;font-family:Arial'>></span><span style='font-size:
\r
2270 10.0pt'>, the rest is output from Splint. Explanations added to the code or
\r
2271 splint output are shown in <i>italics</i>. Code shown in the figures in this
\r
2272 document is available from the splint web site, </span><span
\r
2273 style='font-size:10.0pt;font-family:Arial'>http://www.splint.org</span><span
\r
2274 style='font-size:10.0pt'>. No error is reported for line 9, since the
\r
2275 dereference is reached only if </span><span class=CodeText><span
\r
2276 style='font-size:10.0pt'>s</span></span><span style='font-size:10.0pt'> is
\r
2277 non-null. For most of the figures, the options </span><span class=Flag><span
\r
2278 style='font-size:9.0pt'>-linelen 55 -hints
\96showcol</span></span><span
\r
2279 style='font-size:10.0pt'> were used to produce condensed output, and </span><span
\r
2280 class=Flag><span style='font-size:9.0pt'>
\96exportlocal</span></span><span
\r
2281 style='font-size:10.0pt'> to inhibit warnings about exported declarations. </span></p>
\r
2287 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974939"></a><a
\r
2288 name="_Ref344185475">2.1.1<span style='font:7.0pt "Times New Roman"'>
\r
2289 </span>Predicate Functions</a></h3>
\r
2291 <p class=TextFontCX>Another way to protect null
\r
2292 dereference, is to declare a function using <span class=Annot><span
\r
2293 style='font-size:10.0pt'>nullwhentrue</span></span> or <span
\r
2294 class=Annot><span style='font-size:10.0pt'>falsewhennull</span></span><span
\r
2295 class=Annot><span style='font-size:10.0pt'> </span></span>(these annotations
\r
2296 where originally <span class=Annot><span style='font-size:10.0pt'>falsenull</span></span> and <span
\r
2297 class=Annot><span style='font-size:10.0pt'>truenull</span></span>, but were renamed to clarify the logical asymmetry; <span
\r
2298 class=Annot><span style='font-size:10.0pt'>falsenull</span></span> and <span
\r
2299 class=Annot><span style='font-size:10.0pt'>truenull</span></span> may still be
\r
2300 used) and call the function in a conditional statement before the <span
\r
2301 class=Annot><span style='font-size:10.0pt'>null</span></span>-annotated pointer
\r
2302 is dereferenced. </p>
\r
2304 <p class=TextFontCX> </p>
\r
2306 <p class=TextFontCX>If a function annotated with <span
\r
2307 class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span> returns
\r
2308 true it means its first passed parameter is <span class=CodeText><span
\r
2309 style='font-size:10.0pt'>NULL</span></span>. If it returns false, the parameter
\r
2310 is not <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.
\r
2311 Note that it may return true for a parameter that is not <span class=CodeText><span
\r
2312 style='font-size:10.0pt'>NULL</span></span>. A more descriptive name for <span
\r
2313 class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span> would be
\r
2314 \93if the result is false, the parameter was not null
\94. For example, if <span
\r
2315 class=CodeText><span style='font-size:10.0pt'>isNull</span></span> is declared
\r
2318 <p class=example> /*@nullwhentrue@*/ bool isNull (/*@null@*/ char *x);</p>
\r
2320 <p class=beforelist>we could write <span class=CodeText><span style='font-size:
\r
2321 10.0pt'>firstChar2</span></span>:</p>
\r
2323 <p class=Verbatim> char firstChar2 (/*@null@*/ char *s)</p>
\r
2325 <p class=Verbatim> {</p>
\r
2327 <p class=Verbatim style='margin-left:.5in'>if (isNull (s)) return '\0';<br>
\r
2330 <p class=Verbatim> }</p>
\r
2332 <p class=afterlist>No error is reported since the dereference of <span
\r
2333 class=CodeText><span style='font-size:10.0pt'>s</span></span> is only reached
\r
2334 if <span class=CodeText><span style='font-size:10.0pt'>isNull(s)</span></span>
\r
2335 is false, and since <span class=CodeText><span style='font-size:10.0pt'>isNull</span></span>
\r
2336 is declared with the <span class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span>
\r
2337 annotation this means <span class=CodeText><span style='font-size:10.0pt'>s</span></span>
\r
2338 must not be null.</p>
\r
2340 <p class=TextFontCX> </p>
\r
2342 <p class=TextFontCX>The <span class=Annot><span
\r
2343 style='font-size:10.0pt'>falsewhennull</span></span> annotation is not quite
\r
2344 the logical opposite of <span class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span>.
\r
2345 If a function declared with <span class=Annot><span style='font-size:10.0pt'>falsewhennull</span></span>
\r
2346 returns true, it means its parameter is definitely not <span class=CodeText><span
\r
2347 style='font-size:10.0pt'>NULL</span></span>. If it returns false, the
\r
2348 parameter may or may not be <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.
\r
2349 That is a <span class=Annot><span style='font-size:10.0pt'>falsewhennull</span></span>
\r
2350 always returns false when passed a <span class=CodeText><span style='font-size:
\r
2351 10.0pt'>NULL</span></span> parameter; it may sometimes return false when passed
\r
2352 a non-<span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>
\r
2355 <p class=TextFontCX> </p>
\r
2357 <p class=beforelist>For example, we could define <span class=CodeText><span
\r
2358 style='font-size:10.0pt'>isNonEmpty</span></span> to return true if its
\r
2359 parameter is not <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>
\r
2360 and has least one character before the <span class=CodeText><span
\r
2361 style='font-size:10.0pt'>NUL</span></span> terminator:</p>
\r
2363 <p class=Verbatim> /*@falsewhennull@*/ bool isNonEmpty (/*@null@*/ char *x)</p>
\r
2365 <p class=Verbatim> {</p>
\r
2367 <p class=Verbatim> return (x != NULL && *x !=
\91\0
\92);</p>
\r
2369 <p class=Verbatim> }</p>
\r
2371 <p class=afterlist>Splint does not check that the implementation of a function
\r
2372 declared with <span class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span>
\r
2373 or <span class=Annot><span style='font-size:10.0pt'>falsewhennull</span></span>
\r
2374 is consistent with its annotation, but assumes the annotation is correct when
\r
2375 code that calls the function is checked.</p>
\r
2377 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974940">2.1.2<span
\r
2378 style='font:7.0pt "Times New Roman"'>
\r
2379 </span>Notnull Annotations</a></h3>
\r
2381 <p class=TextFontCX>The <span class=Annot><span
\r
2382 style='font-size:10.0pt'>notnull</span></span> annotation specifies that a
\r
2383 declarator is definitely not <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.
\r
2384 By default, this is assumed, but it may be necessary to use <span class=Annot><span
\r
2385 style='font-size:10.0pt'>notnull</span></span> to override a <span class=Annot><span
\r
2386 style='font-size:10.0pt'>null</span></span> in a type definition. The <span
\r
2387 class=Annot><span style='font-size:10.0pt'>null</span></span> annotation may be
\r
2388 used in a type definition to indicate that all instances of the type may be <span
\r
2389 class=CodeText><span style='font-size:10.0pt'>NULL</span></span>. For declarations
\r
2390 of a type declared using <span class=Annot><span style='font-size:10.0pt'>null</span></span>,
\r
2391 the <span class=Annot><span style='font-size:10.0pt'>null</span></span>
\r
2392 annotation in the type definition may be overridden with <span class=Annot><span
\r
2393 style='font-size:10.0pt'>notnull</span></span>. This is particularly useful for parameters to hidden <span
\r
2394 class=CodeText><span style='font-size:10.0pt'>static</span></span> operations
\r
2395 of abstract types (see Section 4.3) where the null test has already been done before the function is called, or function results known to never be <span
\r
2396 class=CodeText><span style='font-size:10.0pt'>NULL</span></span>. For an
\r
2397 abstract type, <span class=Flag><span style='font-size:10.0pt'>notnull</span></span>
\r
2398 may not be used for parameters to external functions, since clients should not
\r
2399 be aware of when the concrete representation may by <span class=CodeText><span
\r
2400 style='font-size:10.0pt'>NULL</span></span>. Parameters to static functions in
\r
2401 the implementation module, however, may be declared using <span class=Annot><span
\r
2402 style='font-size:10.0pt'>notnull</span></span>, since they may only be called
\r
2403 from places where the representation is accessible. Return values for <span
\r
2404 class=CodeText><span style='font-size:10.0pt'>static</span></span> or external
\r
2405 functions may be declared using <span class=Annot><span style='font-size:10.0pt'>notnull</span></span>.
\r
2408 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974941"></a><a
\r
2409 name="_Ref347853058">2.1.3<span style='font:7.0pt "Times New Roman"'>
\r
2410 </span>Relaxing Null Checking</a></h3>
\r
2412 <p class=TextFontCX>An additional annotation, <span
\r
2413 class=Annot><span style='font-size:10.0pt'>relnull</span></span> may be used to relax null checking. No error is reported when a <span
\r
2414 class=Annot><span style='font-size:10.0pt'>relnull</span></span> value is
\r
2415 dereferenced, or when a possibly null value is assigned to an identifier
\r
2416 declared using <span class=Annot><span style='font-size:10.0pt'>relnull</span></span>.
\r
2419 <p class=TextFontCX> </p>
\r
2421 <p class=TextFontCX>This is generally used for
\r
2422 structure fields that may or may not be null depending on some other
\r
2423 constraint. Splint does not report and error when <span class=CodeText><span
\r
2424 style='font-size:10.0pt'>NULL</span></span> is assigned to a <span class=Annot><span
\r
2425 style='font-size:10.0pt'>relnull</span></span> reference, or when a <span
\r
2426 class=Annot><span style='font-size:10.0pt'>relnull</span></span> reference is
\r
2427 dereferenced. It is up to the programmer to ensure that this constraint is
\r
2428 satisfied before the pointer is dereferenced.</p>
\r
2430 <h1 style='margin-left:0in;text-indent:0in'><a name="_Ref348845237"></a><a
\r
2431 name="_Ref347254431"></a><a name="_Ref347169350"></a><a name="_Ref344916590"></a><a
\r
2432 name="_Ref344907893"></a><a name="_Toc344355407"></a><a name="_Toc534974942"></a><a
\r
2433 name="_Ref534641444"></a><a name="_Ref534093775"></a><a name="_Ref534093769"></a><a
\r
2434 name="_Ref534049950">3<span style='font:7.0pt "Times New Roman"'>
\r
2435 </span>Undefined Values</a></h1>
\r
2437 <p class=TextFontCX>Like many static checkers,
\r
2438 Splint detects instances where the value of a location is used before it is
\r
2439 defined. This analysis is done at the procedural level. If there is a path
\r
2440 through the procedure that uses a local variable before it is defined, a use
\r
2441 before definition error is reported. The <span class=Flag><span
\r
2442 style='font-size:10.0pt'>usedef</span></span> flag controls use before
\r
2443 definition checking.</p>
\r
2445 <p class=TextFontCX> </p>
\r
2447 <p class=TextFontCX>Splint can do more checking
\r
2448 than standard checkers though, because the annotations can be used to describe
\r
2449 what storage must be defined and what storage may be undefined at interface
\r
2450 points. Unannotated references are expected to be completely defined at
\r
2451 interface points. This means all storage reachable from a global variable, parameter to a function, or function return value is defined before and
\r
2452 after a function call.</p>
\r
2454 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974943"></a><a
\r
2455 name="_Ref347811030"></a><a name="_Ref347204458">3.1.1<span style='font:7.0pt "Times New Roman"'>
\r
2456 </span>Undefined Parameters</a></h3>
\r
2458 <p class=TextFontCX>Sometimes, function
\r
2459 parameters or return values are expected to reference undefined or partially
\r
2460 defined storage. For example, a pointer parameter may be intended only as an
\r
2461 address to store a result, or a memory allocator may return allocated but
\r
2462 undefined storage. The <span class=Annot><span style='font-size:10.0pt'>out</span></span> annotation denotes a pointer to storage that may be undefined.</p>
\r
2464 <p class=TextFontCX> </p>
\r
2466 <p class=TextFontCX>Splint does not report an
\r
2467 error when a pointer to allocated but undefined storage is passed as an <span
\r
2468 class=Annot><span style='font-size:10.0pt'>out</span></span> parameter. Within
\r
2469 the body of a function, Splint will assume an <span class=Annot><span
\r
2470 style='font-size:10.0pt'>out</span></span> parameter is allocated but not
\r
2471 necessarily bound to a value, so an error is reported if its value is used
\r
2472 before it is defined. </p>
\r
2474 <p class=TextFontCX> </p>
\r
2476 <p class=TextFontCX>Splint reports an error if
\r
2477 storage reachable by the caller after the call is not defined when the function
\r
2478 returns. This can be suppressed by <span class=Flag><span style='font-size:
\r
2479 10.0pt'>-must-define</span></span>. After a call returns, an actual parameter corresponding to an <span
\r
2480 class=Annot><span style='font-size:10.0pt'>out</span></span> parameter is
\r
2481 assumed to be completely defined.</p>
\r
2483 <p class=TextFontCX> </p>
\r
2485 <p class=TextFontCX>When checking unannotated
\r
2486 programs, many spurious use before definition errors may be reported If <span
\r
2487 class=Flag><span style='font-size:10.0pt'>impouts</span></span> is on, no error is reported when an incompletely-defined parameter is passed to a
\r
2488 formal parameter with no definition annotation, and the actual parameter is
\r
2489 assumed to be defined after the call. The <span class=Annot><span
\r
2490 style='font-size:10.0pt'>/*@in@*/</span></span> annotation can be used to denote a parameter that must be completely defined, even if <span class=Flag><span
\r
2491 style='font-size:10.0pt'>imp-outs</span></span> is on. If <span class=Flag><span
\r
2492 style='font-size:10.0pt'>imp-outs</span></span> is off, there is an implicit <span
\r
2493 class=Annot><span style='font-size:10.0pt'>in</span></span> annotation on every
\r
2494 parameter with no definition annotation.</p>
\r
2496 <p class=TextFontCX> </p>
\r
2498 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
2499 style='margin-left:.9pt;border-collapse:collapse'>
\r
2501 <td width="40%" valign=top style='border:solid black 1.5pt;
\r
2502 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
2503 <p class=TextFontCX align=center
\r
2504 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
2505 color:white'>usedef.c</span></b></span></p>
\r
2507 <td valign=top style='border-top:1.5pt solid black;
\r
2508 border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black;
\r
2509 background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
\r
2510 <p class=TextFontCX align=center
\r
2511 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
2515 <td valign=top style='border:solid black 1.5pt;
\r
2516 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
2517 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2518 color:windowtext'>extern void</span></span></p>
\r
2519 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2520 color:windowtext'> setVal (/*@out@*/ int *x);</span></span></p>
\r
2521 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2522 color:windowtext'>extern int</span></span></p>
\r
2523 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2524 color:windowtext'> getVal (/*@in@*/ int *x);</span></span></p>
\r
2525 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2526 color:windowtext'>extern int mysteryVal </span></span></p>
\r
2527 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2528 color:windowtext'> (int *x);</span></span></p>
\r
2529 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2530 color:windowtext'> </span></span></p>
\r
2531 <p class=MsoNormal align=left style='text-align:left'><span class=Keyword><span
\r
2532 style='font-size:10.0pt;color:windowtext'>int dumbfunc </span></span></p>
\r
2533 <p class=MsoNormal align=left style='text-align:left'><span class=Keyword><span
\r
2534 style='font-size:10.0pt;color:windowtext'> (/*@out@*/ int *x, int i)</span></span></p>
\r
2535 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2536 color:windowtext'>{</span></span></p>
\r
2537 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2538 color:windowtext'> if (i > 3)</span></span></p>
\r
2539 <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>11</span></span><span
\r
2540 class=Keyword><span style='font-size:10.0pt;color:windowtext'> return *x;</span></span></p>
\r
2541 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2542 color:windowtext'> else if (i > 1)</span></span></p>
\r
2543 <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>13</span></span><span
\r
2544 class=Keyword><span style='font-size:10.0pt;color:windowtext'> return
\r
2545 getVal (x);</span></span></p>
\r
2546 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2547 color:windowtext'> else if (i == 0)</span></span></p>
\r
2548 <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>15</span></span><span
\r
2549 class=Keyword><span style='font-size:10.0pt;color:windowtext'> return
\r
2550 mysteryVal (x);</span></span></p>
\r
2551 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2552 color:windowtext'> else</span></span></p>
\r
2553 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2554 color:windowtext'> {</span></span></p>
\r
2555 <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>18</span></span><span
\r
2556 class=Keyword><span style='font-size:10.0pt;color:windowtext'> setVal (x);</span></span></p>
\r
2557 <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>19</span></span><span
\r
2558 class=Keyword><span style='font-size:10.0pt;color:windowtext'> return *x;</span></span></p>
\r
2559 <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;
\r
2560 color:windowtext'> }</span></span></p>
\r
2561 <p class=Verbatim><span class=Keyword><span style='color:windowtext'>}</span></span></p>
\r
2563 <td valign=top style='border-top:medium none;border-left:medium none;
\r
2564 border-bottom:1.5pt solid black;border-right:1.5pt solid black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
\r
2565 <p class=lclintrun>> splint usedef.c</p>
\r
2566 <p class=lclintrun>usedef.c:11: Value *x used before definition</p>
\r
2567 <p class=lclintrun>usedef.c:13: Passed storage x not completely defined</p>
\r
2568 <p class=lclintrun> (*x is undefined): getVal (x)</p>
\r
2569 <p class=lclintrun>usedef.c:15: Passed storage x not completely defined</p>
\r
2570 <p class=lclintrun> (*x is undefined): mysteryVal (x)</p>
\r
2571 <p class=lclintrun> </p>
\r
2572 <p class=lclintrun>Finished checking --- 3 code warnings</p>
\r
2573 <p class=TextFontCX><i> </i></p>
\r
2574 <p class=IndentText style='margin-top:0in;margin-right:.85pt;margin-bottom:
\r
2575 0in;margin-left:0in;margin-bottom:.0001pt;page-break-after:avoid'><i>No error
\r
2576 is reported for line 18, since the incompletely defined storage </i><span
\r
2577 class=CodeText><span style='font-size:10.0pt'>x</span></span><i> is passed as
\r
2578 an </i><span class=CodeText><span style='font-size:10.0pt'>out</span></span><i>
\r
2579 parameter. After the call, </i><span class=CodeText><span style='font-size:
\r
2580 10.0pt'>x</span></span><i> may be dereferenced, since </i><span class=Annot><span
\r
2581 style='font-size:10.0pt'>setVal</span></span><i> is assumed to completely
\r
2582 define its </i><span class=Annot><span style='font-size:10.0pt'>out</span></span><i>
\r
2583 parameter. The warning for line 15 would not appear if </i><span class=Flag><span
\r
2584 style='font-size:10.0pt'>+impouts</span></span><i> were used since there is no </i><span class=Annot><span style='font-size:10.0pt'>in</span></span><i>
\r
2585 annotation on the parameter to </i><span class=Flag><span style='font-size:
\r
2586 10.0pt'>mysteryVal</span></span><i>.</i></p>
\r
2593 <div align="center">
\r
2596 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 style="border-collapse: collapse" bordercolor="#111111">
\r
2598 <td valign=top align=left style='padding-top:0in;padding-right:
\r
2599 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
2600 <p class=MsoCaption><a name="_Ref347764461"></a><a name="_Ref347853047"></a><a
\r
2601 name="_Toc534824607">Figure 3. Use before Definition</a></p>
\r
2613 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974944">3.1.2<span
\r
2614 style='font:7.0pt "Times New Roman"'>
\r
2615 </span>Relaxing Checking</a></h3>
\r
2617 <p class=TextFontCX>The <span class=Annot><span
\r
2618 style='font-size:10.0pt'>reldef</span></span> annotation relaxes definition checking for a particular declaration. Storage declared with a <span class=Annot><span
\r
2619 style='font-size:10.0pt'>reldef</span></span> annotation is assumed to be
\r
2620 defined when it is used, but no error is reported if it is not defined before
\r
2621 it is returned or passed as a parameter.</p>
\r
2623 <p class=TextFontCX> </p>
\r
2625 <p class=TextFontCX>It is up to the programmer to
\r
2626 check <span class=Annot><span style='font-size:10.0pt'>reldef</span></span>
\r
2627 fields are used correctly. They should be avoided in most cases, but may be
\r
2628 useful for fields of structures that may or may not be defined depending on
\r
2629 other constraints. </p>
\r
2631 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974945"></a><a
\r
2632 name="_Ref347853043">3.1.3<span style='font:7.0pt "Times New Roman"'>
\r
2633 </span>Partially Defined Structures</a></h3>
\r
2635 <p class=TextFontCX>The <span class=Annot><span
\r
2636 style='font-size:10.0pt'>partial</span></span> annotation can be used to relax checking of structure fields. A structure with
\r
2637 undefined fields may be passed as a <span class=Annot><span style='font-size:
\r
2638 10.0pt'>partial</span></span> parameter or returned as a <span class=Annot><span
\r
2639 style='font-size:10.0pt'>partial</span></span> result. Inside a function body,
\r
2640 no error is reported when the field of a <span class=Annot><span
\r
2641 style='font-size:10.0pt'>partial</span></span> structure is used. After a
\r
2642 call, all fields of a structure that is passed as a <span class=Annot><span
\r
2643 style='font-size:10.0pt'>partial</span></span> parameter are assumed to be
\r
2644 completely defined.</p>
\r
2646 <h1 style='margin-left:0in;text-indent:0in'><a name="_Ref534977413"></a><a
\r
2647 name="_Toc534974946">4<span style='font:7.0pt "Times New Roman"'>
\r
2648 </span>Types</a></h1>
\r
2650 <p class=TextFontCX>Strong type checking often reveals programming errors. Splint can check primitive C types more strictly
\r
2651 and flexibly than typical compilers (4.1) and provides support a Boolean type (4.2). In addition, users can define abstract types that provide information hiding (0). </p>
\r
2653 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974947"></a><a
\r
2654 name="_Ref534642132"></a><a name="_Ref533964147"></a><a name="_Toc344355401">4.1<span
\r
2655 style='font:7.0pt "Times New Roman"'>
\r
2656 </span>Built in C Types</a></h2>
\r
2658 <p align=right><span style='font-size:9.0pt'>
\r
2659 <i>Two types have </i>compatible<i> type if their types are
\r
2661 <p class=TextFontCX align=right
\r
2662 style='text-align:right'><span style='font-size:9.0pt'>ANSI C, 3.1.2.6.</span></p>
\r
2663 <p class=Sidebar> </p>
\r
2666 <p class=MsoListBullet style='margin-left:0in;text-indent:0in'>Splint supports
\r
2667 stricter checking of built in C types. The <span class=CodeText><span
\r
2668 style='font-size:10.0pt'>char</span></span> and <span class=CodeText><span
\r
2669 style='font-size:10.0pt'>enum</span></span> types can be checked as distinct
\r
2670 types, and the different numeric types can be type-checked strictly.</p>
\r
2672 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974948">4.1.1<span
\r
2673 style='font:7.0pt "Times New Roman"'>
\r
2674 </span>Characters</a></h3>
\r
2676 <p class=TextFontCX>The primitive <span
\r
2677 class=CodeText><span style='font-size:10.0pt'>char</span></span> type can be
\r
2678 type-checked as a distinct type. If <span class=CodeText><span
\r
2679 style='font-size:10.0pt'>char</span></span> is used as a distinct type, common
\r
2680 errors involving assigning <span class=CodeText><span style='font-size:10.0pt'>int</span></span>s
\r
2681 to <span class=CodeText><span style='font-size:10.0pt'>char</span></span>s are
\r
2684 <p class=TextFontCX> </p>
\r
2686 <p class=TextFontCX>The <span class=Flag><span
\r
2687 style='font-size:10.0pt'>+charint</span></span> flag can be used for checking
\r
2688 legacy programs where <span class=CodeText><span style='font-size:10.0pt'>char</span></span>
\r
2689 and <span class=CodeText><span style='font-size:10.0pt'>int</span></span> are
\r
2690 used interchangeably. If <span class=Flag><span style='font-size:10.0pt'>charint</span></span>
\r
2691 is on, <span class=CodeText><span style='font-size:10.0pt'>char</span></span>
\r
2692 types indistinguishable from <span class=CodeText><span style='font-size:10.0pt'>int</span></span>s.
\r
2693 To keep <span class=CodeText><span style='font-size:10.0pt'>char</span></span>
\r
2694 and <span class=Keyword><span style='font-size:10.0pt'>int</span></span> as
\r
2695 distinct types, but allow chars to be used to index arrays, use <span
\r
2696 class=Flag><span style='font-size:10.0pt'>+charindex</span></span>.</p>
\r
2698 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974949">4.1.2<span
\r
2699 style='font:7.0pt "Times New Roman"'>
\r
2700 </span>Enumerators</a></h3>
\r
2702 <p class=TextFontCX>Standard C treats
\r
2703 user-declared <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>
\r
2704 types just like integers. An arbitrary integral value may be assigned to an <span
\r
2705 class=CodeText><span style='font-size:10.0pt'>enum</span></span> type, whether
\r
2706 or not it was listed as an enumerator member. Splint checks each user-defined <span
\r
2707 class=CodeText><span style='font-size:10.0pt'>enum</span></span> type as
\r
2708 distinct type. An error is reported if a value that is not an enumerator
\r
2709 member is assigned to the <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>
\r
2710 type, or if an <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>
\r
2711 type is used as an operand to an arithmetic operator. If the <span class=Flag><span
\r
2712 style='font-size:10.0pt'>enumint</span></span> flag is on, <span
\r
2713 class=CodeText><span style='font-size:10.0pt'>enum</span></span> and <span
\r
2714 class=CodeText><span style='font-size:10.0pt'>int</span></span> types may be
\r
2715 used interchangeably. Like <span class=Flag><span style='font-size:10.0pt'>charindex</span></span>, if the <span
\r
2716 class=Flag><span style='font-size:10.0pt'>enumindex</span></span> flag is on, <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>
\r
2717 types may be used to index arrays.</p>
\r
2719 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974950">4.1.3<span
\r
2720 style='font:7.0pt "Times New Roman"'>
\r
2721 </span>Numeric Types</a></h3>
\r
2723 <p class=TextFontCX>Splint reports where numeric
\r
2724 types are used in dangerous or inconsistent ways. With the strictest checking,
\r
2725 Splint will report an error anytime numeric types do not match exactly. If the
\r
2726 <span class=Flag><span style='font-size:10.0pt'>relax-quals</span></span> flag is on, only those inconsistencies that may corrupt values are reported. For
\r
2727 example, if an <span class=CodeText><span style='font-size:10.0pt'>int</span></span>
\r
2728 is assigned to a variable of type <span class=CodeText><span style='font-size:
\r
2729 10.0pt'>long</span></span> (or passed as a <span class=CodeText><span
\r
2730 style='font-size:10.0pt'>long</span></span> formal parameter), Splint will not
\r
2731 report an error if <span class=Flag><span style='font-size:10.0pt'>relax-quals</span></span>
\r
2732 is on since a <span class=CodeText><span style='font-size:10.0pt'>long</span></span>
\r
2733 must have at least enough bits to store an <span class=CodeText><span
\r
2734 style='font-size:10.0pt'>int</span></span> without data loss. On the other
\r
2735 hand, an error would be reported if the <span class=CodeText><span
\r
2736 style='font-size:10.0pt'>long</span></span> were assigned to an <span
\r
2737 class=CodeText><span style='font-size:10.0pt'>int</span></span>, since the <span
\r
2738 class=CodeText><span style='font-size:10.0pt'>int</span></span> type may not
\r
2739 have enough bits to store the <span class=CodeText><span style='font-size:10.0pt'>long</span></span>
\r
2742 <p class=TextFontCX> </p>
\r
2744 <p class=TextFontCX>Similarly, if a <span
\r
2745 class=CodeText><span style='font-size:10.0pt'>signed</span></span> value is
\r
2746 assigned to an <span class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>,
\r
2747 Splint will report an error since an <span class=CodeText><span
\r
2748 style='font-size:10.0pt'>unsigned</span></span> type cannot represent all <span
\r
2749 class=CodeText><span style='font-size:10.0pt'>signed</span></span> values correctly.
\r
2750 If the <span class=Flag><span style='font-size:10.0pt'>+ignore-signs</span></span>
\r
2751 flag is on, checking is relaxed to ignore all sign qualifiers in type
\r
2752 comparisons (this is not recommended, since it will suppress reporting of real
\r
2753 bugs, but may be necessary for quickly checking certain legacy code). </p>
\r
2755 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974951">4.1.4<span
\r
2756 style='font:7.0pt "Times New Roman"'>
\r
2757 </span>Arbitrary Integral Types</a></h3>
\r
2759 <p class=TextFontCX>Some types are declared to be
\r
2760 integral types, but the concrete type may be implementation dependent. For
\r
2761 example, the standard library declares the types <span class=CodeText><span
\r
2762 style='font-size:10.0pt'>size_t</span></span>, <span class=CodeText><span
\r
2763 style='font-size:10.0pt'>ptr_diff</span></span> and <span class=CodeText><span
\r
2764 style='font-size:10.0pt'>wchar_t</span></span>, but does not constrain their
\r
2765 types other than limiting them to integral types. Programs may rely on them
\r
2766 being integral types (e.g., can use <span class=CodeText><span
\r
2767 style='font-size:10.0pt'>+</span></span> operator on two <span class=CodeText><span
\r
2768 style='font-size:10.0pt'>size_t</span></span> operands), but should not rely on
\r
2769 a particular representation (e.g., <span class=CodeText><span style='font-size:
\r
2770 10.0pt'>long unsigned</span></span>). </p>
\r
2772 <p class=TextFontCX> </p>
\r
2774 <p class=TextFontCX>Splint supports three
\r
2775 different kinds of arbitrary integral types:</p>
\r
2777 <p class=TextFontCX> </p>
\r
2779 <p class=TextFontCX><span class=Annot><span
\r
2780 style='font-size:10.0pt'>/*@integraltype@*/</span></span></p>
\r
2782 <p class=TextFontCX><span class="Annot"><font size="2"> </font>
\r
2783 </span>An arbitrary integral type. The actual type may be any one
\r
2784 of <span class=CodeText><span style='font-size:10.0pt'>short</span></span>, <span
\r
2785 class=CodeText><span style='font-size:10.0pt'>int</span></span>, <span
\r
2786 class=CodeText><span style='font-size:10.0pt'>long</span></span>, <span
\r
2787 class=CodeText><span style='font-size:10.0pt'>unsigned short</span></span>, <span
\r
2788 class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>, or <span
\r
2789 class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>. </p>
\r
2791 <p class=TextFontCX><span class=Annot><span
\r
2792 style='font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>
\r
2794 <p class=TextFontCX><span class="Annot"><font size="2"> </font>
\r
2795 </span>An arbitrary unsigned integral type. The actual type may
\r
2796 be any one of <span class=CodeText><span style='font-size:10.0pt'>unsigned
\r
2797 short</span></span>, <span class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>,
\r
2798 or <span class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>.</p>
\r
2800 <p class=TextFontCX><span class=Annot><span
\r
2801 style='font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>
\r
2803 <p class=TextFontCX><span class="Annot"><font size="2"> </font>
\r
2804 </span>An arbitrary signed integral type. The actual type may be
\r
2805 any one of <span class=CodeText><span style='font-size:10.0pt'>short</span></span>,
\r
2806 <span class=CodeText><span style='font-size:10.0pt'>int</span></span>, or <span
\r
2807 class=CodeText><span style='font-size:10.0pt'>long</span></span>.</p>
\r
2809 <p class=TextFontCX> </p>
\r
2811 <p class=TextFontCX>Splint reports an error if
\r
2812 the code depends on the actual representation of a type declared as an
\r
2813 arbitrary integral. The <span class=Flag><span style='font-size:10.0pt'>match-any-integral</span></span> flag relaxes checking and allows an arbitrary integral type is allowed to match
\r
2814 any integral type.</p>
\r
2816 <p class=TextFontCX> </p>
\r
2818 <p class=TextFontCX>Other flags set the arbitrary
\r
2819 integral types to a concrete type. These should only be used if portability to
\r
2820 platforms that may use different representations is not important. The <span
\r
2821 class=Flag><span style='font-size:10.0pt'>long-integral</span></span> and <span class=Flag><span style='font-size:10.0pt'>long-unsigned-integral</span></span> flags set the type corresponding to <span class=Annot><span style='font-size:
\r
2822 10.0pt'>/*@integraltype@*/</span></span> to be <span class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>
\r
2823 and <span class=CodeText><span style='font-size:10.0pt'>long</span></span>
\r
2824 respectively. The <span class=Flag><span style='font-size:10.0pt'>long-unsigned-unsigned-integral</span></span> flag sets the type corresponding to <span class=Annot><span style='font-size:
\r
2825 10.0pt'>/*@unsignedintegraltype@*/ </span></span>to be <span class=CodeText><span
\r
2826 style='font-size:10.0pt'>unsigned long</span></span>. The <span class=Flag><span
\r
2827 style='font-size:10.0pt'>long-signed-integral</span></span> flag sets the type corresponding to <span class=Annot><span style='font-size:10.0pt'>/*@signedintegraltype@*/
\r
2828 </span></span>to be <span class=CodeText><span style='font-size:10.0pt'>long</span></span>.</p>
\r
2830 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974952"></a><a
\r
2831 name="_Ref534642133"></a><a name="_Ref533964143"></a><a name="_Ref344892413"></a><a
\r
2832 name="_Toc344355400">4.2<span style='font:7.0pt "Times New Roman"'>
\r
2833 </span>Boolean Types</a></h2>
\r
2835 <p class=TextFontCX>Pre-ISO99 C had no Boolean
\r
2836 representation
\96 the result of a comparison operator was an integer, and no
\r
2837 type checking is done for test expressions. C99 introduced a Boolean type (<span
\r
2838 class=CodeText><span style='font-size:10.0pt'>_Bool</span></span> and <span
\r
2839 class=CodeText><span style='font-size:10.0pt'>bool</span></span>, <span
\r
2840 class=CodeText><span style='font-size:10.0pt'>true</span></span> and <span
\r
2841 class=CodeText><span style='font-size:10.0pt'>false</span></span> macros in <span
\r
2842 style='font-size:10.0pt;font-family:Arial'>stdbool.h</span>), but did not
\r
2843 strengthen the type checking. Splint supports a Boolean type that can be
\r
2844 checked distinctly from integral types. Many common errors can be detected by
\r
2845 introducing a distinct Boolean type and stronger type checking. </p>
\r
2847 <p class=TextFontCX> </p>
\r
2849 <p class=TextFontCX>Splint checks that the test
\r
2850 expression in an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>,
\r
2851 <span class=CodeText><span style='font-size:10.0pt'>while</span></span>, or <span
\r
2852 class=CodeText><span style='font-size:10.0pt'>for</span></span> statement or an
\r
2853 operand of a <span class=CodeText><span style='font-size:10.0pt'>&&</span></span>,
\r
2854 <span class=CodeText><span style='font-size:10.0pt'>||</span></span> or <span
\r
2855 class=CodeText><span style='font-size:10.0pt'>!</span></span><span
\r
2856 class=Keyword><span style='font-size:10.0pt'> </span></span>operator is a
\r
2857 Boolean. If the type of a test expression is not a Boolean, Splint will
\r
2858 produce a warning depending on the type of the test expression and flag
\r
2859 settings. If the test expression has pointer type, the warning is inhibited by
\r
2860 <span class=Flag><span style='font-size:10.0pt'>
\96predboolptr</span></span> (this can be used to prevent messages for the idiom of testing if a pointer is not
\r
2861 null without a comparison). If it is type <span class=CodeText><span
\r
2862 style='font-size:10.0pt'>int</span></span>, the warnings is inhibited by <span
\r
2863 class=Flag><span style='font-size:10.0pt'>-pred-bool-int</span></span>. For
\r
2864 all other types, Splint warns unless <span class=Flag><span style='font-size:
\r
2865 10.0pt'>-pred-bool-others</span></span> is set. Relations, comparisons and
\r
2866 certain standard library functions are declared to return Booleans.</p>
\r
2868 <p class=TextFontCX> </p>
\r
2870 <p class=TextFontCX>Since using <span
\r
2871 class=CodeText><span style='font-size:10.0pt'>=</span></span> instead of <span
\r
2872 class=CodeText><span style='font-size:10.0pt'>==</span></span> is such a common
\r
2873 bug, reporting of test expressions that are assignments is controlled by the
\r
2874 separate <span class=Flag><span style='font-size:10.0pt'>pred-assign</span></span>
\r
2875 flag. The message can be suppressed by adding extra parentheses around the
\r
2876 test expression.</p>
\r
2878 <p class=TextFontCX> </p>
\r
2880 <p class=TextFontCX>Use the <span class=Flag><span
\r
2881 style='font-size:10.0pt'>
\96booltype <name></span></span> flag to select the type name is used to represent Boolean values. There is no
\r
2882 default Boolean type, although <span class=CodeText><span style='font-size:
\r
2883 10.0pt'>bool</span></span> is used by convention. The names <span
\r
2884 class=CodeText><span style='font-size:10.0pt'>TRUE</span></span> and <span
\r
2885 class=CodeText><span style='font-size:10.0pt'>FALSE</span></span> are assumed
\r
2886 to represent true and false Boolean values. To change the names of true and
\r
2887 false, use <span class=Flag><span style='font-size:10.0pt'>-booltrue</span></span>
\r
2888 and <span class=Flag><span style='font-size:10.0pt'>-boolfalse</span></span>. (The Splint distribution includes an implementation of <span
\r
2889 class=CodeText><span style='font-size:10.0pt'>bool</span></span>, in <span
\r
2890 class=CodeText><span style='font-size:10.0pt;color:windowtext'>lib/bool.h</span></span>.
\r
2891 However, it isn
\92t necessary to use this implementation to get the benefits of
\r
2892 Boolean checking.)</p>
\r
2894 <p class=TextFontCX> </p>
\r
2896 <p class=TextFontCX>Figure 4 illustrates some of the Boolean checking done by Splint. </p>
\r
2898 <p class=TextFontCX> </p>
\r
2901 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:5.4pt;border-collapse:collapse;
\r
2902 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
2903 <tr style='height:13.3pt'>
\r
2904 <td valign=top style='border:solid black 1.5pt;
\r
2905 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.3pt'>
\r
2906 <p class=TextFontCX align=center
\r
2907 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
2908 color:white'>bool.c</span></b></span></p>
\r
2910 <td valign=top style='border-top:1.5pt solid black;
\r
2911 border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black;
\r
2912 background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
\r
2913 <p class=TextFontCX align=center
\r
2914 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
2918 <td valign=top style='width:2.0in;border:solid black 1.5pt;
\r
2919 border-top:none;padding:0in 5.4pt 0in 5.4pt;height:156.15pt'>
\r
2920 <p class=Verbatim># include "bool.h"</p>
\r
2921 <p class=Verbatim>int f (int i, char *s,</p>
\r
2922 <p class=Verbatim> bool b1, bool b2)</p>
\r
2923 <p class=Verbatim>{</p>
\r
2924 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 6</span></span>
\r
2926 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 7</span></span>
\r
2928 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 8</span></span>
\r
2930 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 9</span></span>
\r
2932 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10</span></span>
\r
2934 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>11</span></span>
\r
2936 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>12</span></span>
\r
2938 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>13</span></span>
\r
2940 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>14</span></span>
\r
2942 <p class=Verbatim>}</p>
\r
2944 <td valign=top style='border-top:medium none;border-left:
\r
2945 medium none;border-bottom:1.5pt solid black;border-right:1.5pt solid black;
\r
2946 padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
\r
2947 <p class=lclintrun>> splint bool.c +predboolptr
\96booltype bool</p>
\r
2948 <p class=lclintrun> </p>
\r
2949 <p class=lclintrun>bool.c:6: Test expression for if is assignment expression:
\r
2951 <p class=lclintrun>bool.c:6: Test expression for if not bool, type int: i = 3</p>
\r
2952 <p class=lclintrun>bool.c:7: Return value type bool does not match declared
\r
2954 <p class=lclintrun>bool.c:8: Operand of ! is non-boolean (int): !i</p>
\r
2955 <p class=lclintrun>bool.c:8: Right operand of || is non-boolean (char *): !i
\r
2957 <p class=lclintrun>bool.c:10: Test expression for if not bool, type char *: s</p>
\r
2958 <p class=lclintrun>bool.c:12: Use of == with bool variables (risks
\r
2959 inconsistency because</p>
\r
2960 <p class=lclintrun> of multiple true values): b1 == b2</p>
\r
2961 <p class=lclintrun> </p>
\r
2962 <p class=lclintrun style='page-break-after:avoid'>Finished checking --- 7
\r
2963 code warnings found</p>
\r
2968 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
2970 <td valign=top align=left style='padding-top:.1in;padding-right:
\r
2971 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
\r
2972 <p class=MsoCaption><a name="_Ref533964137"></a><a name="_Toc534824608"></a><a
\r
2973 name="_Ref534821769">Figure 4</a>. Boolean Checking</p>
\r
2979 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974953"></a><a
\r
2980 name="_Ref534970776">4.3<span style='font:7.0pt "Times New Roman"'>
\r
2981 </span>Abstract Types</a></h2>
\r
2983 <p class=TextFontCX>Information hiding is a
\r
2984 technique for handling complexity. By hiding implementation details, programs
\r
2985 can be understood and developed in distinct modules and the effects of a change
\r
2986 can be localized. One technique for information hiding is data abstraction. An abstract type is used to represent some natural program abstraction. It
\r
2987 provides functions for manipulating instances of the type. The module that
\r
2988 implements these functions is called the <i>implementation</i> module. We call
\r
2989 the functions that are part of the implementation of an abstract type the <i>operations</i>
\r
2990 of the type. Other modules that use the abstract type are called <i>clients</i>.</p>
\r
2992 <p class=TextFontCX> </p>
\r
2994 <p class=TextFontCX>Clients may use the type name
\r
2995 and operations, but should not manipulate or rely on the actual representation
\r
2996 of the type. Only the implementation module may manipulate the representation
\r
2997 of an abstract type. This hides information, since implementers and
\r
2998 maintainers of client modules should not need to know anything about how the
\r
2999 abstract type is implemented. It provides modularity, since the representation
\r
3000 of an abstract type can be changed without having to change any client code.</p>
\r
3002 <p class=TextFontCX> </p>
\r
3004 <p class=TextFontCX>Splint supports abstract
\r
3005 types by detecting places where client code depends on the concrete
\r
3006 representation of an abstract type. Some examples of abstraction violations
\r
3007 detected by Splint are shown in Figure 5.</p>
\r
3009 <p class=beforelist> </p>
\r
3011 <p class=beforelist>To declare an abstract type, the <span class=Annot><span
\r
3012 style='font-size:10.0pt'>abstract</span></span> annotation is added to a <span class=CodeText><span style='font-size:10.0pt'>typedef</span></span>.
\r
3013 For example (in <span class=Keyword><span style='font-size:10.0pt;font-family:
\r
3014 Arial;color:windowtext'>mstring.h</span></span>),</p>
\r
3016 <p class=example>typedef /*@abstract@*/ char *mstring;</p>
\r
3018 <p class=TextFontCX>declares <span
\r
3019 class=CodeText><span style='font-size:10.0pt'>mstring</span></span> as an
\r
3020 abstract type. It is implemented using a <span class=CodeText><span
\r
3021 style='font-size:10.0pt'>char *</span></span>, but clients of the type should
\r
3022 not depend on or need to be aware of this. If it later becomes apparent that a
\r
3023 better representation such as a string table should be used, we should be able
\r
3024 to change the implementation of <span class=CodeText><span style='font-size:
\r
3025 10.0pt'>mstring</span></span> without having to change or inspect any client
\r
3028 <p class=TextFontCX> </p>
\r
3030 <p class=TextFontCX>In a client module, abstract
\r
3031 types are checked by name, not structure. Splint reports an error if an
\r
3032 instance of <span class=CodeText><span style='font-size:10.0pt'>mstring</span></span>
\r
3033 is passed as a <span class=CodeText><span style='font-size:10.0pt'>char *</span></span>
\r
3034 (for instance, as an argument to <span class=CodeText><span style='font-size:
\r
3035 10.0pt'>strlen</span></span>), since the correctness of this call depends on
\r
3036 the representation of the abstract type. Splint also reports errors if any C
\r
3037 operator except assignment (<span class=CodeText><span style='font-size:10.0pt'>=</span></span>)
\r
3038 or <span class=CodeText><span style='font-size:10.0pt'>sizeof</span></span> is
\r
3039 used on an abstract type. The assignment operator is allowed since its
\r
3040 semantics do not depend on the representation of the type (for abstract types
\r
3041 whose instances can change value, a client does need to know if assignment has
\r
3042 copy or sharing semantics as discussed in Section 4.3.2). The use of <span
\r
3043 class=CodeText><span style='font-size:10.0pt'>sizeof</span></span> is also permitted, since this is the only way for clients to allocate pointers to
\r
3044 the abstract type. Type casting objects to or from abstract types in a client
\r
3045 module is an abstraction violation and will generate a warning message.</p>
\r
3047 <p class=TextFontCX> </p>
\r
3049 <p class=TextFontCX>Normally, Splint will assume
\r
3050 a type definition is not abstract unless the <span class=Annot><span
\r
3051 style='font-size:10.0pt'>/*@abstract@*/</span></span> qualifier is used. If
\r
3052 instead you want all user-defined types to be abstract types unless they are
\r
3053 marked as <span class=Annot><span style='font-size:10.0pt'>concrete</span></span>,
\r
3054 the <span class=Flag><span style='font-size:10.0pt'>+imp-abstract</span></span>
\r
3055 flag can be used. This adds an implicit <span class=Annot><span
\r
3056 style='font-size:10.0pt'>abstract</span></span> annotation to any <span
\r
3057 class=CodeText><span style='font-size:10.0pt'>typedef</span></span> that is not
\r
3058 marked with <span class=Annot><span style='font-size:10.0pt'>/*@concrete@*/</span></span>.</p>
\r
3060 <p class=TextFontCX> </p>
\r
3063 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='width:418.5pt;margin-left:.9pt;border-collapse:collapse;
\r
3064 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
3065 <tr style='height:13.45pt'>
\r
3066 <td valign=top style='width:211.5pt;border:solid black 1.5pt;
\r
3067 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
\r
3068 <p class=TextFontCX align=center
\r
3069 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
3070 color:white'>palindrome.c</span></b></span></p>
\r
3072 <td valign=top style='width:207.0pt;border-top:solid black 1.5pt;
\r
3073 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
3074 background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
\r
3075 <p class=TextFontCX align=center
\r
3076 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
3079 <tr style='height:196.2pt'>
\r
3080 <td valign=top style='width:211.5pt;border:solid black 1.5pt;
\r
3081 border-top:none;padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>
\r
3082 <p class=Verbatim><span style='font-size:9.0pt'># include "bool.h"</span></p>
\r
3083 <p class=Verbatim><span style='font-size:9.0pt'># include
\r
3084 "mstring.h"</span></p>
\r
3085 <p class=Verbatim><span style='font-size:9.0pt'> </span></p>
\r
3086 <p class=Verbatim><span style='font-size:9.0pt'>bool isPalindrome (mstring s)</span></p>
\r
3087 <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>
\r
3088 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 6</span></span><span
\r
3089 style='font-size:9.0pt'> char *current = (char *) s;</span></p>
\r
3090 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 7</span></span><span
\r
3091 style='font-size:9.0pt'> int i, len = (int) strlen (s);</span></p>
\r
3092 <p class=Verbatim><span style='font-size:9.0pt'> </span></p>
\r
3093 <p class=Verbatim><span style='font-size:9.0pt'> for (i = 0; i <= (len+1)
\r
3094 / 2; i++)</span></p>
\r
3095 <p class=Verbatim><span style='font-size:9.0pt'> {</span></p>
\r
3096 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>11</span></span><span
\r
3097 style='font-size:9.0pt'> if (current[i] != s[len-i-1])</span></p>
\r
3098 <p class=Verbatim><span style='font-size:9.0pt'> return FALSE;</span></p>
\r
3099 <p class=Verbatim><span style='font-size:9.0pt'> }</span></p>
\r
3100 <p class=Verbatim><span style='font-size:9.0pt'> return TRUE;</span></p>
\r
3101 <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>
\r
3102 <p class=Verbatim><span style='font-size:9.0pt'> </span></p>
\r
3103 <p class=Verbatim><span style='font-size:9.0pt'>bool callPal (void)</span></p>
\r
3104 <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>
\r
3105 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>19</span></span><i><span
\r
3106 style='font-size:9.0pt;font-family:Arial'> </span></i><span
\r
3107 style='font-size:9.0pt'>return (isPalindrome ("bob"));</span></p>
\r
3108 <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>
\r
3110 <td valign=top style='width:207.0pt;border-top:none;border-left:
\r
3111 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
3112 padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>
\r
3113 <p class=lclintrun>> splint palindrome.c</p>
\r
3114 <p class=lclintrun> </p>
\r
3115 <p class=lclintrun>palindrome.c:6: Cast from underlying</p>
\r
3116 <p class=lclintrun> abstract type mstring: (char *)s</p>
\r
3117 <p class=lclintrun>palindrome.c:7: Function strlen expects arg</p>
\r
3118 <p class=lclintrun> 1 to be char * gets mstring: s</p>
\r
3119 <p class=lclintrun>palindrome.c:11: Array fetch from non-array</p>
\r
3120 <p class=lclintrun> (mstring): s[len - i - 1]</p>
\r
3121 <p class=lclintrun>palindrome.c:19: Function isPalindrome</p>
\r
3122 <p class=lclintrun> expects arg 1 to be mstring gets char *:</p>
\r
3123 <p class=lclintrun> "bob"</p>
\r
3124 <p class=TextFontCX> </p>
\r
3125 <p class=lclintrun>Finished checking --- 4 code warnings</p>
\r
3126 <p class=TextFontCX><span style='font-size:
\r
3127 9.0pt;font-family:Times'> </span></p>
\r
3132 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
3134 <td valign=top style='padding-top:0in;padding-right:
\r
3135 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
3136 <p class=MsoCaption><a name="_Toc534824609"></a><a name="_Toc347255385"></a><a
\r
3137 name="_Ref344908730"></a><a name="_Ref344908735">Figure 5</a>. Information Hiding
\r
3146 <i><span style='font-size:9.0pt'> Traditionally, programming books wax mathematical when
\r
3147 they arrive at the topic of abstract data types
\85<br>Such books make it seem as
\r
3148 if you
\92d never actually use an abstract data type except as a sleep aid. </i></p>
\r
3149 <p class=TextFontCX align=right
\r
3150 style='text-align:right'><i><span style='font-size:9.0pt'> </span></i><span
\r
3151 style='font-size:9.0pt'> Steve McConnell</span><span style='font-size:9.0pt'> </span></p>
\r
3152 <p class=TextFontCX><i> </i></p>
\r
3154 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974954"></a><a
\r
3155 name="_Ref344892422"></a><a name="_Ref344870884"></a><a name="_Toc344355398">4.3.1<span
\r
3156 style='font:7.0pt "Times New Roman"'>
\r
3157 </span>Controlling Access</a></h3>
\r
3159 <p class=TextFontCX>Where code may manipulate the
\r
3160 representation of an abstract type, we say the code has <i>access</i> to that
\r
3161 type. If code has access to an abstract type, the representation of the type
\r
3162 and the abstract type are indistinguishable. Usually, a single program module
\r
3163 that is the only code that has access to the type representation implements an
\r
3164 abstract type. Sometimes, more complicated access control is desired if the implementation of an abstract type is split across program files, or particular
\r
3165 client code needs to access the representation.</p>
\r
3167 <p class=TextFontCX> </p>
\r
3169 <p class=beforelist>There are a several ways of selecting what code has access
\r
3170 the representation of an abstract type:</p>
\r
3172 <p class=TextFontCX style='margin-left:12.95pt;
\r
3173 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
3174 </span></span>Modules. An abstract type defined in <i><span style='font-size:
\r
3175 10.0pt;font-family:Arial'>M</span></i><span class=Keyword><span
\r
3176 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span> is
\r
3177 accessible in <i><span style='font-size:10.0pt;font-family:Arial'>M</span></i><span
\r
3178 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>.
\r
3179 Controlled by the <span class=Flag><span style='font-size:10.0pt'>accessmodule</span></span>
\r
3180 flag. This means when <span class=Flag><span style='font-size:10.0pt'>accessmodule</span></span>
\r
3181 is on, as it is by default, the module access rule is in effect. If <span
\r
3182 class=Flag><span style='font-size:10.0pt'>accessmodule</span></span> is off (when <span class=Flag><span style='font-size:10.0pt'>-access-module</span></span>
\r
3183 is used), the module access rule is not in effect and an abstract type defined
\r
3184 in <i><span style='font-size:10.0pt;font-family:Arial'>M</span></i><span
\r
3185 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
\r
3186 is not necessarily accessible in <i><span style='font-size:10.0pt;font-family:
\r
3187 Arial'>M</span></i><span class=Keyword><span style='font-size:10.0pt;
\r
3188 font-family:Arial;color:windowtext'>.c</span></span>.</p>
\r
3190 <p class=TextFontCX style='margin-left:12.95pt;
\r
3191 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
3192 </span></span>File names. An abstract type named <span class=CodeText><i><span
\r
3193 style='font-size:10.0pt'>type</span></i></span> is accessible in files named <span
\r
3194 class=CodeText><i><span style='font-size:10.0pt'>type.<extension></span></i></span>.
\r
3195 For example, the representation of <span class=CodeText><span style='font-size:
\r
3196 10.0pt'>mstring</span></span> is accessible in <span class=CodeText><span
\r
3197 style='font-size:10.0pt'>mstring.h</span></span> and <span class=CodeText><span
\r
3198 style='font-size:10.0pt'>mstring.c</span></span>. Controlled by the <span
\r
3199 class=Flag><span style='font-size:10.0pt'>access-file</span></span> flag.</p>
\r
3201 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
3202 style='font:7.0pt "Times New Roman"'> </span></span>Function
\r
3203 names. An abstract type named <span class=CodeText><i><span style='font-size:
\r
3204 10.0pt'>type</span></i></span> may be accessible in a function named <span
\r
3205 class=CodeText><i><span style='font-size:10.0pt'>type_name</span></i></span> or
\r
3206 <span class=CodeText><i><span style='font-size:10.0pt'>typeName</span></i></span>.
\r
3207 For example, <span class=CodeText><span style='font-size:10.0pt'>mstring_length</span></span><span
\r
3208 style='text-transform:uppercase'> </span>and <span class=CodeText><span
\r
3209 style='font-size:10.0pt'>mstringLength</span></span> would have access to the <span
\r
3210 class=CodeText><span style='font-size:10.0pt'>mstring</span></span> abstract
\r
3211 type. Controlled by <span class=Flag><span style='font-size:10.0pt'>accessfunction</span></span> and the naming convention (see Section 12).</p>
\r
3213 <p class=TextFontCX style='margin-left:12.95pt;
\r
3214 text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>
\r
3215 </span></span>Access control comments. The syntax <span class=Annot><span
\r
3216 style='font-size:10.0pt'>/*@access <i>type</i>,<sup>+</sup>@*/</span></span><a
\r
3217 href="#_ftn2" name="_ftnref2" title=""><span class=MsoFootnoteReference><span
\r
3218 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>
\r
3219 allows the following code to access the representation of <span class=CodeText><i><span
\r
3220 style='font-size:10.0pt'>type</span></i></span>. Similarly, <span class=Annot><span
\r
3221 style='font-size:10.0pt'>/*@noaccess </span></span><span
\r
3222 class=Annot><span style='font-size:10.0pt'><i>type</i>,<sup>+</sup>@*/ </span></span>restricts
\r
3223 access to the representation of <span class=CodeText><i><span style='font-size:
\r
3224 10.0pt'>type</span></i></span>. The type in a <span class=Annot><span
\r
3225 style='font-size:10.0pt'>noaccess</span></span> comment must have been declared
\r
3226 as an abstract type.</p>
\r
3228 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974955"></a><a
\r
3229 name="_Toc344355399"></a><a name="_Ref343240525"></a><a name="_Ref343240518">4.3.2<span
\r
3230 style='font:7.0pt "Times New Roman"'>
\r
3231 </span>Mutability</a></h3>
\r
3233 <p class=TextFontCX>We can view types as being <i>mutable</i>
\r
3234 or <i>immutable</i>. A type is mutable if passing it as a parameter to a
\r
3235 function call can change the value of an instance of the type. For example,
\r
3236 the primitive type <span class=CodeText><span style='font-size:10.0pt'>int</span></span>
\r
3237 is immutable. If <span class=CodeText><span style='font-size:10.0pt'>i</span></span>
\r
3238 is a local variable of type <span class=CodeText><span style='font-size:10.0pt'>int</span></span>
\r
3239 and no variables point to the location where <span class=CodeText><span
\r
3240 style='font-size:10.0pt'>i</span></span> is stored, the value of <span
\r
3241 class=CodeText><span style='font-size:10.0pt'>i</span></span> must be the same
\r
3242 before and after the call <span class=CodeText><span style='font-size:10.0pt'>f
\r
3243 (i)</span></span>. Structure and union types are also immutable, since they
\r
3244 are copied when they are passed as arguments. On the other hand, pointer types
\r
3245 are mutable. If <span class=CodeText><span style='font-size:10.0pt'>x</span></span>
\r
3246 is a local variable of type <span class=CodeText><span style='font-size:10.0pt'>int
\r
3247 *</span></span>, the value of <span class=CodeText><span style='font-size:10.0pt'>*x</span></span>
\r
3248 (and hence, the value of the object <span class=CodeText><span
\r
3249 style='font-size:10.0pt'>x</span></span>) can be changed by the function call <span
\r
3250 class=CodeText><span style='font-size:10.0pt'>g(x)</span></span>. </p>
\r
3252 <p class=TextFontCX> </p>
\r
3254 <p class=TextFontCX>The mutability of a concrete
\r
3255 type is determined by its type definition. For abstract types, mutability does
\r
3256 not depend on the type representation but on what operations the type provides.
\r
3257 If an abstract type has operations that may change the value of instances of
\r
3258 the type, the type is mutable. If not, it is immutable. The value of an
\r
3259 instance of an immutable type never changes. Since object sharing is
\r
3260 noticeable only for mutable types, they are checked differently from immutable
\r
3263 <p class=TextFontCX> </p>
\r
3265 <p class=beforelist>The <span class=Annot><span style='font-size:10.0pt'>/*@mutable@*/</span></span>
\r
3266 and <span class=Annot><span style='font-size:10.0pt'>/*@immutable@*/</span></span>
\r
3267 annotations are used to declare an abstract type as mutable or immutable. (If
\r
3268 neither is used, the abstract type is assumed to be mutable.) For example,</p>
\r
3270 <p class=Verbatim> typedef /*@abstract@*/ /*@mutable@*/ char *mstring;</p>
\r
3272 <p class=Verbatim> typedef /*@abstract@*/ /*@immutable@*/ int weekDay;</p>
\r
3274 <p class=afterlist>declares <span class=CodeText><span style='font-size:10.0pt'>mstring</span></span>
\r
3275 as a mutable abstract type and <span class=CodeText><span style='font-size:
\r
3276 10.0pt'>weekDay </span></span>as an immutable abstract type.</p>
\r
3278 <p class=TextFontCX> </p>
\r
3280 <p class=TextFontCX>Clients of a mutable abstract
\r
3281 type need to know the semantics of assignment. After the assignment expression
\r
3282 <span class=CodeText><span style='font-size:10.0pt'>s = t</span></span>, do <span
\r
3283 class=CodeText><span style='font-size:10.0pt'>s</span></span> and <span
\r
3284 class=CodeText><span style='font-size:10.0pt'>t</span></span> refer to the same
\r
3285 object (that is, will changes to the value of <span class=CodeText><span
\r
3286 style='font-size:10.0pt'>s</span></span> also change the value of <span
\r
3287 class=CodeText><span style='font-size:10.0pt'>t</span></span>).</p>
\r
3289 <p class=TextFontCX> </p>
\r
3291 <p class=TextFontCX>Splint prescribes that all
\r
3292 abstract types have sharing semantics, so <span class=CodeText><span
\r
3293 style='font-size:10.0pt'>s</span></span> and <span class=CodeText><span
\r
3294 style='font-size:10.0pt'>t</span></span> would indeed be the same object.
\r
3295 Splint will produce a warning if a mutable type is implemented with a
\r
3296 representation (e.g., a <span class=CodeText><span style='font-size:10.0pt'>struct</span></span>)
\r
3297 that does not provide sharing semantics (controlled by <span class=Flag><span
\r
3298 style='font-size:10.0pt'>mutrep</span></span> flag). </p>
\r
3300 <p class=TextFontCX> </p>
\r
3302 <p class=TextFontCX>The mutability of an abstract
\r
3303 type is not necessarily the same as the mutability of its representation. We
\r
3304 could use the immutable concrete type <span class=CodeText><span
\r
3305 style='font-size:10.0pt'>int</span></span> to represent mutable strings using
\r
3306 an index into a string table, or declare <span class=CodeText><span
\r
3307 style='font-size:10.0pt'>mstring</span></span> as immutable as long as no
\r
3308 operations are provided that modify the value of an <span class=CodeText><span
\r
3309 style='font-size:10.0pt'>mstring</span></span>.</p>
\r
3311 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974956"></a><a
\r
3312 name="_Toc344355422"></a><a name="_Ref343109614">4.4<span style='font:7.0pt "Times New Roman"'>
\r
3313 </span>Polymorphism</a></h2>
\r
3315 <p class=TextFontCX>In C, all declarators must be
\r
3316 declared to have exactly one type. This makes it impossible to write functions
\r
3317 that operate on more than one type of parameter
\96 for example, we cannot use
\r
3318 the same square function for <span class=CodeText><span style='font-size:10.0pt'>int</span></span>s
\r
3319 and <span class=CodeText><span style='font-size:10.0pt'>float</span></span>s.
\r
3320 Because of the stricter type checking made possible by Splint, it is often
\r
3321 useful to declare a parameter that has more than one possible type.</p>
\r
3323 <p class=TextFontCX> </p>
\r
3325 <p class=TextFontCX>Splint provides alternate
\r
3326 types to indicate that a declaration may be one of several possible types. The
\r
3327 <span class=Annot><span style='font-size:10.0pt'>/*@alt <i>type</i>,<sup>+</sup>@*/
\r
3328 </span></span>annotation creates a union type. For example, <span
\r
3329 class=CodeText><span style='font-size:10.0pt'>int </span></span><a
\r
3330 href="mailto:/*@alt"><span class=Annot><span style='font-size:10.0pt'>/*@alt</span></span></a><span
\r
3331 class=Annot><span style='font-size:10.0pt'> char, unsigned </span></span><a
\r
3332 href="mailto:char@*/"><span class=Annot><span style='font-size:10.0pt'>char@*/</span></span></a><span
\r
3333 class=CodeText><span style='font-size:10.0pt'> c </span></span>declares <span
\r
3334 class=CodeText><span style='font-size:10.0pt'>c</span></span> such that either
\r
3335 an <span class=CodeText><span style='font-size:10.0pt'>int</span></span>, <span
\r
3336 class=CodeText><span style='font-size:10.0pt'>char</span></span> or <span
\r
3337 class=CodeText><span style='font-size:10.0pt'>unsigned char</span></span> value
\r
3338 may be assigned to it without warning.</p>
\r
3340 <p class=TextFontCX> </p>
\r
3342 <p class=TextFontCX>One use of alternate types is
\r
3343 to specify the type of a macro that operates on multiple types of operands (see
\r
3344 Section 11.2.1). Alternate types are also useful for declaring functions for which the return value may be safely ignored (see Section 8.4.2). A function can be declared to return <span
\r
3345 class=CodeText><i><span style='font-size:10.0pt'>t</span></i></span> <a
\r
3346 href="mailto:/*@alt"><span class=Annot><span style='font-size:10.0pt'>/*@alt</span></span></a><span
\r
3347 class=Annot><span style='font-size:10.0pt'> </span></span><a
\r
3348 href="mailto:void@*/"><span class=Annot><span style='font-size:10.0pt'>void@*/</span></span></a>
\r
3349 to indicate that it returns a value of type <span class=CodeText><i><span
\r
3350 style='font-size:10.0pt'>t</span></i></span>, but there should be not warning
\r
3351 if that value is ignored.</p>
\r
3353 <h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534974957"></a><a
\r
3354 name="_Ref534008388">5<span style='font:7.0pt "Times New Roman"'>
\r
3355 </span>Memory Management</a></h1>
\r
3357 <p class=TextFontCX>About half the bugs in
\r
3358 typical C programs can be attributed to memory management problems. Memory management bugs are notoriously difficult to detect through traditional
\r
3359 techniques. Often, the symptom of the bug is far removed from its actual
\r
3360 source. Memory management bugs often only appear sporadically and some bugs
\r
3361 may only be apparent when compiler optimizations are turned on or the code is
\r
3362 compiled on a different platform. Run-time tools offer some help, but are
\r
3363 cumbersome to use and limited to detecting errors that occur when test cases
\r
3364 are run. By detecting these errors statically, we can be confident that
\r
3365 certain types of errors will never occur and provide verified documentation on
\r
3366 the memory management behavior of a program. </p>
\r
3368 <p class=TextFontCX> </p>
\r
3370 <p class=beforelist>Splint can detect many memory management errors at compile
\r
3371 time including using storage that may have been deallocated (Section 5.2),
\r
3372 memory leaks (Section 5.2), or returning a pointer to stack-allocated storage (Section 5.2.6).</p>
\r
3376 <i><span style='font-size:9.0pt'>Yea, from the table
\r
3377 of my memory I'll wipe away all trivial fond records, all saws of books,<br>all
\r
3378 forms, all pressures past, that youth and observation copied there.</span></i><br>
\r
3380 style='font-size:9.0pt'>Hamlet prefers garbage collection
\r
3381 (Shakespeare, Hamlet. Act I, Scene v)</span></p>
\r
3383 <p class=afterlist>Most of these checks depend on annotations added to programs
\r
3384 to document assumptions related to memory management and pointer values. By
\r
3385 documenting these assumptions for function interfaces, variables, type
\r
3386 definitions and structure fields, memory management bugs can be detected at
\r
3387 their source
\97 where an assumption is violated. In addition, precise documentation
\r
3388 about memory management decisions makes it easier to change code.</p>
\r
3390 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974958"></a><a
\r
3391 name="_Toc344355408">5.1<span style='font:7.0pt "Times New Roman"'>
\r
3392 </span>Storage Model</a></h2>
\r
3394 <p class=TextFontCX>This section describes
\r
3395 execution-time concepts for describing the state of storage more precisely than
\r
3396 can be done using standard C terminology. Certain uses of storage are likely
\r
3397 to indicate program bugs, and are reported as anomalies.<a href="#_ftn3"
\r
3398 name="_ftnref3" title=""><span class=MsoFootnoteReference><b><span
\r
3399 class=MsoFootnoteReference><b><span style='font-size:11.0pt;font-family:"Times New Roman"'>[3]</span></b></span></b></span></a></p>
\r
3401 <p class=TextFontCX> </p>
\r
3403 <p class=TextFontCX>Splint assumes a CLU-like object storage model.<a href="#_ftn4" name="_ftnref4" title=""><span
\r
3404 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
3405 style='font-size:11.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>
\r
3406 An <i>object</i> is a typed region of storage. Some objects use a fixed amount
\r
3407 of storage that is allocated and deallocated automatically by the compiler.
\r
3408 Other objects use dynamic storage that must be managed by the program.</p>
\r
3410 <p class=TextFontCX> </p>
\r
3412 <p class=TextFontCX>Storage is <i>undefined</i>
\r
3413 if it has not been assigned a value, and <i>defined</i> after it has been
\r
3414 assigned a value. An object is <i>completely defined</i> if all storage that
\r
3415 may be reached from it is defined. What storage is reachable from an object
\r
3416 depends on the type and value of the object. For example, if <span
\r
3417 class=CodeText><span style='font-size:10.0pt'>p</span></span> is a pointer to a
\r
3418 structure, <span class=CodeText><span style='font-size:10.0pt'>p</span></span>
\r
3419 is completely defined if the value of <span class=CodeText><span
\r
3420 style='font-size:10.0pt'>p</span></span> is <span class=CodeText><span
\r
3421 style='font-size:10.0pt'>NULL</span></span>, or if every field of the structure
\r
3422 <span class=CodeText><span style='font-size:10.0pt'>p</span></span> points to
\r
3423 is completely defined.</p>
\r
3425 <p class=TextFontCX> </p>
\r
3427 <p class=TextFontCX>When an expression is used as
\r
3428 the left side of an assignment expression we say it is <i>used as an lvalue</i>.
\r
3429 Its location in memory is used, but not its value. Undefined storage may be
\r
3430 used as an lvalue since only its location is needed. When storage is used in
\r
3431 any other way, such as on the right side of an assignment, as an operand to a
\r
3432 primitive operator (including the indirection operator, <span class=CodeText><span
\r
3433 style='font-size:10.0pt'>*</span></span>),<a href="#_ftn5" name="_ftnref5"
\r
3434 title=""><span class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
3435 style='font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>
\r
3436 or as a function parameter, we say it is <i>used as an rvalue</i>. It is an
\r
3437 anomaly to use undefined storage as an rvalue.</p>
\r
3439 <p class=TextFontCX> </p>
\r
3441 <p class=TextFontCX>A <i>pointer</i> is a typed
\r
3442 memory address. A pointer is either <i>live</i> or <i>dead</i>. A live
\r
3443 pointer is either <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>
\r
3444 or an address within allocated storage. A pointer that points to an object is
\r
3445 an <i>object</i> pointer. A pointer that points inside an object (e.g., to the
\r
3446 third element of an allocated block) is an <i>offset</i> pointer. A pointer
\r
3447 that points to allocated storage that is not defined is an <i>allocated</i>
\r
3448 pointer. The result of dereferencing an allocated pointer is undefined
\r
3449 storage. Hence, it is an anomaly to use it as an rvalue. A dead (or
\r
3450 \93dangling
\94) pointer does not point to allocated storage. A pointer becomes
\r
3451 dead if the storage it points to is deallocated (e.g., the pointer is passed to
\r
3452 the <span class=CodeText><span style='font-size:10.0pt'>free</span></span> library
\r
3453 function.) It is an anomaly to use a dead pointer as an rvalue.</p>
\r
3455 <p class=TextFontCX> </p>
\r
3457 <p class=TextFontCX>There is a special object <i>null</i>
\r
3458 corresponding to the <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span><span
\r
3459 class=Keyword><span style='font-size:10.0pt'> </span></span>pointer in a C
\r
3460 program. A pointer that may have the value <span class=CodeText><span
\r
3461 style='font-size:10.0pt'>NULL</span></span> is a <i>possibly-null</i> pointer.
\r
3462 It is an anomaly to use a possibly-null pointer where a non-null pointer is
\r
3463 expected (e.g., certain function arguments or the indirection operator).</p>
\r
3465 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974959"></a><a
\r
3466 name="_Ref347476065"></a><a name="_Ref347469133"></a><a name="_Ref347465595"></a><a
\r
3467 name="_Ref344893840"></a><a name="_Toc344355409">5.2<span style='font:7.0pt "Times New Roman"'>
\r
3468 </span>Deallocation Errors</a></h2>
\r
3470 <p class=TextFontCX>There are two kinds of
\r
3471 deallocation errors with which we are concerned: deallocating storage when
\r
3472 there are other live references to the same storage, or failing to deallocate
\r
3473 storage before the last reference to it is lost. To handle these deallocation
\r
3474 errors, we introduce a concept of an obligation to release storage. Every time
\r
3475 storage is allocated, it creates an obligation to release the storage. This
\r
3476 obligation is attached to the reference to which the storage is assigned.<a
\r
3477 href="#_ftn6" name="_ftnref6" title=""><span class=MsoFootnoteReference><span
\r
3478 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>
\r
3479 Before the scope of the reference is exited or it is assigned to a new value,
\r
3480 the storage to which it points must be released. Annotations can be used to indicate that this obligation is transferred through a return value,
\r
3481 function parameter or assignment to an external reference.</p>
\r
3483 <p align=right><i>
\r
3484 <span style='font-size:9.0pt'>
\91Tis
\r
3485 in my memory lock
\92d, and you yourself shall keep the key of it.</span></i><br><span
\r
3486 style='font-size:9.0pt'>Ophelia prefers explicit deallocation (Hamlet. Act
\r
3487 I, Scene iii)</span></p>
\r
3489 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974960">5.2.1<span
\r
3490 style='font:7.0pt "Times New Roman"'>
\r
3491 </span>Unshared References</a></h3>
\r
3494 <p class=TextFontCX>The <span class=Annot><span
\r
3495 style='font-size:10.0pt'>only</span></span> annotation is used to indicate a
\r
3496 reference is the only pointer to the object it points to. We can view the
\r
3497 reference as having an obligation to release this storage. This obligation is
\r
3498 satisfied by transferring it to some other reference in one of three ways:</p>
\r
3500 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
3501 style='font:7.0pt "Times New Roman"'> </span></span>pass
\r
3502 it as an actual parameter corresponding to a formal parameter declared with an <span
\r
3503 class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
3506 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
3507 style='font:7.0pt "Times New Roman"'> </span></span>assign
\r
3508 it to an external reference declared with an <span class=Annot><span
\r
3509 style='font-size:10.0pt'>only</span></span> annotation</p>
\r
3511 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
3512 style='font:7.0pt "Times New Roman"'> </span></span>return
\r
3513 it as a result declared with an <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
3516 <p class=afterlist>After the release obligation is transferred, the original
\r
3517 reference is a dead pointer and the storage it points to may not be used. </p>
\r
3519 <p class=TextFontCX> </p>
\r
3521 <p class=TextFontCX>All obligations to release
\r
3522 storage stem from primitive allocation routines (e.g., <span class=CodeText><span
\r
3523 style='font-size:10.0pt'>malloc</span></span>), and are ultimately satisfied by
\r
3524 calls to <span class=CodeText><span style='font-size:10.0pt'>free</span></span>. The standard library declared the primitive allocation and deallocation routines.</p>
\r
3526 <p class=TextFontCX> </p>
\r
3528 <p class=TextFontCX>The basic memory allocator, <span
\r
3529 class=CodeText><span style='font-size:10.0pt'>malloc</span></span>, is declared:</p>
\r
3531 <p class=example><a href="mailto:/*@only@*/">/*@only@*/</a> /*@null@*/ void
\r
3532 *malloc (size_t size);</p>
\r
3534 <p class=TextFontCX>It returns an object that is
\r
3535 referenced only by the function return value. </p>
\r
3537 <p class=TextFontCX> </p>
\r
3539 <p class=TextFontCX>The deallocator, <span
\r
3540 class=CodeText><span style='font-size:10.0pt'>free</span></span>, is declared:<a href="#_ftn7" name="_ftnref7" title=""><span
\r
3541 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
3542 style='font-size:11.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a></p>
\r
3544 <p class=example>void free (/*@only@*/ <a href="mailto:/*@out@*/">/*@out@*/</a>
\r
3545 <a href="mailto:/*@null@*/">/*@null@*/</a> void *ptr);</p>
\r
3548 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt;
\r
3549 margin-right:-2.25pt'>
\r
3551 <td valign=top style='width:193.5pt;border:solid black 1.5pt;
\r
3552 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
3553 <p class=TextFontCX align=center
\r
3554 style='text-align:center'><a name="_Ref344990094"><span class=Keyword><b><span
\r
3555 style='font-size:10.0pt;color:white'>only.c</span></b></span></a></p>
\r
3557 <td valign=top style='width:225.0pt;border-top:solid black 1.5pt;
\r
3558 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
3559 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
3560 <p class=TextFontCX align=center
\r
3561 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
3565 <td valign=top style='width:193.5pt;border:solid black 1.5pt;
\r
3566 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
3567 <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>1 </span></i><span
\r
3568 style='font-size:9.5pt'>extern /*@only@*/ int *glob;</span></p>
\r
3569 <p class=Verbatim><span style='font-size:9.5pt'> </span></p>
\r
3570 <p class=Verbatim><span style='font-size:9.5pt'>/*@only@*/ int *</span></p>
\r
3571 <p class=Verbatim><span style='font-size:9.5pt'>f (/*@only@*/ int *x, int *y,</span></p>
\r
3572 <p class=Verbatim><span style='font-size:9.5pt'> int *z)</span></p>
\r
3573 <p class=Verbatim><span style='font-size:9.5pt'> /*@globals glob;@*/</span></p>
\r
3574 <p class=Verbatim><span style='font-size:9.5pt'>{</span></p>
\r
3575 <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'> 8</span></i><span
\r
3576 style='font-size:9.5pt'> int *m = (int *)</span></p>
\r
3577 <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'> 9</span></i><span
\r
3578 style='font-size:9.5pt'> malloc (sizeof (int));</span></p>
\r
3579 <p class=Verbatim><span style='font-size:9.5pt'> </span></p>
\r
3580 <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>11</span></i><span
\r
3581 style='font-size:9.5pt'> glob = y; </span><i><span style='font-size:9.5pt;
\r
3582 font-family:"Times New Roman"'>Memory leak</span></i><span style='font-size:
\r
3583 9.5pt'> </span></p>
\r
3584 <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>12</span></i><span
\r
3585 style='font-size:9.5pt'> free (x);</span></p>
\r
3586 <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>13</span></i><span
\r
3587 style='font-size:9.5pt'> *m = *x; </span><i><span style='font-size:9.5pt;
\r
3588 font-family:"Times New Roman"'>Use after free</span></i><span
\r
3589 style='font-size:9.5pt'> </span></p>
\r
3590 <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>14</span></i><span
\r
3591 style='font-size:9.5pt'> return z; </span><i><span style='font-size:9.5pt;
\r
3592 font-family:"Times New Roman"'>Memory leak detected</span></i><i><span
\r
3593 style='font-size:9.5pt;font-family:Arial'> </span></i></p>
\r
3594 <p class=TextFontCX><span style='font-size:
\r
3595 9.5pt'>}</span></p>
\r
3597 <td valign=top style='width:225.0pt;border-top:none;border-left:
\r
3598 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
3599 padding:0in 5.4pt 0in 5.4pt'>
\r
3600 <p class=lclintrun>> splint only.c</p>
\r
3601 <p class=lclintrun>only.c:11: Only storage glob (type int *) not released</p>
\r
3602 <p class=lclintrun> before assignment: glob = y</p>
\r
3603 <p class=lclintrun> only.c:1: Storage glob becomes only</p>
\r
3604 <p class=lclintrun>only.c:11: Implicitly temp storage y assigned to only:</p>
\r
3605 <p class=lclintrun> glob = y</p>
\r
3606 <p class=lclintrun>only.c:13: Dereference of possibly null pointer m: *m</p>
\r
3607 <p class=lclintrun> only.c:8: Storage m may become null</p>
\r
3608 <p class=lclintrun>only.c:13: Variable x used after being released</p>
\r
3609 <p class=lclintrun> only.c:12: Storage x released</p>
\r
3610 <p class=lclintrun>only.c:14: Implicitly temp storage z returned as only: z</p>
\r
3611 <p class=lclintrun>only.c:14: Fresh storage m not released before return</p>
\r
3612 <p class=lclintrun style='page-break-after:avoid'> only.c:9: Fresh storage
\r
3618 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
3620 <td valign=top align=left style='padding-top:0in;padding-right:
\r
3621 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
3622 <p class=MsoCaption><a name="_Toc534824610">Figure 6. Memory Management</a></p>
\r
3627 <p class=TextFontCX>The parameter to <span
\r
3628 class=CodeText><span style='font-size:10.0pt'>free</span></span> must reference
\r
3629 an unshared object. Since the parameter is declared using <span class=Annot><span
\r
3630 style='font-size:10.0pt'>only</span></span>, the caller may not use the
\r
3631 referenced object after the call, and may not pass in a reference to a shared
\r
3632 object. There is nothing special about <span class=CodeText><span
\r
3633 style='font-size:10.0pt'>malloc</span></span> and <span class=CodeText><span
\r
3634 style='font-size:10.0pt'>free</span></span>
\97 their behavior can be described
\r
3635 entirely in terms of the provided annotations.</p>
\r
3637 <h3 style='margin-left:0in;text-indent:0in'><a name="_Ref347468963"></a><a
\r
3638 name="_Toc534974961"></a><a name="_Ref347469360">5.2.2<span style='font:7.0pt "Times New Roman"'>
\r
3639 </span>Temporary Parameters</a></h3>
\r
3641 <p class=TextFontCX>The <span class=Annot><span
\r
3642 style='font-size:10.0pt'>temp</span></span> annotation is used to declare a
\r
3643 function parameter that is used temporarily by the function. An error is
\r
3644 reported if the function releases the storage associated with a <span
\r
3645 class=Annot><span style='font-size:10.0pt'>temp</span></span> formal parameter
\r
3646 or creates new aliases to it that are visible after the function returns. Any
\r
3647 storage may be passed as a <span class=Annot><span style='font-size:10.0pt'>temp</span></span>
\r
3648 parameter, and it satisfies its original memory constraints after the function
\r
3651 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974962">5.2.3<span
\r
3652 style='font:7.0pt "Times New Roman"'>
\r
3653 </span>Owned and Dependent References</a></h3>
\r
3655 <p class=TextFontCX>In real programs it is
\r
3656 sometimes necessary to have storage that is shared between several possibly
\r
3657 references. The <span class=Annot><span style='font-size:10.0pt'>owned</span></span>
\r
3658 and <span class=Annot><span style='font-size:10.0pt'>dependent</span></span>
\r
3659 annotations provide a more flexible way of managing storage, at the cost of
\r
3660 less checking. The <span class=Annot><span style='font-size:10.0pt'>owned</span></span>
\r
3661 annotation denotes a reference with an obligation to release storage. Unlike <span
\r
3662 class=Annot><span style='font-size:10.0pt'>only</span></span>, however, other
\r
3663 external references marked with <span class=Annot><span style='font-size:10.0pt'>dependent</span></span>
\r
3664 annotations may share this object. It is up to the programmer to ensure that
\r
3665 the lifetime of a <span class=Annot><span style='font-size:10.0pt'>dependent</span></span>
\r
3666 reference is contained within the lifetime of the corresponding <span
\r
3667 class=Annot><span style='font-size:10.0pt'>owned</span></span> reference.</p>
\r
3669 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974963"></a><a
\r
3670 name="_Ref347805800">5.2.4<span style='font:7.0pt "Times New Roman"'>
\r
3671 </span>Keep Parameters</a></h3>
\r
3673 <p class=TextFontCX>The <span class=Annot><span
\r
3674 style='font-size:10.0pt'>keep</span></span> annotation is similar to <span
\r
3675 class=Annot><span style='font-size:10.0pt'>only</span></span>, except the
\r
3676 caller may use the reference after the call. The called function must assign
\r
3677 the <span class=Annot><span style='font-size:10.0pt'>keep</span></span>
\r
3678 parameter to an <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
3679 reference, or pass it as a <span class=Annot><span style='font-size:10.0pt'>keep</span></span>
\r
3680 parameter to another function. It is up to the programmer to make sure that
\r
3681 the calling function does not use this reference after it is released. The <span
\r
3682 class=Annot><span style='font-size:10.0pt'>keep</span></span> annotation is
\r
3683 useful for adding an object to a collection (e.g., a symbol table), where it is
\r
3684 known that it will not be deallocated until the collection is. </p>
\r
3686 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974964"></a><a
\r
3687 name="_Ref347469304">5.2.5<span style='font:7.0pt "Times New Roman"'>
\r
3688 </span>Shared References</a></h3>
\r
3690 <p class=TextFontCX>If Splint is used to check a
\r
3691 program designed to be used in a garbage-collected environment, there may be
\r
3692 storage that is shared by one or more references and never explicitly
\r
3693 released. The <span class=Annot><span style='font-size:10.0pt'>shared</span></span> annotation declares storage that may be shared arbitrarily, but never released.</p>
\r
3695 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974965"></a><a
\r
3696 name="_Ref348341639">5.2.6<span style='font:7.0pt "Times New Roman"'>
\r
3697 </span>Stack References</a></h3>
\r
3699 <p class=TextFontCX>Local variables that are not
\r
3700 allocated dynamically are stored on a call stack. When a function returns, its
\r
3701 stack frame is deallocated, destroying the storage associated with the
\r
3702 function
\92s local variables. A memory error occurs if a pointer into this
\r
3703 storage is live after the function returns. Splint detects errors involving stack
\r
3704 references exported from a function through return values or assignments to
\r
3705 references reachable from global variables or actual parameters. No
\r
3706 annotations are needed to detect stack reference errors, since it is clear from
\r
3707 a declaration if storage is allocated on the function stack. Figure 7 gives and example of errors reported involving stack-allocated storage.</p>
\r
3710 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
3711 style='margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt;
\r
3712 margin-right:-2.25pt'>
\r
3714 <td valign=top style='width:2.25in;border:solid black 1.5pt;
\r
3715 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
3716 <p class=TextFontCX align=center
\r
3717 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
3718 color:white'>stack.c</span></b></span></p>
\r
3720 <td valign=top style='width:256.5pt;border-top:solid black 1.5pt;
\r
3721 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
3722 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
3723 <p class=TextFontCX align=center
\r
3724 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
3728 <td valign=top style='width:2.25in;border:solid black 1.5pt;
\r
3729 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
3730 <p class=Verbatim>int *glob;</p>
\r
3731 <p class=Verbatim> </p>
\r
3732 <p class=Verbatim>/*@dependent@*/ int *</p>
\r
3733 <p class=Verbatim> f (int **x)</p>
\r
3734 <p class=Verbatim>{</p>
\r
3735 <p class=Verbatim> int sa[2] = { 0, 1 };</p>
\r
3736 <p class=Verbatim> int loc = 3;</p>
\r
3737 <p class=Verbatim> </p>
\r
3738 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 9</span></span>
\r
3739 glob = &loc;</p>
\r
3740 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10</span></span>
\r
3741 *x = &sa[0];</p>
\r
3742 <p class=Verbatim> </p>
\r
3743 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>12</span></span>
\r
3744 return &loc;</p>
\r
3745 <p class=Verbatim>} </p>
\r
3747 <td valign=top style='width:256.5pt;border-top:none;border-left:
\r
3748 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
3749 padding:0in 5.4pt 0in 5.4pt'>
\r
3750 <p class=lclintrun>> splint stack.c</p>
\r
3751 <p class=lclintrun>stack.c:12: Stack-allocated storage &loc reachable</p>
\r
3752 <p class=lclintrun> from return value: &loc</p>
\r
3753 <p class=lclintrun>stack.c:12: Stack-allocated storage *x reachable from</p>
\r
3754 <p class=lclintrun> parameter x</p>
\r
3755 <p class=lclintrun> stack.c:10: Storage *x becomes stack</p>
\r
3756 <p class=lclintrun>stack.c:12: Stack-allocated storage glob reachable</p>
\r
3757 <p class=lclintrun> from global glob</p>
\r
3758 <p class=lclintrun> stack.c:9: Storage glob becomes stack</p>
\r
3759 <p class=lclintrun> </p>
\r
3760 <p class=TextFontCX align=left
\r
3761 style='text-align:left;page-break-after:avoid'><i>A </i><span class=Annot><span
\r
3762 style='font-size:10.0pt'>dependent</span></span><i> annotation is used on the
\r
3763 return value. Without this, other warnings would be reported, since the
\r
3764 result would have an implicit </i><span class=Annot><span style='font-size:
\r
3765 10.0pt'>only</span></span><i> annotation.</i></p>
\r
3770 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
3772 <td valign=top style='padding-top:5.05pt;padding-right:
\r
3773 9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>
\r
3774 <p class=MsoCaption><a name="_Toc534824611"></a><a name="_Ref534821941">Figure
\r
3775 7</a>. Stack-Allocated Storage</p>
\r
3782 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974966">5.2.7<span
\r
3783 style='font:7.0pt "Times New Roman"'>
\r
3784 </span>Inner Storage</a></h3>
\r
3786 <p class=TextFontCX>An annotation always applies
\r
3787 to the outermost level of storage. For example,</p>
\r
3789 <p class=example>/*@only@*/ int **x;</p>
\r
3791 <p class=beforelist>declares <span class=CodeText><span style='font-size:10.0pt'>x</span></span>
\r
3792 as an unshared pointer to a pointer to an <span class=CodeText><span
\r
3793 style='font-size:10.0pt'>int</span></span>. The <span class=Flag><span
\r
3794 style='font-size:10.0pt'>only</span></span> annotation applies to <span
\r
3795 class=CodeText><span style='font-size:10.0pt'>x</span></span>, but not to <span
\r
3796 class=CodeText><span style='font-size:10.0pt'>*x</span></span>. To apply
\r
3797 annotations to inner storage a type definition may be used:</p>
\r
3799 <p class=Verbatim> typedef /*@only@*/ int *oip;</p>
\r
3801 <p class=Verbatim> /*@only@*/ oip *x;</p>
\r
3803 <p class=afterlist>Now, x is an <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
3804 pointer to an <span class=Annot><span style='font-size:10.0pt'>oip</span></span>,
\r
3805 which is an <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
3806 pointer to an <span class=Annot><span style='font-size:10.0pt'>int</span></span>.</p>
\r
3808 <p class=afterlist>When annotations are used in type definitions, they may be
\r
3809 overridden in instance declarations. For example,</p>
\r
3811 <p class=example>/*@dependent@*/ oip x;</p>
\r
3813 <p class=TextFontCX>makes <span class=CodeText><span
\r
3814 style='font-size:10.0pt'>x</span></span> a <span class=Annot><span
\r
3815 style='font-size:10.0pt'>dependent</span></span> pointer to an <span
\r
3816 class=CodeText><span style='font-size:10.0pt'>int</span></span>. Another way
\r
3817 to apply annotations to inner storage is to use a state clause (see Section 7.4).</p>
\r
3819 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974967"></a><a
\r
3820 name="_Ref347812243"></a><a name="_Ref344893978"></a><a name="_Toc344355410">5.3<span
\r
3821 style='font:7.0pt "Times New Roman"'>
\r
3822 </span>Implicit Memory Annotations</a></h2>
\r
3824 <p class=TextFontCX>Since it is important that
\r
3825 Splint can check unannotated programs effectively, the meaning of declarations
\r
3826 with no memory annotations is chosen to minimize the number of annotations
\r
3827 needed to get useful checking on an unannotated program. </p>
\r
3829 <p class=TextFontCX> </p>
\r
3831 <p class=TextFontCX>An implicit memory management
\r
3832 annotation may be assumed for declarations with no explicit memory management
\r
3833 annotation. Implicit annotations are checked identically to the corresponding
\r
3834 explicit annotation, except error messages indicate that they result from an
\r
3835 implicit annotation. Figure 8 illustrates some implicit annotations.</p>
\r
3837 <p class=TextFontCX> </p>
\r
3839 <p class=TextFontCX>Unannotated function
\r
3840 parameters are assumed to be <span class=Annot><span style='font-size:10.0pt'>temp</span></span>.
\r
3841 This means if memory checking is turned on for an unannotated program, all
\r
3842 functions that release storage referenced by a parameter or assign a global
\r
3843 variable to alias the storage will produce error messages. (Controlled by <span
\r
3844 class=Flag><span style='font-size:10.0pt'>paramimptemp</span></span>.)</p>
\r
3846 <p class=TextFontCX> </p>
\r
3849 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='width:423.0pt;margin-left:.9pt;border-collapse:collapse;
\r
3850 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
3851 <tr style='page-break-inside:avoid'>
\r
3852 <td colspan=2 valign=top style='width:423.0pt;border:solid black 1.5pt;
\r
3853 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
3854 <p class=TextFontCX align=center
\r
3855 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
3856 color:white'>implicit.c</span></b></span></p>
\r
3860 <td valign=top style='width:207.0pt;border-top:none;border-left:
\r
3861 solid black 1.5pt;border-bottom:solid black 1.5pt;border-right:none;
\r
3862 padding:0in 5.4pt 0in 5.4pt'>
\r
3863 <p class=Verbatim>typedef struct {</p>
\r
3864 <p class=Verbatim> <span class=implicit><b>only</b></span> char *name;</p>
\r
3865 <p class=Verbatim> int val;</p>
\r
3866 <p class=Verbatim>} *rec;</p>
\r
3867 <p class=Verbatim> </p>
\r
3868 <p class=Verbatim>extern <span class=implicit><b>only</b></span> rec rec_last
\r
3870 <p class=Verbatim> </p>
\r
3871 <p class=Verbatim>extern <span class=implicit><b>only</b></span> rec </p>
\r
3872 <p class=Verbatim> rec_create (<span class=implicit><b>temp</b></span> char
\r
3874 <p class=Verbatim> int val) ;</p>
\r
3875 <p class=TextFontCX><i>Annotations in </i><span
\r
3876 class=Keyword><b><i><span style='font-size:10.0pt;color:windowtext'>italics</span></i></b></span><i>
\r
3877 are not present in the code, but may be implied depending on flag settings.</i></p>
\r
3879 <td valign=top style='width:3.0in;border-top:none;border-left:none;
\r
3880 border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
3881 <p class=TextFontCX> </p>
\r
3882 <p class=TextFontCX align=left
\r
3883 style='text-align:left'><i>Implicit </i><span class=Annot><i><span
\r
3884 style='font-size:10.0pt'>only</span></i></span><i> annotation on mutable
\r
3885 structure field if </i><span class=Flag><span style='font-size:10.0pt'>structimponly</span></span><i>
\r
3886 </i><i>is on.</i></p>
\r
3887 <p class=lclintrun><i> </i></p>
\r
3888 <p class=TextFontCX align=left
\r
3889 style='text-align:left'><i>Implicit </i><span class=Annot><span
\r
3890 style='font-size:10.0pt'>only</span></span><i> annotation on mutable global
\r
3891 variables if </i><span class=Flag><span style='font-size:10.0pt'>globimponly</span></span><i>
\r
3892 </i><i>is on.</i></p>
\r
3893 <p class=TextFontCX align=left
\r
3894 style='text-align:left'><i> </i></p>
\r
3895 <p class=TextFontCX align=left
\r
3896 style='text-align:left;page-break-after:avoid'><i>Implicit </i><span
\r
3897 class=Annot><span style='font-size:10.0pt'>only</span></span><i> annotation
\r
3898 on mutable function result if </i><span class=Flag><span style='font-size:
\r
3899 10.0pt'>retimponly</span></span><i> </i><i>is set. Implicit </i><span
\r
3900 class=Annot><span style='font-size:10.0pt'>temp</span></span><i> annotation
\r
3901 on mutable parameter if </i><span class=Flag><span style='font-size:10.0pt'>paramimptemp</span></span><i>
\r
3902 </i><i>is set.</i></p>
\r
3907 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
3909 <td valign=top align=left style='padding-top:.1in;padding-right:
\r
3910 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
\r
3911 <p class=MsoCaption><a name="_Toc534824612"></a><a name="_Ref534822006">Figure
\r
3912 8</a>. Implicit Annotations</p>
\r
3919 <p class=TextFontCX>Unannotated return values,
\r
3920 structure fields and global variables are assumed to be <span class=Annot><span
\r
3921 style='font-size:10.0pt'>only</span></span>. With implicit annotations (on by
\r
3922 default), turning on memory checking for an unannotated program will produce
\r
3923 errors for any function that does not return unshared storage or assignment of shared
\r
3924 storage to a global variable or structure field. If an exposure qualifier is
\r
3925 used (see Section 6.2), the implied <span class=Annot><span style='font-size:
\r
3926 10.0pt'>dependent</span></span> annotation is used instead of the more
\r
3927 generally implied <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
3928 annotation. (Controlled by <span class=Flag><span style='font-size:10.0pt'>retimponly</span></span>, <span
\r
3929 class=Flag><span style='font-size:10.0pt'>structimponly</span></span> and <span class=Flag><span style='font-size:10.0pt'>globimponly</span></span>. The <span
\r
3930 class=Flag><span style='font-size:10.0pt'>allimponly</span></span> flag sets all of the implicit only flags.) </p>
\r
3932 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974968"></a><a
\r
3933 name="_Ref534970957"></a><a name="_Ref347469058"></a><a name="_Ref344907383"></a><a
\r
3934 name="_Toc344355411">5.4<span style='font:7.0pt "Times New Roman"'>
\r
3935 </span>Reference Counting</a></h2>
\r
3937 <p class=TextFontCX>Another approach to memory
\r
3938 management is to add a field to a type to explicitly keep track of the number
\r
3939 of references to that storage. Every time a reference is added or lost the
\r
3940 reference count is adjusted accordingly; if it would become zero, the storage
\r
3941 is released. Reference counting it difficult to do without automatic checking
\r
3942 since it is easy to forget to increment or decrement the reference count, and
\r
3943 exceedingly difficult to track down these errors.</p>
\r
3945 <p class=TextFontCX> </p>
\r
3947 <p class=TextFontCX>Splint supports reference
\r
3948 counting by using annotations to constrain the use of reference counted storage
\r
3949 in a manner similar to other memory management annotations.</p>
\r
3951 <p class=TextFontCX> </p>
\r
3953 <p class=TextFontCX>A reference counted type is
\r
3954 declared using the <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span> annotation. Only pointer to <span class=CodeText><span style='font-size:10.0pt'>struct</span></span>
\r
3955 types may be declared as <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>,
\r
3956 since reference counted storage must have a field to count the references. One
\r
3957 field in the structure (or integral type) is preceded by the <span class=Annot><span
\r
3958 style='font-size:10.0pt'>refs</span></span> annotation to indicate that the
\r
3959 value of this field is the number of live references to the structure. For
\r
3960 example (in <span class=Keyword><span style='font-size:10.0pt;font-family:Arial;
\r
3961 color:windowtext'>rstring.h</span></span>),</p>
\r
3963 <p class=Verbatim style='margin-top:6.0pt'> typedef /*@abstract@*/ /*@refcounted@*/ struct {</p>
\r
3965 <p class=Verbatim> /*@refs@*/ int refs;</p>
\r
3967 <p class=Verbatim> char *contents;</p>
\r
3969 <p class=Verbatim> } *rstring;</p>
\r
3971 <p class=afterlist>declares <span class=CodeText><span style='font-size:10.0pt'>rstring</span></span>
\r
3972 as an abstract, reference-counted type. The <span class=CodeText><span
\r
3973 style='font-size:10.0pt'>refs</span></span> field counts the number of
\r
3974 references and the <span class=CodeText><span style='font-size:10.0pt'>contents</span></span>
\r
3975 field holds the contents of a string.</p>
\r
3977 <p class=TextFontCX> </p>
\r
3980 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='width:425.5pt;margin-left:.2in;border-collapse:collapse'>
\r
3982 <td valign=top style='width:267.05pt;border:solid black 1.5pt;
\r
3983 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
3984 <p class=TextFontCX align=center
\r
3985 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
3986 color:white'>rstring.c</span></b></span></p>
\r
3988 <td valign=top style='width:158.45pt;border-top:solid black 1.5pt;
\r
3989 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
3990 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
3991 <p class=TextFontCX align=center
\r
3992 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
3996 <td valign=top style='width:267.05pt;border:solid black 1.5pt;
\r
3997 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
3998 <p class=Verbatim><span style='font-size:9.0pt'># include
\r
3999 "rstring.h"</span></p>
\r
4000 <p class=Verbatim><span style='font-size:9.0pt'> </span></p>
\r
4001 <p class=Verbatim><span style='font-size:9.0pt'>static rstring rstring_ref
\r
4002 (rstring r)</span></p>
\r
4003 <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>
\r
4004 <p class=Verbatim><span style='font-size:9.0pt'> r->refs++;</span></p>
\r
4005 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>6</span></span><span
\r
4006 style='font-size:9.0pt'> return r;</span></p>
\r
4007 <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>
\r
4008 <p class=Verbatim><span style='font-size:9.0pt'> </span></p>
\r
4009 <p class=Verbatim><span style='font-size:9.0pt'>rstring rstring_first
\r
4010 (rstring r1, rstring r2)</span></p>
\r
4011 <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>
\r
4012 <p class=Verbatim><span style='font-size:9.0pt'> if (strcmp
\r
4013 (r1->contents, r2->contents) < 0)</span></p>
\r
4014 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>12</span></span><span
\r
4015 style='font-size:9.0pt'> return r1;</span></p>
\r
4016 <p class=Verbatim><span style='font-size:9.0pt'> else</span></p>
\r
4017 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>14</span></span><span
\r
4018 style='font-size:9.0pt'> return rstring_ref (r2);</span></p>
\r
4019 <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>
\r
4021 <td valign=top style='width:158.45pt;border-top:none;border-left:
\r
4022 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
4023 padding:0in 5.4pt 0in 5.4pt'>
\r
4024 <p class=lclintrun>> splint rstring.c</p>
\r
4025 <p class=lclintrun>rstring.c:12: Reference counted </p>
\r
4026 <p class=lclintrun> storage returned without modifying</p>
\r
4027 <p class=lclintrun> reference count: r1</p>
\r
4028 <p class=lclintrun><i> </i></p>
\r
4029 <p class=TextFontCX align=left
\r
4030 style='text-align:left'><i><span style='font-size:10.0pt'>No error is
\r
4031 reported for line 6 since the reference count was incremented. No error is
\r
4032 reported for line 14, since </span></i><span class=CodeText><i><span
\r
4033 style='font-size:10.0pt'>rstring_ref</span></i></span><i><span
\r
4034 style='font-size:10.0pt'> returns a new reference.</span></i></p>
\r
4035 <p class=TextFontCX align=left
\r
4036 style='text-align:left;page-break-after:avoid'><span style='font-size:10.0pt'> </span></p>
\r
4041 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 align=center>
\r
4043 <td valign=top align=left style='padding-top:.1in;padding-right:
\r
4044 0in;padding-bottom:.1in;padding-left:0in'>
\r
4045 <p class=MsoCaption><a name="_Toc534824613"></a><a name="_Ref534822069">Figure
\r
4046 9</a>. Reference Counting</p>
\r
4055 <p class=TextFontCX>All functions that return <span
\r
4056 class=Annot><span style='font-size:10.0pt'>refcounted</span></span> storage
\r
4057 must increase the reference count before returning. Splint cannot determine if
\r
4058 the reference count was increased, so any function that directly returns a
\r
4059 reference to <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>
\r
4060 storage will produce an error. This is avoided, by using a function to return
\r
4061 a new reference (e.g., <span class=CodeText><span style='font-size:10.0pt'>rstring_ref</span></span>
\r
4064 <p class=TextFontCX> </p>
\r
4066 <p class=TextFontCX>A reference counted type may
\r
4067 be passed as a <span class=Annot><span style='font-size:10.0pt'>temp</span></span>
\r
4068 or <span class=Annot><span style='font-size:10.0pt'>dependent</span></span>
\r
4069 parameter. It may not be passed as an <span class=Annot><span
\r
4070 style='font-size:10.0pt'>only</span></span> parameter. Instead, the <span
\r
4071 class=Annot><span style='font-size:10.0pt'>killref</span></span> annotation is
\r
4072 used to denote a parameter whose reference is eliminated by the function call.
\r
4073 Like <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
4074 parameters, an actual parameter corresponding to a <span class=Annot><span
\r
4075 style='font-size:10.0pt'>killref</span></span> formal parameter may not be used
\r
4076 in the calling function after the call. Splint checks that the implementation
\r
4077 of a function releases all <span class=Annot><span style='font-size:10.0pt'>killref</span></span>
\r
4078 parameters, either by passing them as <span class=Annot><span style='font-size:
\r
4079 10.0pt'>killref</span></span> parameters, or assigning or returning them
\r
4080 without increasing the reference count.</p>
\r
4082 <h1 style='margin-left:0in;text-indent:0in'><a name="_Ref348845247"></a><a
\r
4083 name="_Ref348796245"></a><a name="_Toc344355413"></a><a name="_Ref344355210"></a><a
\r
4084 name="_Ref343064238"></a><a name="_Ref343064188"></a><a name="_Toc534974969"></a><a
\r
4085 name="_Ref534642796"></a><a name="_Ref534642146">6<span style='font:7.0pt "Times New Roman"'>
\r
4086 </span>Sharing</a></h1>
\r
4088 <p class=TextFontCX>Errors involving unexpected sharing of storage can cause serious problems. Undocumented sharing may lead to unpredictable modifications, and some library calls (e.g., <span
\r
4089 class=CodeText><span style='font-size:10.0pt'>strcpy</span></span>) have
\r
4090 undefined behavior if parameters share storage. Another class of sharing
\r
4091 errors occurs when clients of an abstract type may obtain a reference to
\r
4092 mutable storage that is part of the abstract representation. This exposes the
\r
4093 representation of the abstract type, since clients may modify an instance of the abstract type indirectly through this shared storage.</p>
\r
4095 <h2 style='margin-left:0in;text-indent:0in'><a name="_Ref534977801"></a><a
\r
4096 name="_Toc534974970">6.1<span style='font:7.0pt "Times New Roman"'>
\r
4097 </span>Aliasing</a></h2>
\r
4099 <p class=TextFontCX>Splint detects errors
\r
4100 involving dangerous aliasing of parameters. Some of these errors are already
\r
4101 detected through the standard memory annotations (e.g., <span class=Annot><span
\r
4102 style='font-size:10.0pt'>only</span></span> parameters may not be aliases.) Two additional annotations are provided for constraining aliasing of parameters and return values.</p>
\r
4104 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974971"></a><a
\r
4105 name="_Ref347469444">6.1.1<span style='font:7.0pt "Times New Roman"'>
\r
4106 </span>Unique Parameters</a></h3>
\r
4108 <p class=TextFontCX>The <span class=Annot><span
\r
4109 style='font-size:10.0pt'>unique</span></span> annotation denotes a parameter that may not be aliased by any other storage reachable from the function implementation
\97 that is, any storage reachable through the other parameters
\r
4110 or global variables used by the function. The <span class=Annot><span
\r
4111 style='font-size:10.0pt'>unique</span></span> annotation places similar
\r
4112 constraints on function parameters as the <span class=Annot><span
\r
4113 style='font-size:10.0pt'>only</span></span> annotation, but it does not transfer
\r
4114 the obligation to release storage. Splint will report an error if a <span
\r
4115 class=Annot><span style='font-size:10.0pt'>unique</span></span> parameter may
\r
4116 be aliased by another parameter or global variable.</p>
\r
4118 <p class=TextFontCX> </p>
\r
4120 <p class=TextFontCX>Splint reports an error if a
\r
4121 function returns a reference to storage reachable from one of its parameters
\r
4122 (if <span class=Flag><span style='font-size:10.0pt'>retalias</span></span> is on) since this may introduce unexpected aliases in the body of the calling
\r
4123 function when the result is assigned.</p>
\r
4125 <p class=TextFontCX> </p>
\r
4127 <p class=TextFontCX>Figure 10 illustrated sharing checks. An error is reported since the first parameter to the library function <span
\r
4128 class=CodeText><span style='font-size:10.0pt'>strcpy</span></span> is declared
\r
4129 with unique. If a <span class=CodeText><span style='font-size:10.0pt'>unique</span></span>
\r
4130 qualifier were added to the parameter declaration for <span class=CodeText><span
\r
4131 style='font-size:10.0pt'>s</span></span> or <span class=CodeText><span
\r
4132 style='font-size:10.0pt'>t</span></span>, no error would be reported. </p>
\r
4135 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
4136 style='margin-left:5.4pt;border-collapse:collapse;
\r
4137 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
4139 <td valign=top style='border:solid black 1.5pt;
\r
4140 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
4141 <p class=TextFontCX align=center
\r
4142 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
4143 color:white'>unique.c</span></b></span></p>
\r
4145 <td valign=top style='border-top:solid black 1.5pt;
\r
4146 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
4147 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
4148 <p class=TextFontCX align=center
\r
4149 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
4153 <td valign=top style='border:solid black 1.5pt;
\r
4154 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
4155 <p class=Verbatim># include <string.h></p>
\r
4156 <p class=Verbatim> </p>
\r
4157 <p class=Verbatim>void </p>
\r
4158 <p class=Verbatim>capitalize (/*@out@*/ char *s,</p>
\r
4159 <p class=Verbatim> char *t)</p>
\r
4160 <p class=Verbatim>{</p>
\r
4161 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 7</span></span>
\r
4162 strcpy (s, t);</p>
\r
4163 <p class=Verbatim> *s = toupper (*s);</p>
\r
4164 <p class=Verbatim>}</p>
\r
4166 <td valign=top style='border-top:none;border-left:
\r
4167 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
4168 padding:0in 5.4pt 0in 5.4pt'>
\r
4169 <p class=lclintrun>> splint unique.c</p>
\r
4170 <p class=lclintrun> </p>
\r
4171 <p class=lclintrun>unique.c: (in function capitalize)</p>
\r
4172 <p class=lclintrun>unique.c:7: Parameter 1 (s) to function strcpy is</p>
\r
4173 <p class=lclintrun> declared unique but may be aliased externally by</p>
\r
4174 <p class=lclintrun> parameter 2 (t)</p>
\r
4175 <p class=lclintrun> </p>
\r
4180 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
4182 <td valign=top align=left style='padding-top:6.5pt;padding-right:
\r
4183 9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>
\r
4184 <p class=MsoCaption><a name="_Toc534824614"></a><a name="_Ref534822167">Figure
\r
4185 10</a>. Unique parameters</p>
\r
4192 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974972"></a><a
\r
4193 name="_Ref347469448">6.1.2<span style='font:7.0pt "Times New Roman"'>
\r
4194 </span>Returned Parameters</a></h3>
\r
4196 <p class=TextFontCX>The <span class=Annot><span
\r
4197 style='font-size:10.0pt'>returned</span></span> annotation denotes a parameter that may be aliased by the return value. Splint
\r
4198 checks the call assuming the result may be an alias to the <span class=Annot><span
\r
4199 style='font-size:10.0pt'>returned</span></span> parameter.</p>
\r
4201 <p class=TextFontCX> </p>
\r
4203 <p class=TextFontCX>Consider the following code
\r
4206 <p class=TextFontCX> </p>
\r
4208 <p class=Verbatim>extern intSet intSet_insert (/*@returned@*/ intSet s, int x);</p>
\r
4210 <p class=Verbatim> </p>
\r
4212 <p class=Verbatim>intSet intSet_singleton (int x)</p>
\r
4214 <p class=Verbatim>{</p>
\r
4216 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>7</span></span>
\r
4217 return (intSet_insert (intSet_new (), x));</p>
\r
4219 <p class=TextFontCX>}</p>
\r
4221 <p class=TextFontCX> </p>
\r
4223 <p class=TextFontCX>Without the <span
\r
4224 class=Annot><span style='font-size:10.0pt'>returned</span></span> qualifier on
\r
4225 the parameter to <span class=CodeText><span style='font-size:10.0pt'>intSet_insert</span></span>,
\r
4226 a memory leak error would be reported for line 7, since the <span class=Annot><span
\r
4227 style='font-size:10.0pt'>only</span></span><span style='font-size:10.0pt'> </span>storage
\r
4228 returned by <span class=CodeText><span style='font-size:10.0pt'>intSet_new</span></span>
\r
4229 is not released. Because of the <span class=Annot><span style='font-size:10.0pt'>returned</span></span>
\r
4230 qualifier, Splint assumes the result of <span class=CodeText><span
\r
4231 style='font-size:10.0pt'>intSet_insert</span></span> is the same storage as its
\r
4232 first parameter, in this case the storage returned by <span class=CodeText><span
\r
4233 style='font-size:10.0pt'>intSet_new</span></span>. No error is reported, since
\r
4234 the only storage is then transferred through the return value (which has an
\r
4235 implicit only annotation, see Section 5.3).</p>
\r
4237 <h2 style='margin-left:0in;text-indent:0in'><a name="_Ref344907981"></a><a
\r
4238 name="_Ref344894258"></a><a name="_Ref344809320"></a><a name="_Toc344355414"></a><a
\r
4239 name="_Toc534974973"></a><a name="_Ref345591408"></a><a name="_Ref345591053">6.2<span
\r
4240 style='font:7.0pt "Times New Roman"'>
\r
4241 </span>Exposure</a></h2>
\r
4243 <p class=TextFontCX>Splint detects places where
\r
4244 the representation of an abstract type is exposed. This occurs if a client has
\r
4245 a pointer to storage that is part of the representation of an instance of the
\r
4246 abstract type. The client can then modify or examine the storage this points
\r
4247 to, and manipulate the value of the abstract type instance without using its
\r
4250 <p class=TextFontCX> </p>
\r
4252 <p class=TextFontCX>There are three ways a
\r
4253 representation may be exposed:</p>
\r
4255 <p class=TextFontCX style='margin-left:.25in;
\r
4256 text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'>
\r
4257 </span>Returning (or assigning to a global variable) an object that includes a
\r
4258 pointer to a mutable component of an abstract type representation. (Controlled by <span class=Flag><span style='font-size:10.0pt'>ret-expose</span></span>).</p>
\r
4260 <p class=TextFontCX style='margin-left:.25in;
\r
4261 text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'>
\r
4262 </span>Assigning a mutable component of an abstract object to storage reachable
\r
4263 from an actual parameter or a global variable that may be used after the call. This means the client may manipulate the abstract object using the actual
\r
4264 parameter after the call. Note that if the corresponding formal parameter is
\r
4265 declared <span class=Annot><span style='font-size:10.0pt'>only</span></span>,
\r
4266 the caller may not use the actual parameter after the call so the
\r
4267 representation is not exposed. (Controlled by <span class=Flag><span
\r
4268 style='font-size:10.0pt'>assign-expose</span></span>).</p>
\r
4270 <p class=TextFontCX style='margin-left:.25in;
\r
4271 text-indent:-.25in'>3.<span style='font:7.0pt "Times New Roman"'>
\r
4272 </span>Casting mutable storage to or from an abstract type. (Controlled by <span class=Flag><span style='font-size:10.0pt'>cast-expose</span></span>).</p>
\r
4274 <p class=afterlist>Annotations may be used to allow exposed storage to be
\r
4275 returned safely by restricting how the caller may use the returned storage.</p>
\r
4277 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974974"></a><a
\r
4278 name="_Ref347469553">6.2.1<span style='font:7.0pt "Times New Roman"'>
\r
4279 </span>Read-Only Storage</a></h3>
\r
4281 <p class=beforelist>It is often useful for a function to return a pointer to
\r
4282 internal storage (or an instance of a mutable abstract type) that is intended
\r
4283 only as an <i>observer</i>. The caller may use the result, but should not
\r
4284 modify the storage it points to. For example, consider a naïve implementation
\r
4285 of the <span class=CodeText><span style='font-size:10.0pt'>employee_getName</span></span>
\r
4286 operation for the abstract <span class=CodeText><span style='font-size:10.0pt'>employee</span></span>
\r
4289 <p class=Verbatim> typedef /*@abstract@*/ struct {</p>
\r
4291 <p class=Verbatim> char *name;</p>
\r
4293 <p class=Verbatim> int id;</p>
\r
4295 <p class=Verbatim> } *employee;</p>
\r
4297 <p class=Verbatim>
\85</p>
\r
4299 <p class=Verbatim> char *employee_getName (employee e) { return e->name; }</p>
\r
4301 <p class=afterlist>Splint produces a message to indicate that the return value
\r
4302 exposes the representation. One solution would be to return a fresh copy of <span
\r
4303 class=CodeText><span style='font-size:10.0pt'>e->name</span></span>. This
\r
4304 is expensive, though, especially if we expect <span class=CodeText><span
\r
4305 style='font-size:10.0pt'>employee_getName</span></span> is used mainly just to
\r
4306 get a string for searching or printing. Instead, we could change the
\r
4307 declaration of <span class=CodeText><span style='font-size:10.0pt'>employee_getName</span></span>
\r
4310 <p class=example>extern /*@observer@*/ char *employee_getName (employee e);</p>
\r
4312 <p class=TextFontCX>Now, the original
\r
4313 implementation is correct. The declaration indicates that the caller may not
\r
4314 modify the result, so it is acceptable to return shared storage. (The program
\r
4315 must also not use the returned observer storage after any other calls to the
\r
4316 abstract type module using the same parameter. Splint does not attempt to
\r
4317 check this, and in practice it is rarely a problem.) Splint checks that the
\r
4318 caller does not modify the return value. An error is reported if observer
\r
4319 storage is modified directly, passed as a function parameter that may be
\r
4320 modified, assigned to a global variable or reference derivable from a global
\r
4321 variable that is not declared with an <span class=Annot><span style='font-size:
\r
4322 10.0pt'>observer</span></span> annotation , or returned as a function result or
\r
4323 a reference derivable from the function result that is not annotation with an <span
\r
4324 class=Annot><span style='font-size:10.0pt'>observer</span></span> annotation.</p>
\r
4326 <h4 style='margin-left:0in;text-indent:0in'><a name="_Ref347469563"></a><a
\r
4327 name="_Ref348017065">String Literals</a></h4>
\r
4329 <p class=TextFontCX>A program that attempts to modify a string literal has undefined behavior [ISO, 6.4.5]. This is not enforced by most C compilers, and can lead to particularly
\r
4330 pernicious bugs that only appear when optimizations are turned on and the
\r
4331 compiler attempts to minimize storage for string literals. Splint can be used
\r
4332 to check that string literals are not modified, by treating them as -<span
\r
4333 class=Annot><span style='font-size:10.0pt'>observer</span></span> storage. If <span class=Flag><span style='font-size:10.0pt'>+read-only-strings</span></span>
\r
4334 is set (default in standard mode), Splint will report an error if a string
\r
4335 literal is modified. </p>
\r
4337 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974975">6.2.2<span
\r
4338 style='font:7.0pt "Times New Roman"'>
\r
4339 </span>Exposed Storage</a></h3>
\r
4341 <p class=TextFontCX>Sometimes it is necessary to
\r
4342 expose the representation of an abstract type. This may be evidence of a
\r
4343 design flaw, but in some cases is justified for efficiency reasons. The <span
\r
4344 class=Annot><span style='font-size:10.0pt'>exposed</span></span> annotation denotes storage that is exposed. It may be used on a return value for results that
\r
4345 reference storage internal to an abstract representation, on a parameter value
\r
4346 to indicate a parameter that may be assigned directly to part of an abstract
\r
4347 representation (note that if the parameter is annotated with <span class=Annot><span
\r
4348 style='font-size:10.0pt'>only</span></span>, it is not an error to assign it to
\r
4349 part of an abstract representation, since the caller may not use the storage
\r
4350 after the call returns), or on a field of an abstract representation to
\r
4351 indicate that external references to the storage may exist. <a
\r
4352 name="_Toc344355415"></a><a name="_Ref343064165"></a><a name="_Ref347254440"></a><a
\r
4353 name="_Ref347169365">An error is reported if </a><span class=Annot><span
\r
4354 style='font-size:10.0pt'>exposed</span></span> storage is released, but unlike
\r
4355 an <span class=Annot><span style='font-size:10.0pt'>observer</span></span>, no
\r
4356 error is reported if it is modified. Figure 11 shows examples of exposure problems detected by Splint.</p>
\r
4358 <p class=TextFontCX> </p>
\r
4361 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:6.75pt;border-collapse:collapse;
\r
4362 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
4364 <td width="45%" valign=top style='border:solid black 1.5pt;
\r
4365 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
4366 <p class=TextFontCX align=center
\r
4367 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
4368 color:white'>exposure.c</span></b></span></p>
\r
4370 <td valign=top style='border-top:solid black 1.5pt;
\r
4371 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
4372 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
4373 <p class=TextFontCX align=center
\r
4374 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
4378 <td valign=top style='border:solid black 1.5pt;
\r
4379 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
4380 <p class=Verbatim># include "employee.h"</p>
\r
4381 <p class=Verbatim> </p>
\r
4382 <p class=Verbatim>char *</p>
\r
4383 <p class=Verbatim>employee_getName (employee e) </p>
\r
4384 <p class=Verbatim>{ </p>
\r
4385 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>6</span></span>
\r
4386 return e->name; </p>
\r
4387 <p class=Verbatim>}</p>
\r
4388 <p class=Verbatim> </p>
\r
4389 <p class=Verbatim>/*@observer@*/ char *</p>
\r
4390 <p class=Verbatim>employee_obsName (employee e) </p>
\r
4391 <p class=Verbatim>{ return e->name; }</p>
\r
4392 <p class=Verbatim> </p>
\r
4393 <p class=Verbatim>/*@exposed@*/ char *</p>
\r
4394 <p class=Verbatim>employee_exposeName (employee e)</p>
\r
4395 <p class=Verbatim>{ return e->name; }</p>
\r
4396 <p class=Verbatim> </p>
\r
4397 <p class=Verbatim>void </p>
\r
4398 <p class=Verbatim>employee_capName (employee e)</p>
\r
4399 <p class=Verbatim>{</p>
\r
4400 <p class=Verbatim> char *name;</p>
\r
4401 <p class=Verbatim> </p>
\r
4402 <p class=Verbatim> name = employee_obsName (e);</p>
\r
4403 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>23 </span></span>*name
\r
4404 = toupper (*name);</p>
\r
4405 <p class=Verbatim>}</p>
\r
4407 <td valign=top style='border-top:none;border-left:none;
\r
4408 border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
4409 <p class=lclintrun>> splint exposure.c +checks</p>
\r
4410 <p class=lclintrun> </p>
\r
4411 <p class=lclintrun>exposure.c:6: Function returns reference to</p>
\r
4412 <p class=lclintrun> parameter e: e->name</p>
\r
4413 <p class=lclintrun>exposure.c:6: Return value exposes rep of</p>
\r
4414 <p class=lclintrun> employee: e->name</p>
\r
4415 <p class=lclintrun>exposure.c:6: Released storage e->name reachable</p>
\r
4416 <p class=lclintrun> from parameter at return point</p>
\r
4417 <p class=lclintrun> exposure.c:6: Storage e->name is released</p>
\r
4418 <p class=lclintrun>exposure.c:23: Suspect modification of observer</p>
\r
4419 <p class=lclintrun> name: *name = toupper(*name)</p>
\r
4420 <p class=TextFontCX style='page-break-after:
\r
4422 <p class=TextFontCX align=left
\r
4423 style='text-align:left;page-break-after:avoid'><i><span style='font-size:
\r
4424 10.0pt'>Three messages are reported for line 6 where a mutable field of an
\r
4425 abstract type is returned with no sharing qualifier (without </span></i><span
\r
4426 class=Flag><span style='font-size:10.0pt'>+checks</span></span><i><span
\r
4427 style='font-size:10.0pt'> only the third one would be reported.) The error
\r
4428 for line 23 reports a modification of an observer. If the call in line 22
\r
4429 were changed to call </span></i><span class=CodeText><span style='font-size:
\r
4430 10.0pt'>employee_exposeName</span></span><i><span style='font-size:10.0pt'>,
\r
4431 no error would be reported.</span></i></p>
\r
4436 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 >
\r
4438 <td valign=top style='padding-top:.1in;padding-right:
\r
4439 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
\r
4440 <p class=MsoCaption><a name="_Toc534824615">Figure 11. Exposure</a></p>
\r
4447 <p class=TextFontCX> </p>
\r
4449 <h1 style='margin-left:0in;text-indent:0in'><a name="_Ref361649198"></a><a
\r
4450 name="_Ref361649165"></a><a name="_Ref354415790"></a><a name="_Ref350062908"></a><a
\r
4451 name="_Ref348845273"></a><a name="_Ref345591297"></a><a name="_Ref344916609"></a><a
\r
4452 name="_Ref344894369"></a><a name="_Ref344891459"></a><a name="_Ref344798185"></a><a
\r
4453 name="_Toc344355418"></a><a name="_Toc534974976"></a><a name="_Ref534014913"></a><a
\r
4454 name="_Ref534014715"></a><a name="_Ref348871484">7<span style='font:7.0pt "Times New Roman"'>
\r
4455 </span>Function Interfaces</a></h1>
\r
4457 <p class=TextFontCX>Functions communicate with their calling environment through an interface. The caller communicates
\r
4458 the values of actual parameters and global variables to the function, and the
\r
4459 function communicates to the caller through the return value, global variables
\r
4460 and storage reachable from the actual parameters. By keeping interfaces narrow
\r
4461 (restricting the amount of information visible across a function interface), we
\r
4462 can understand and implement functions independently. </p>
\r
4464 <p class=TextFontCX> </p>
\r
4466 <p class=TextFontCX>A function prototype
\r
4467 documents the interface to a function. It serves as a contract between the
\r
4468 function and its caller. In early versions of C, the function
\93prototype
\94 was
\r
4469 very limited. It described the type returned by the function but nothing about
\r
4470 its parameters. ANSI C (1989) provided function prototypes with the ability to
\r
4471 add information on the number and types of parameter to a function. Splint
\r
4472 provides the means to express much more about a function interface such as what
\r
4473 global variable the function may use and what values visible to the caller it
\r
4476 <p class=TextFontCX> </p>
\r
4478 <p class=TextFontCX>The extra interface
\r
4479 information places constraints on both how the function may be called and how
\r
4480 it may be implemented. Splint reports places where these constraints are not
\r
4481 satisfied. Typically, these indicate bugs in the code or errors in the
\r
4482 interface documentation.</p>
\r
4484 <p class=TextFontCX> </p>
\r
4486 <p class=TextFontCX>This section describes
\r
4487 annotations that may be added to a function declaration to document what global
\r
4488 variables the function implementation may use and what values visible to its
\r
4489 caller it may modify.</p>
\r
4491 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974977"></a><a
\r
4492 name="_Ref348845225"></a><a name="_Ref344908335"></a><a name="_Ref344892358"></a><a
\r
4493 name="_Toc344355403">7.1<span style='font:7.0pt "Times New Roman"'>
\r
4494 </span>Modifications</a></h2>
\r
4496 <p class=TextFontCX>The modifies clause lists what values visible to the caller may be modified by a function.
\r
4497 Modifies clauses limit what values a function may modify, but they do not
\r
4498 require that listed values are always modified. The declaration,</p>
\r
4500 <p class=example>int f (int *p, int *q) /*@modifies *p@*/;</p>
\r
4502 <p class=TextFontCX>declares a function <span
\r
4503 class=CodeText><span style='font-size:10.0pt'>f</span></span> that may modify
\r
4504 the value pointed to by its first argument but may not modify the value of its
\r
4505 second argument or any global state.</p>
\r
4507 <p class=TextFontCX> </p>
\r
4509 <p class=TextFontCX>Splint checks that a function
\r
4510 does not modify any caller-visible value not encompassed by its modifies clause
\r
4511 and does modify all values listed in its modifies clause on some possible
\r
4512 execution of the function. Figure 12 shows an example of modifies checking done by Splint.</p>
\r
4514 <p class=TextFontCX> </p>
\r
4518 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
4519 style='margin-left:5.4pt;border-collapse:collapse' width=80%>
\r
4521 <td width="40%" valign=top style='border:solid black 1.5pt;
\r
4522 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>
\r
4523 <p class=TextFontCX align=center
\r
4524 style='text-align:center'><a name="_Ref344908343"><span class=Keyword><b><span
\r
4525 style='font-size:10.0pt;color:white'>modify.c</span></b></span></a></p>
\r
4527 <td width=60% valign=top style='border-top:solid black 1.5pt;
\r
4528 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
4529 background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>
\r
4530 <p class=TextFontCX align=center
\r
4531 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
4534 <tr style='height:120.9pt'>
\r
4535 <td valign=top style='border:solid black 1.5pt;
\r
4536 border-top:none;padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>
\r
4537 <p class=Verbatim>void setx (int *x, int *y)</p>
\r
4538 <p class=Verbatim> /*@modifies *x@*/</p>
\r
4539 <p class=Verbatim>{</p>
\r
4540 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>4</span></span>
\r
4542 <p class=Verbatim>}</p>
\r
4543 <p class=Verbatim> </p>
\r
4544 <p class=Verbatim>void sety (int *x, int *y)</p>
\r
4545 <p class=Verbatim> /*@modifies *y@*/</p>
\r
4546 <p class=Verbatim>{</p>
\r
4547 <p class=Verbatim> setx (y, x);</p>
\r
4548 <p class=Verbatim>}</p>
\r
4550 <td width=60% valign=top style='border-top:none;border-left:
\r
4551 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
4552 padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>
\r
4553 <p class=lclintrun>> splint modify.c +checks</p>
\r
4554 <p class=lclintrun>modify.c:4: Undocumented modification of *y: *y = *x</p>
\r
4555 <p class=lclintrun>modify.c:5: Suspect object listed in modifies of setx</p>
\r
4556 <p class=lclintrun> not modified: *x</p>
\r
4557 <p class=lclintrun> modify.c:1: Declaration of setx</p>
\r
4558 <p class=TextFontCX><i><span style='font-size:
\r
4559 10.0pt'> </span></i></p>
\r
4560 <p class=TextFontCX style='page-break-after:
\r
4561 avoid'><i><span style='font-size:10.0pt'>There are n</span></i><i><span
\r
4562 style='font-size:10.0pt'>o errors for </span></i><span class=CodeText><span
\r
4563 style='font-size:10.0pt'>sety</span></span><i><span style='font-size:10.0pt'>
\r
4564 \96 the call to </span></i><span class=CodeText><span style='font-size:10.0pt'>setx</span></span><i><span
\r
4565 style='font-size:10.0pt'> modifies the value <br>pointed to by its first
\r
4566 parameter (</span></i><span class=CodeText><span style='font-size:10.0pt'>y</span></span><i><span
\r
4567 style='font-size:10.0pt'>) as documented by the <br>modifies clause. The </span></i><span
\r
4568 class=Flag><span style='font-size:10.0pt'>checks</span></span><i><span style='font-size:10.0pt'> mode turns on </span></i><span class=Flag><span
\r
4569 style='font-size:10.0pt'>mustmod</span></span><i><span style='font-size:10.0pt'>
\r
4570 </span></i><i><span style='font-size:10.0pt'>checking,<br> so the second error
\r
4571 concerning missing documented <br>modifications is reported.</span></i></p>
\r
4575 <td style='border:none'></td>
\r
4576 <td style='border:none'></td>
\r
4580 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 >
\r
4582 <td valign=top style='padding-top:4.3pt;padding-right:
\r
4583 .3in;padding-bottom:4.3pt;padding-left:.3in'>
\r
4584 <p class=MsoCaption><a name="_Toc534824616"></a><a name="_Ref534822865">Figure
\r
4585 12</a>. Modification</p>
\r
4594 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974978">7.1.1<span
\r
4595 style='font:7.0pt "Times New Roman"'>
\r
4596 </span>State Modifications</a></h3>
\r
4598 <p class=beforelist>A few special names are provided for describing function
\r
4599 modifications that effect state not identifiable through parameters or global
\r
4602 <p class=TextFontCX><span class=Annot><span
\r
4603 style='font-size:10.0pt'>internalState</span></span></p>
\r
4605 <p class=IndentText>The function modifies some internal state (that is, the
\r
4606 value of a <span class=CodeText><span style='font-size:10.0pt'>static</span></span>
\r
4607 variable). Even though a client cannot access the internal state directly, it
\r
4608 is important to know that something may be modified by the function call both
\r
4609 for clear documentation and for checking undefined order of evaluation (Section 8.2) and side effect free parameters (Section 11.2.1).</p>
\r
4611 <p class=TextFontCX><span class=Annot><span
\r
4612 style='font-size:10.0pt'>fileSystem</span></span></p>
\r
4614 <p class=IndentText>The function modifies the file system. Any modification
\r
4615 that may change the system state is considered a file system modification. All
\r
4616 functions that modify an object of type pointer to <span class=CodeText><span
\r
4617 style='font-size:10.0pt'>FILE</span></span> also modify the file system. In
\r
4618 addition, functions that do not modify a <span class=CodeText><span
\r
4619 style='font-size:10.0pt'>FILE</span></span> pointer but modify some state that
\r
4620 is visible outside this process also modify the file system (e.g., <span
\r
4621 class=CodeText><span style='font-size:10.0pt'>rename</span></span>). The flag
\r
4622 <span class=Flag><span style='font-size:10.0pt'>mod-file-system</span></span> controls reporting of undocumented file system modifications.</p>
\r
4624 <p class=MsoListBullet><span class=Annot><span style='font-size:10.0pt'>nothing</span></span></p>
\r
4626 <p class=IndentText>The function modifies nothing (i.e., it is side effect
\r
4629 <p class=TextFontCX style='margin-left:.5in'> </p>
\r
4631 <p class=TextFontCX>The annotation, <span
\r
4632 class=Annot><span style='font-size:10.0pt'>/*@*/</span></span> in a function declaration or definition (after the parameter list, before the
\r
4633 semi-colon or function body) denotes a function that modifies nothing and does
\r
4634 not use any global variables (see Section 7.2).</p>
\r
4636 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974979"></a><a
\r
4637 name="_Ref345591515">7.1.2<span style='font:7.0pt "Times New Roman"'>
\r
4638 </span>Missing Modifies Clauses</a></h3>
\r
4640 <p class=TextFontCX>Splint is designed so
\r
4641 programs with many functions that are declared without modifies clauses can be
\r
4642 checked effectively. Unless <span class=Flag><span style='font-size:10.0pt'>modnomods</span></span>
\r
4643 is in on, no modification errors are reported checking a function declared with
\r
4644 no modifies clause. </p>
\r
4646 <p class=TextFontCX> </p>
\r
4648 <p class=TextFontCX>A function with no modifies
\r
4649 clause is an <i>unconstrained</i> function since there are no documented
\r
4650 constraints on what it may modify. When an unconstrained function is called,
\r
4651 it is checked differently from a function declared with a modifies clause. To
\r
4652 prevent spurious errors, no modification error is reported at the call site
\r
4653 unless the <span class=Flag><span style='font-size:10.0pt'>mod-uncon</span></span> flag is on. Flags control whether errors involving unconstrained functions are reported for other checks that depend on modifications (side effect free macro parameters (Section
\r
4654 11.2.1), undefined evaluation order (Section 8.2), and likely infinite loops (Section 8.3.1).)</p>
\r
4656 <h2 style='margin-left:0in;text-indent:0in'><a name="_Ref534980042"></a><a
\r
4657 name="_Toc534974980"></a><a name="_Ref534972121"></a><a name="_Ref348845219"></a><a
\r
4658 name="_Ref347475720"></a><a name="_Ref347171487"></a><a name="_Ref344908307"></a><a
\r
4659 name="_Ref344893725"></a><a name="_Toc344355404">7.2<span style='font:7.0pt "Times New Roman"'>
\r
4660 </span>Global Variables</a></h2>
\r
4662 <p class=TextFontCX>Another aspect of a
\r
4663 function
\92s interface, is the global variables it uses. A globals list in a function declaration lists external variables that may be used in the
\r
4664 function body. Splint checks that global variables used in a procedure match
\r
4665 those listed in its globals list. A global is used in a function if it appears
\r
4666 in the body directly, or it is in the globals list of a function called in the
\r
4667 body. Splint reports if a global that is used in a procedure is not listed in
\r
4668 its globals list, and if a listed global is not used in the function
\r
4669 implementation. Figure 13 shows an example function definition with a globals list and associated checking done by Splint.</p>
\r
4672 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
4673 style='margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt;
\r
4674 margin-right:-2.25pt'>
\r
4675 <tr style='height:13.25pt'>
\r
4676 <td valign=top style='width:202.5pt;border:solid black 1.5pt;
\r
4677 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>
\r
4678 <p class=TextFontCX align=center
\r
4679 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
4680 color:white'>globals.c</span></b></span></p>
\r
4682 <td valign=top style='width:220.5pt;border-top:solid black 1.5pt;
\r
4683 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
4684 background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>
\r
4685 <p class=TextFontCX align=center
\r
4686 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
4689 <tr style='height:70.65pt'>
\r
4690 <td valign=top style='width:202.5pt;border:solid black 1.5pt;
\r
4691 border-top:none;padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>
\r
4692 <p class=Verbatim><span style='font-size:9.5pt'>int glob1, glob2;</span></p>
\r
4693 <p class=Verbatim><span style='font-size:9.5pt'> </span></p>
\r
4694 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>3 </span></span><span
\r
4695 style='font-size:9.5pt'>int f (void) /*@globals glob1;@*/</span></p>
\r
4696 <p class=Verbatim><span style='font-size:9.5pt'>{</span></p>
\r
4697 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>5 </span></span><span
\r
4698 style='font-size:9.5pt'>return glob2;</span></p>
\r
4699 <p class=Verbatim><span style='font-size:9.5pt'>}</span></p>
\r
4701 <td valign=top style='width:220.5pt;border-top:none;border-left:
\r
4702 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
4703 padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>
\r
4704 <p class=lclintrun>> splint globals.c +checks</p>
\r
4705 <p class=lclintrun> </p>
\r
4706 <p class=lclintrun>globals.c:5: Undocumented use of global glob2</p>
\r
4707 <p class=lclintrun>globals.c:3: Global glob1 listed but not used</p>
\r
4708 <p class=lclintrun> </p>
\r
4709 <p class=lclintrun style='page-break-after:avoid'> </p>
\r
4714 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
4716 <td valign=top align=left style='padding-top:8.65pt;padding-right:
\r
4717 9.35pt;padding-bottom:8.65pt;padding-left:9.35pt'>
\r
4718 <p class=MsoCaption><a name="_Ref349498221"></a><a name="_Ref349498215"></a><a
\r
4719 name="_Ref347468808"></a><a name="_Ref347468791"></a><a name="_Ref344908072"></a><a
\r
4720 name="_Ref344908069"></a><a name="_Ref344893745"></a><a name="_Toc344355405"></a><a
\r
4721 name="_Toc534824617"></a><a name="_Ref534822988">Figure 13</a>. Global
\r
4729 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974981">7.2.1<span
\r
4730 style='font:7.0pt "Times New Roman"'>
\r
4731 </span>Controlling Globals Checking</a></h3>
\r
4733 <p class=TextFontCX>Whether on not an error is
\r
4734 reported for a use of a global variable in a given function depends on the
\r
4735 scope of the variable (file <span class=CodeText><span style='font-size:10.0pt'>static</span></span>
\r
4736 or external), the checking annotation used in the variable declaration or the
\r
4737 implicit annotation if no checking annotation is used, whether or not the
\r
4738 function is declared with a globals list, and flag settings.</p>
\r
4740 <p class=TextFontCX> </p>
\r
4742 <p class=beforelist>A global or file static variable declaration may be
\r
4743 preceded by an annotation to indicate how the variable should be checked. In
\r
4744 order of decreasing checks, the annotations are:</p>
\r
4746 <p class=TextFontCX><span class=Annot><span
\r
4747 style='font-size:10.0pt'>/*@checkedstrict@*/</span></span></p>
\r
4749 <p class=IndentText>Strictest checking. Undocumented uses and modifications of
\r
4750 the variable are reported in all functions whether or not they have a globals
\r
4751 list (unless <span class=Flag><span style='font-size:10.0pt'>check-strict-globs</span></span>
\r
4754 <p class=TextFontCX><span class=Annot><span
\r
4755 style='font-size:10.0pt'>/*@checked@*/</span></span></p>
\r
4757 <p class=IndentText>Undocumented use of the variable is reported in a function
\r
4758 with a globals list, but not in a function declared with no globals (unless <span
\r
4759 class=Flag><span style='font-size:10.0pt'>glob-noglobs</span></span> is on).<a name=here></a></p>
\r
4761 <p class=TextFontCX><span class=Annot><span
\r
4762 style='font-size:10.0pt'>/*@checkmod@*/</span></span></p>
\r
4764 <p class=IndentText>Undocumented uses of the variable are not reported, but
\r
4765 undocumented modifications are reported. (If <span class=Flag><span
\r
4766 style='font-size:10.0pt'>mod-globs-nomods</span></span> is on, errors are
\r
4767 reported even in functions declared with no modifies clause or globals list.)</p>
\r
4769 <p class=TextFontCX><span class=Annot><span
\r
4770 style='font-size:10.0pt'>/*@unchecked@*/</span></span></p>
\r
4772 <p class=IndentText>No messages are reported for undocumented use or
\r
4773 modification of this global variable.</p>
\r
4775 <p class=afterlist>If a variable has none of these annotations, an implicit
\r
4776 annotation is determined by the flag settings. </p>
\r
4778 <p class=TextFontCX> </p>
\r
4780 <p class=TextFontCX>Different flags control the
\r
4781 implicit annotation for variables declared with global scope and variables
\r
4782 declared with file scope (i.e., using the <span class=CodeText><span
\r
4783 style='font-size:10.0pt'>static</span></span> storage qualifier). To set the
\r
4784 implicit annotation for global variables declared in <span class=Flag><i><span
\r
4785 style='font-size:10.0pt'>context</span></i></span> (<span class=Flag><span
\r
4786 style='font-size:10.0pt'>globs</span></span> for external variables or <span
\r
4787 class=Flag><span style='font-size:10.0pt'>statics</span></span> for file static
\r
4788 variable) to be <span class=Flag><i><span style='font-size:10.0pt'>annotation</span></i></span>
\r
4789 (<span class=Flag><span style='font-size:10.0pt'>checked</span></span>, <span
\r
4790 class=Flag><span style='font-size:10.0pt'>checkmod</span></span>, <span
\r
4791 class=Flag><span style='font-size:10.0pt'>checkedstrict</span></span>) use <span
\r
4792 class=Flag><span style='font-size:10.0pt'>imp<i><annotation>
\r
4793 <context></i></span></span>. For example, <span class=Flag><span
\r
4794 style='font-size:10.0pt'>+imp-checked-strict-statics</span></span> makes the implicit checking on unqualified file static variables <span class=Flag><span
\r
4795 style='font-size:10.0pt'>checkedstrict</span></span>. See Appendix B for a complete list of globals checking flags. </p>
\r
4797 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974982"></a><a
\r
4798 name="_Ref534971010">7.2.2<span style='font:7.0pt "Times New Roman"'>
\r
4799 </span></a>Definition State</h3>
\r
4801 <p class=TextFontCX>Annotations can be used in
\r
4802 the globals list of a function declaration to describe the states of global
\r
4803 variables before and after the call. If a global is preceded by <span
\r
4804 class=Annot><span style='font-size:10.0pt'>undef</span></span>, it is assumed to be undefined before the call. Thus, no error is reported if the
\r
4805 global is not defined when the function is called, but an error is reported if
\r
4806 the global is used in the function body before it is defined. The <span
\r
4807 class=Annot><span style='font-size:10.0pt'>killed</span></span> annotation
\r
4808 denotes a global variable that may be undefined when the call returns. For
\r
4809 globals that contain dynamically allocated storage, a <span class=Annot><span
\r
4810 style='font-size:10.0pt'>killed</span></span> global variable is similar to an <span
\r
4811 class=Annot><span style='font-size:10.0pt'>only</span></span> parameter (Section 5.2). An error is reported if it contains the only reference to
\r
4812 storage that is not released before the call returns. Figure 14 illustrated <span
\r
4813 class=Annot><span style='font-size:10.0pt'>killed</span></span> and <span
\r
4814 class=Annot><span style='font-size:10.0pt'>undef</span></span> globals.</p>
\r
4819 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
4820 style='margin-left:.9pt;border-collapse:collapse;
\r
4821 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
4823 <td valign=top style='border:solid black 1.5pt;
\r
4824 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
\r
4825 <p class=TextFontCX align=center
\r
4826 style='text-align:center'> <span class=Keyword><b><span
\r
4827 style='font-size:10.0pt;color:white'>annotglobs.c</span></b></span></p>
\r
4829 <td valign=top style='width:198.8pt;border-top:solid black 1.5pt;
\r
4830 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
4831 background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
\r
4832 <p class=TextFontCX align=center
\r
4833 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
4837 <td valign=top style='border:solid black 1.5pt;
\r
4838 border-top:none;padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>
\r
4839 <p class=Verbatim>int globnum;</p>
\r
4840 <p class=Verbatim> </p>
\r
4841 <p class=Verbatim>struct {</p>
\r
4842 <p class=Verbatim> char *firstname, *lastname;</p>
\r
4843 <p class=Verbatim> int id;</p>
\r
4844 <p class=Verbatim>} globname;</p>
\r
4845 <p class=Verbatim> </p>
\r
4846 <p class=Verbatim>void </p>
\r
4847 <p class=Verbatim>initialize (/*@only@*/ char *name)</p>
\r
4848 <p class=Verbatim> /*@globals undef globnum,</p>
\r
4849 <p class=Verbatim> undef globname @*/</p>
\r
4850 <p class=Verbatim>{</p>
\r
4851 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>13 </span></span>globname.id
\r
4853 <p class=Verbatim> globname.lastname = name;</p>
\r
4854 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>15</span></span>}</p>
\r
4855 <p class=Verbatim> </p>
\r
4856 <p class=Verbatim>void finalize (void)</p>
\r
4857 <p class=Verbatim> /*@globals killed globname@*/</p>
\r
4858 <p class=Verbatim>{</p>
\r
4859 <p class=Verbatim> free (globname.lastname);</p>
\r
4860 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>21 </span></span>}</p>
\r
4862 <td valign=top style='width:198.8pt;border-top:none;border-left:
\r
4863 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
4864 padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>
\r
4865 <p class=lclintrun>> splint annotglobs.c</p>
\r
4866 <p class=lclintrun> </p>
\r
4867 <p class=lclintrun>annotglobs.c:13: Undef global globnum used</p>
\r
4868 <p class=lclintrun> before definition</p>
\r
4869 <p class=lclintrun>annotglobs.c:15: Global storage globname</p>
\r
4870 <p class=lclintrun> contains 1 undefined field when call</p>
\r
4871 <p class=lclintrun> returns: firstname</p>
\r
4872 <p class=lclintrun>annotglobs.c:21: Only storage</p>
\r
4873 <p class=lclintrun> globname.firstname (type char *) derived</p>
\r
4874 <p class=lclintrun> from killed global is not released</p>
\r
4875 <p class=lclintrun style='page-break-after:avoid'> (memory leak)</p>
\r
4880 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
4882 <td valign=top align=left style='padding-top:10.1pt;padding-right:
\r
4883 9.35pt;padding-bottom:10.1pt;padding-left:9.35pt'>
\r
4884 <p class=MsoCaption><a name="_Toc534824618"></a><a name="_Ref534823055">Figure
\r
4885 14</a>. Annotated Globals Lists</p>
\r
4891 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974983"></a><a
\r
4892 name="_Ref344894947"></a><a name="_Toc344355406">7.3<span style='font:7.0pt "Times New Roman"'>
\r
4893 </span>Declaration Consistency</a></h2>
\r
4895 <p class=TextFontCX>Splint checks that function declarations and definitions are consistent. The general rule is that the <i>first</i> declaration of a function implies all later declarations and
\r
4896 definitions. If a function is declared in a header file, the first declaration
\r
4897 processed is its first declaration (if it is declared in more than one header
\r
4898 file an error is reported if <span class=Flag><span style='font-size:10.0pt'>redecl</span></span> is set)<span
\r
4899 style='display:none'> (if the same function is declared in more than one header
\r
4900 file ???)</span>. Otherwise, the first declaration in the file defining the
\r
4901 function is its first declaration.</p>
\r
4903 <p class=TextFontCX> </p>
\r
4905 <p class=TextFontCX>Later declarations may not
\r
4906 include variables in the globals list that were not included in the first
\r
4907 declaration. The exception to this is when the first declaration is in a
\r
4908 header file and the later declaration or definition includes file static
\r
4909 variables. Since these are not visible in the header file, they can not be
\r
4910 included in the header file declaration. Similarly, the modifies clause of a
\r
4911 later declaration may not include objects that are not modifiable in the first
\r
4912 declaration. The later declaration may be more specific. For example, if the
\r
4913 header declaration is:</p>
\r
4915 <p class=example style='text-indent:.3in'>extern void setName (employee e, char
\r
4916 *s) /*@modifies e@*/;</p>
\r
4918 <p class=TextFontCX>the later declaration could
\r
4921 <p class=example> void setName (employee e, char *) /*@modifies e->name@*/;</p>
\r
4923 <p class=TextFontCX>If <span class=CodeText><span
\r
4924 style='font-size:10.0pt'>employee</span></span> is an abstract type, the declaration in the header should not refer to a particular implementation
\r
4925 (i.e., it shouldn
\92t rely on there being a <span class=CodeText><span
\r
4926 style='font-size:10.0pt'>name</span></span> field), but the implementation
\r
4927 declaration can be more specific. </p>
\r
4929 <p class=TextFontCX> </p>
\r
4931 <p class=TextFontCX>This rule also applies to
\r
4932 file static variables. The header declaration for a function that modifies a
\r
4933 file static variable should use <span class=Annot><span style='font-size:10.0pt'>modifies
\r
4934 internalState</span></span> since file static variables are not visible to
\r
4935 clients. The implementation declaration should list the actual file static
\r
4936 variables that may be modified.</p>
\r
4938 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974984"></a><a
\r
4939 name="_Ref354411787">7.4<span style='font:7.0pt "Times New Roman"'>
\r
4940 </span>State Clauses</a></h2>
\r
4942 <p class=TextFontCX>Sometimes it is necessary to
\r
4943 specify function interfaces at a lower level than is possible with the standard
\r
4944 annotations. For example, if a function defines some fields of a returned
\r
4945 structure but does not define all the fields. The <span class=Annot><span
\r
4946 style='font-size:10.0pt'>/*@special@*/</span></span> annotation is used to mark
\r
4947 a parameter, global variable, or return value that is described using state
\r
4950 <p class=TextFontCX> </p>
\r
4952 <p class=TextFontCX>State clauses may be used to
\r
4953 constrain the state of a parameter or return value before or after a call. One
\r
4954 or more state clauses may appear in a function declaration, before the modifies
\r
4955 or globals clauses. State clauses may be listed in any order, but the same
\r
4956 state clause should not be used more than once. In a state clause list, <span
\r
4957 class=CodeText><span style='font-size:10.0pt'>result</span></span> is used to
\r
4958 refer to the return value of the function. </p>
\r
4960 <p class=TextFontCX> </p>
\r
4962 <p class=TextFontCX style='margin-bottom:6.0pt'>The
\r
4963 following state clauses are used to describe the definition state or parameters
\r
4964 before and after the function is called and the return value after the function
\r
4967 <p class=TextFontCX><span class=Annot><span
\r
4968 style='font-size:10.0pt'>/*@uses <i><references></i>@*/</span></span></p>
\r
4970 <p class=indentbefore0>References in a <span
\r
4971 class=Annot><span style='font-size:10.0pt'>uses</span></span> clause must be
\r
4972 completely defined before the function is called. They are assumed to be
\r
4973 defined at function entrance when the function is checked.</p>
\r
4975 <p class=TextFontCX><span class=Annot><span
\r
4976 style='font-size:10.0pt'>/*@sets <i><references></i>@*/</span></span></p>
\r
4978 <p class=indentbefore0>References in a <span
\r
4979 class=Annot><span style='font-size:10.0pt'>sets</span></span> clause must be
\r
4980 allocated before the function is called. They are completely defined after the
\r
4981 function returns. They are assumed to be allocated but undefined storage at
\r
4982 function entrance and an error is reported if there is a path on which they are
\r
4983 not defined before the function returns.</p>
\r
4985 <p class=TextFontCX><span class=Annot><span
\r
4986 style='font-size:10.0pt'>/*@defines <i><references></i>@*/</span></span></p>
\r
4988 <p class=indentbefore0>References in a <span
\r
4989 class=Annot><span style='font-size:10.0pt'>defines</span></span> clause must
\r
4990 not refer to unshared, allocated storage before the function is called. They
\r
4991 are completely defined after the function returns. When the function is
\r
4992 checked, they are assumed to be undefined at function entrance and an error is
\r
4993 reported if there is a path on which they are not defined before the function
\r
4996 <p class=TextFontCX><span class=Annot><span
\r
4997 style='font-size:10.0pt'>/*@allocates <i><references></i>@*/</span></span></p>
\r
4999 <p class=indentbefore0>References in an <span
\r
5000 class=Annot><span style='font-size:10.0pt'>allocates</span></span> clause must
\r
5001 be unallocated before the function is called. They are allocated but not necessarily
\r
5002 defined after the function returns. An error is reported if there is a path
\r
5003 through the function on which they are not allocated before the function
\r
5006 <p class=TextFontCX><span class=Annot><span
\r
5007 style='font-size:10.0pt'>/*@releases <references>@*/</span></span></p>
\r
5009 <p class=IndentText>References in the <span
\r
5010 class=Annot><span style='font-size:10.0pt'>releases</span></span> clause are
\r
5011 deallocated by the function. They must be storage that could be passed as an <span
\r
5012 class=Annot><span style='font-size:10.0pt'>only</span></span> parameter before the function is called, and are dead pointers after the function returns. They are assumed to be defined at function entrance and an error is reported if they
\r
5013 refer to live, allocated storage at any return point.</p>
\r
5015 <p class=TextFontCX> </p>
\r
5017 <p class=TextFontCX>Some examples of state
\r
5018 clauses are shown in Figure 15. The <span class=Annot><span style='font-size:
\r
5019 10.0pt'>defines</span></span> clause for <span class=CodeText><span
\r
5020 style='font-size:10.0pt'>record_new</span></span> indicates that the <span
\r
5021 class=CodeText><span style='font-size:10.0pt'>id</span></span> field of the
\r
5022 structure pointed to by the result is defined, but the <span class=CodeText><span
\r
5023 style='font-size:10.0pt'>name</span></span> field is not. So, <span
\r
5024 class=CodeText><span style='font-size:10.0pt'>record_create</span></span> needs
\r
5025 to call <span class=CodeText><span style='font-size:10.0pt'>record_setName</span></span>
\r
5026 to define the name field. Similarly, the <span class=Annot><span
\r
5027 style='font-size:10.0pt'>releases</span></span> clause for <span
\r
5028 class=CodeText><span style='font-size:10.0pt'>record_clearName</span></span>
\r
5029 indicates that no storage is associated with the <span class=CodeText><span
\r
5030 style='font-size:10.0pt'>name</span></span> field of its parameter after the
\r
5031 return, so no failure to deallocate storage message is produced for the call to
\r
5032 <span class=CodeText><span style='font-size:10.0pt'>free</span></span> in <span
\r
5033 class=CodeText><span style='font-size:10.0pt'>record_free</span></span>. The <span
\r
5034 class=Annot><span style='font-size:10.0pt'>ensures isnull</span></span> clause
\r
5035 is described in the next section.</p>
\r
5040 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
5041 style='margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt;
\r
5042 margin-right:-2.25pt'>
\r
5044 <td valign=top style='width:423.0pt;border:solid black 1.5pt;
\r
5045 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5046 <p class=TextFontCX align=center
\r
5047 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
5048 color:white'>clauses.c</span></b></span></p>
\r
5052 <td valign=top style='width:423.0pt;border:solid black 1.5pt;
\r
5053 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
5054 <p class=Verbatim>typedef struct</p>
\r
5055 <p class=Verbatim>{</p>
\r
5056 <p class=Verbatim> int id;</p>
\r
5057 <p class=Verbatim> /*@only@*/ char *name;</p>
\r
5058 <p class=Verbatim>} *record;</p>
\r
5059 <p class=Verbatim> </p>
\r
5060 <p class=Verbatim>static /*@special@*/ record record_new (void)</p>
\r
5061 <p class=Verbatim> /*@defines result->id@*/</p>
\r
5062 <p class=Verbatim>{</p>
\r
5063 <p class=Verbatim> record r = (record) malloc (sizeof (*r));</p>
\r
5064 <p class=Verbatim> </p>
\r
5065 <p class=Verbatim> assert (r != NULL);</p>
\r
5066 <p class=Verbatim> r->id = 3;</p>
\r
5067 <p class=Verbatim> return r;</p>
\r
5068 <p class=Verbatim>}</p>
\r
5069 <p class=Verbatim> </p>
\r
5070 <p class=Verbatim>static void </p>
\r
5071 <p class=Verbatim> record_setName (/*@special@*/ record r, /*@only@*/ char
\r
5073 <p class=Verbatim> /*@defines r->name@*/</p>
\r
5074 <p class=Verbatim>{</p>
\r
5075 <p class=Verbatim> r->name = name;</p>
\r
5076 <p class=Verbatim>}</p>
\r
5077 <p class=Verbatim> </p>
\r
5078 <p class=Verbatim>record record_create (/*@only@*/ char *name)</p>
\r
5079 <p class=Verbatim>{</p>
\r
5080 <p class=Verbatim> record r = record_new ();</p>
\r
5081 <p class=Verbatim> record_setName (r, name);</p>
\r
5082 <p class=Verbatim> return r;</p>
\r
5083 <p class=Verbatim>}</p>
\r
5084 <p class=Verbatim> </p>
\r
5085 <p class=Verbatim>void record_clearName (/*@special@*/ record r)</p>
\r
5086 <p class=Verbatim> /*@releases r->name@*/</p>
\r
5087 <p class=Verbatim> /*@ensures isnull r->name@*/</p>
\r
5088 <p class=Verbatim>{</p>
\r
5089 <p class=Verbatim> free (r->name);</p>
\r
5090 <p class=Verbatim> r->name = NULL;</p>
\r
5091 <p class=Verbatim>}</p>
\r
5092 <p class=Verbatim> </p>
\r
5093 <p class=Verbatim>void record_free (/*@only@*/ record r)</p>
\r
5094 <p class=Verbatim>{</p>
\r
5095 <p class=Verbatim> record_clearName (r);</p>
\r
5096 <p class=Verbatim> free (r);</p>
\r
5097 <p class=Verbatim>}</p>
\r
5098 <p class=Verbatim style='page-break-after:avoid'> </p>
\r
5103 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
5105 <td valign=top style='padding-top:0in;padding-right:
\r
5106 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
5107 <p class=MsoCaption><a name="_Toc534824619"></a><a name="_Ref354412972">Figure
\r
5108 15</a>. State Clauses</p>
\r
5114 <p class=TextFontCX><span class=Keyword><span
\r
5115 style='font-size:10.0pt'> </span></span></p>
\r
5117 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974985"></a><a
\r
5118 name="_Ref534888798">7.5<span style='font:7.0pt "Times New Roman"'>
\r
5119 </span>Requires and Ensures Clauses</a></h2>
\r
5121 <p class=TextFontCX>More general assumptions
\r
5122 about state of parameters and globals before and after a function is called can
\r
5123 be described using <span class=Annot><i><span style='font-size:10.0pt'>requires</span></i></span>
\r
5124 and <span class=Annot><i><span style='font-size:10.0pt'>ensures</span></i></span>
\r
5125 clauses. A <span class=Annot><span style='font-size:10.0pt'>requires</span></span>
\r
5126 clause specifies a predicate that must be true at a call site; when checking a
\r
5127 function implementation Splint assumes the constraints given in its <span
\r
5128 class=Annot><span style='font-size:10.0pt'>requires</span></span> clauses are
\r
5129 true at function entry. An <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
5130 clause specifies a predicate that is true at a call site after the call
\r
5131 returns; when checking a function implementation Splint warns if there is an
\r
5132 execution path that does not return with a state that stratifies the
\r
5133 constraints given in its <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
5134 clauses. A function declaration can have many <span class=Annot><span
\r
5135 style='font-size:10.0pt'>requires</span></span> and <span class=Annot><span
\r
5136 style='font-size:10.0pt'>ensures</span></span> clauses as long as their
\r
5137 meanings are not contradictory.</p>
\r
5139 <p class=TextFontCX> </p>
\r
5141 <p class=TextFontCX>The following constraints can
\r
5142 be stated using <span class=Annot><span style='font-size:10.0pt'>requires</span></span>
\r
5143 and <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
5146 <h6 style='margin-left:0in;text-indent:0in'><b>Aliasing Annotations</b></h6>
\r
5148 <p class=TextFontCX><span class=Annot><span
\r
5149 style='font-size:10.0pt'>/*@requires only<i><references></i>@*/</span></span>;
\r
5150 <span class=Annot><span style='font-size:10.0pt'>/*@ensures only<i><references></i>@*/</span></span></p>
\r
5152 <p class=TextFontCX><span class=Annot><span
\r
5153 style='font-size:10.0pt'>/*@requires shared<i><references></i>@*/</span></span>;
\r
5154 <span class=Annot><span style='font-size:10.0pt'>/*@ensures shared<i><references></i>@*/</span></span></p>
\r
5156 <p class=TextFontCX><span class=Annot><span
\r
5157 style='font-size:10.0pt'>/*@requires owned<i><references></i>@*/</span></span>;
\r
5158 <span class=Annot><span style='font-size:10.0pt'>/*@ensures owned<i><references></i>@*/</span></span></p>
\r
5160 <p class=TextFontCX><span class=Annot><span
\r
5161 style='font-size:10.0pt'>/*@requires dependent<i><references></i>@*/</span></span>;
\r
5162 <span class=Annot><span style='font-size:10.0pt'>/*@ensures dependent<i><references></i>@*/</span></span></p>
\r
5164 <p class=IndentText>References refer to <span
\r
5165 class=Annot><span style='font-size:10.0pt'>only</span></span>, <span
\r
5166 class=Annot><span style='font-size:10.0pt'>shared</span></span>, <span
\r
5167 class=Annot><span style='font-size:10.0pt'>owned</span></span> or <span
\r
5168 class=Annot><span style='font-size:10.0pt'>dependent</span></span> storage
\r
5169 before (<span class=Annot><span style='font-size:10.0pt'>requires</span></span>)
\r
5170 or after (<span class=Annot><span style='font-size:10.0pt'>ensures</span></span>)
\r
5173 <h6 style='margin-left:0in;text-indent:0in'><b>Exposure Annotations</b></h6>
\r
5175 <p class=TextFontCX><span class=Annot><span
\r
5176 style='font-size:10.0pt'>/*@requires observer<i><references></i>@*/</span></span>;
\r
5177 <span class=Annot><span style='font-size:10.0pt'>/*@ensures observer<i><references></i>@*/</span></span></p>
\r
5179 <p class=TextFontCX><span class=Annot><span
\r
5180 style='font-size:10.0pt'>/*@requires exposed<i><references></i>@*/</span></span>;
\r
5181 <span class=Annot><span style='font-size:10.0pt'> /*@ensures exposed <i><references></i>@*/</span></span></p>
\r
5183 <p class=IndentText>References refer to <span class=Annot><span
\r
5184 style='font-size:10.0pt'>observer</span></span> or <span class=Annot><span
\r
5185 style='font-size:10.0pt'>exposed</span></span> storage before (<span
\r
5186 class=Annot><span style='font-size:10.0pt'>requires</span></span>) or after (<span
\r
5187 class=Annot><span style='font-size:10.0pt'>ensures</span></span>) the call.</p>
\r
5189 <h6 style='margin-left:0in;text-indent:0in'><b>Null</b><b> </b><b>State</b><b>
\r
5190 Annotations</b></h6>
\r
5192 <p class=TextFontCX><span class=Annot><span
\r
5193 style='font-size:10.0pt'>/*@requires isnull<i><references></i>@*/</span></span>;
\r
5194 <span class=Annot><span style='font-size:10.0pt'>/*@ensures isnull<i><references></i>@*/</span></span></p>
\r
5196 <p class=IndentText>References have the value <span class=CodeText><span
\r
5197 style='font-size:10.0pt'>NULL</span></span> before (<span class=Annot><span
\r
5198 style='font-size:10.0pt'>requires</span></span>) or after (<span class=Annot><span
\r
5199 style='font-size:10.0pt'>ensures</span></span>) the call. Note, this is not
\r
5200 the same name or meaning as the <span class=Annot><span style='font-size:10.0pt'>null</span></span>
\r
5201 annotation (which means the value may or may not be <span class=Annot><span
\r
5202 style='font-size:10.0pt'>NULL</span></span>.)</p>
\r
5204 <p class=TextFontCX><span class=Annot><span
\r
5205 style='font-size:10.0pt'>/*@requires notnull<i><references></i>@*/</span></span>;
\r
5206 <span class=Annot><span style='font-size:10.0pt'>/*@ensures notnull<i><references></i>@*/</span></span></p>
\r
5208 <p class=IndentText>References do not have the value <span class=CodeText><span
\r
5209 style='font-size:10.0pt'>NULL</span></span> before (<span class=Annot><span
\r
5210 style='font-size:10.0pt'>requires</span></span>) or after (<span class=Annot><span
\r
5211 style='font-size:10.0pt'>ensures</span></span>) the call.</p>
\r
5213 <p class=TextFontCX> </p>
\r
5215 <h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534974986"></a><a
\r
5216 name="_Ref534642886"></a><a name="_Ref483663682">8<span style='font:7.0pt "Times New Roman"'>
\r
5217 </span>Control Flow</a></h1>
\r
5219 <p class=TextFontCX>The section describes
\r
5220 checking done by Splint related to control flow. Many of these checks are
\r
5221 significantly improved because of the extra information that is known about the
\r
5222 program when annotations are provided.</p>
\r
5224 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974987"></a><a
\r
5225 name="_Ref345859337"></a><a name="_Ref344907653"></a><a name="_Ref344894343"></a><a
\r
5226 name="_Ref344873752"></a><a name="_Toc344355417">8.1<span style='font:7.0pt "Times New Roman"'>
\r
5227 </span>Execution</a></h2>
\r
5229 <p class=TextFontCX>To detect certain errors and
\r
5230 avoid spurious errors, it is important to know something about the control flow
\r
5231 behavior of called functions. Without additional information, Splint assumes
\r
5232 that all functions eventually return and execution continues normally at the
\r
5235 <p class=TextFontCX> </p>
\r
5237 <p class=TextFontCX>The <span class=Annot><span
\r
5238 style='font-size:10.0pt'>noreturn</span></span> annotation is used to denote a function that never returns<a href="#_ftn8" name="_ftnref8" title=""><span
\r
5239 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
5240 style='font-size:11.0pt;font-family:"Times New Roman"'>[8]</span></span></span></a>.
\r
5243 <p class=example><span class=Annot><span style='font-size:10.0pt'>extern
\r
5244 /*@noreturn@*/ void fatalerror (/*@observer@*/ char *s);</span></span></p>
\r
5246 <p class=beforelist>declares <span class=CodeText><span style='font-size:10.0pt'>fatalerror</span></span>
\r
5247 to never return. This enables Splint to correctly analyze code like,</p>
\r
5249 <p class=TextFontCX><span class=Keyword><span
\r
5250 style='font-size:10.0pt'> if (x == NULL) fatalerror ("Yikes!");</span></span></p>
\r
5252 <p class=TextFontCX><span class=Keyword><span
\r
5253 style='font-size:10.0pt'> *x = 3;</span></span></p>
\r
5255 <p class=afterlist>Other functions may return, but sometimes (or usually)
\r
5256 return normally. The <span class=Annot><span style='font-size:10.0pt'>maynotreturn</span></span>
\r
5257 annotation denotes a function that may or may not return. This may be useful
\r
5258 for documentation, but does not help checking much, since Splint must assume
\r
5259 that a function declared with <span class=Annot><span style='font-size:10.0pt'>maynotreturn</span></span>
\r
5260 returns normally when checking the code. The <span class=Annot><span
\r
5261 style='font-size:10.0pt'>alwaysreturns</span></span> annotation denotes a
\r
5262 function that always returns (but Splint does no checking to verify this).</p>
\r
5264 <p class=TextFontCX> </p>
\r
5266 <p class=TextFontCX>To describe non-returning
\r
5267 functions more precisely, the <span class=Annot><span style='font-size:10.0pt'>noreturnwhentrue</span></span> and <span class=Annot><span style='font-size:10.0pt'>noreturnwhenfalse</span></span> annotations may be used. Similar to <span class=Annot><span style='font-size:
\r
5268 10.0pt'>nullwhentrue</span></span> and <span class=Annot><span
\r
5269 style='font-size:10.0pt'>falsewhennull</span></span> (see Section 2.1.1), <span
\r
5270 class=Annot><span style='font-size:10.0pt'>noreturnwhentrue</span></span> and <span class=Annot><span style='font-size:10.0pt'>noreturnwhenfalse </span></span>mean
\r
5271 that a function never returns if the value of its first argument is true (<span
\r
5272 class=Annot><span style='font-size:10.0pt'>noreturnwhentrue</span></span>) or
\r
5273 false (<span class=Annot><span style='font-size:10.0pt'>noreturnwhenfalse</span></span>).
\r
5274 They may be used only on functions whose first argument is a Boolean. </p>
\r
5276 <p class=TextFontCX> </p>
\r
5278 <p class=TextFontCX style='margin-bottom:6.0pt'>Hence,
\r
5279 a function declared with <span class=Annot><span style='font-size:10.0pt'>noreturnwhenwfalse</span></span>
\r
5280 must not return if the value of its argument is false. For example, the
\r
5281 standard library declares <span class=Keyword><span style='font-size:10.0pt'>assert</span></span> as<a
\r
5282 href="#_ftn9" name="_ftnref9" title=""><span class=MsoFootnoteReference><span
\r
5283 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>:</p>
\r
5285 <p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;
\r
5286 margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>/*@noreturnwhenfalse@*/
\r
5289 <p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;
\r
5290 margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>assert (/*@sef@*/ bool
\r
5291 /*@alt int@*/ pred);</p>
\r
5293 <p class=beforelist style='margin-top:6.0pt'>This way, code like,</p>
\r
5295 <p class=Verbatim> assert (x != NULL);</p>
\r
5297 <p class=Verbatim> *x = 3;</p>
\r
5299 <p class=TextFontCX>is checked without reporting
\r
5300 a false warning, since the <span class=Annot><span style='font-size:10.0pt'>noreturnwhenwfalse
\r
5301 </span></span>annotation on <span class=CodeText><span style='font-size:10.0pt'>assert</span></span>
\r
5302 means the deference of <span class=CodeText><span style='font-size:10.0pt'>x</span></span>
\r
5303 is not reached is <span class=CodeText><span style='font-size:10.0pt'>x != NULL</span></span>
\r
5306 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974988"></a><a
\r
5307 name="_Ref350066608">8.2<span style='font:7.0pt "Times New Roman"'>
\r
5308 </span>Undefined </a>Behavior</h2>
\r
5310 <p class=TextFontCX>The order in which side
\r
5311 effects take place in a C program is not entirely defined by the code. Certain
\r
5312 execution points are known as <i>sequence points</i>
\97 a function call (after the arguments have been evaluated), the end of a full expression (an initializer, expression in an expression statement, the control
\r
5313 expression of an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>,
\r
5314 <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>, <span
\r
5315 class=CodeText><span style='font-size:10.0pt'>while</span></span> or <span
\r
5316 class=CodeText><span style='font-size:10.0pt'>do</span></span> statement, each
\r
5317 expression of a <span class=CodeText><span style='font-size:10.0pt'>for</span></span>
\r
5318 statement, and the expression in a <span class=CodeText><span style='font-size:
\r
5319 10.0pt'>return</span></span> statement), and after the first operand or a <span
\r
5320 class=CodeText><span style='font-size:10.0pt'>&&</span></span>, <span
\r
5321 class=CodeText><span style='font-size:10.0pt'>||</span></span>, <span
\r
5322 class=CodeText><span style='font-size:10.0pt'>?</span></span> or <span
\r
5323 class=CodeText><span style='font-size:10.0pt'>,</span></span> operand.</p>
\r
5325 <p class=TextFontCX> </p>
\r
5327 <p class=TextFontCX>All side effects before a
\r
5328 sequence point must be complete before the sequence point, and no evaluations
\r
5329 after the sequence point shall have taken place. Between sequence points, side
\r
5330 effects and evaluations may take place in any order. Hence, the order in which
\r
5331 expressions or arguments are evaluated is not specified. Compilers are free to
\r
5332 evaluate function arguments and parts of expressions (that do not contain
\r
5333 sequence points) in any order. The behavior of code is undefined if it uses a
\r
5334 value that is modified by another expression that is not required to be
\r
5335 evaluated before or after the other use.</p>
\r
5337 <p class=TextFontCX> </p>
\r
5339 <p class=TextFontCX>Splint detects instances
\r
5340 where undetermined order of evaluation produces undefined behavior. If modifies clauses and globals lists are used, this checking is enabled in expressions
\r
5341 involving function calls. Evaluation order checking is controlled by the <span
\r
5342 class=Flag><span style='font-size:10.0pt'>eval-order</span></span> flag.</p>
\r
5347 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
5348 style='margin-left:13.05pt;border-collapse:collapse;
\r
5349 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
5351 <td valign=top style='border:solid black 1.5pt;
\r
5352 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
\r
5353 <p class=TextFontCX align=center
\r
5354 style='text-align:center'> <span class=Keyword><b><span
\r
5355 style='font-size:10.0pt;color:white'>order.c</span></b></span></p>
\r
5357 <td valign=top style='width:198.8pt;border-top:solid black 1.5pt;
\r
5358 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
5359 background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
\r
5360 <p class=TextFontCX align=center
\r
5361 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
5367 <td valign=top style='width:148.95pt;border:solid black 1.5pt;
\r
5368 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
5369 <p class=Verbatim>extern int glob;</p>
\r
5370 <p class=Verbatim> </p>
\r
5371 <p class=Verbatim>extern int mystery (void);</p>
\r
5372 <p class=Verbatim> </p>
\r
5373 <p class=Verbatim>extern int modglob (void)</p>
\r
5374 <p class=Verbatim> /*@globals glob@*/</p>
\r
5375 <p class=Verbatim> /*@modifies glob@*/;</p>
\r
5376 <p class=Verbatim> </p>
\r
5377 <p class=Verbatim>int f (int x, int y[])</p>
\r
5378 <p class=Verbatim>{</p>
\r
5379 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>11</span></span>
\r
5380 int i = x++ * x;</p>
\r
5381 <p class=Verbatim> </p>
\r
5382 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>13</span></span>
\r
5384 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>14</span></span>
\r
5385 i += modglob() * glob;</p>
\r
5386 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>15</span></span>
\r
5387 i += mystery() * glob;</p>
\r
5388 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>16</span></span>
\r
5390 <p class=Verbatim>}</p>
\r
5392 <td valign=top style='width:275.4pt;border-top:none;border-left:
\r
5393 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
5394 padding:0in 5.4pt 0in 5.4pt'>
\r
5395 <p class=lclintrun>> splint order.c +evalorderuncon </p>
\r
5396 <p class=lclintrun>order.c:11: Expression has undefined behavior (value of</p>
\r
5397 <p class=lclintrun> right operand modified by left operand): x++ * x</p>
\r
5398 <p class=lclintrun>order.c:13: Expression has undefined behavior (left
\r
5400 <p class=lclintrun> uses i, modified by right operand): y[i] = i++</p>
\r
5401 <p class=lclintrun>order.c:14: Expression has undefined behavior (value of</p>
\r
5402 <p class=lclintrun> right operand modified by left operand):</p>
\r
5403 <p class=lclintrun> modglob() * glob</p>
\r
5404 <p class=lclintrun>order.c:15: Expression has undefined behavior</p>
\r
5405 <p class=lclintrun> (unconstrained function mystery used in left operand</p>
\r
5406 <p class=lclintrun> may set global variable glob used in right operand):</p>
\r
5407 <p class=lclintrun> mystery() * glob</p>
\r
5408 <p class=TextFontCX align=left
\r
5409 style='text-align:left'><i> </i></p>
\r
5410 <p class=TextFontCX align=left
\r
5411 style='text-align:left;page-break-after:avoid'><i>The warning for line 14 is
\r
5412 reported because the modifies clause of </i><span class=CodeText><span
\r
5413 style='font-size:10.0pt'>modglob</span></span><i> indicated that it may
\r
5414 modify </i><span class=CodeText><span style='font-size:10.0pt'>glob</span></span><i>.
\r
5415 The behavior is undefined since we don
\92t know if </i><span class=CodeText><span
\r
5416 style='font-size:10.0pt'>glob</span></span><i> is evaluated before, after or
\r
5417 during the</i><i> modification. The line 15 warning would not be reported
\r
5418 without </i><span class=Flag><span style='font-size:10.0pt'>+evalorderuncon</span></span><i>.</i></p>
\r
5423 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
5425 <td valign=top style='padding-top:0in;padding-right:
\r
5426 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
5427 <p class=MsoCaption><a name="_Toc534824620"></a><a name="_Ref534823183">Figure
\r
5428 16</a>. Evaluation Order</p>
\r
5436 <p class=TextFontCX> </p>
\r
5438 <p class=TextFontCX>When checking systems without
\r
5439 modifies and globals information (see Section 7), evaluation order checking may report errors when unconstrained functions are called in procedure arguments. Since Splint has no annotations to constrain what these functions may modify, it cannot be guaranteed that
\r
5440 the evaluation order is defined if another argument calls an unconstrained
\r
5441 function or uses a global variable or storage reachable from a parameter to the
\r
5442 unconstrained function. Its best to add modifies and globals clauses to
\r
5443 constrain the unconstrained functions in ways that eliminate the possibility of
\r
5444 undefined behavior. For large legacy systems, this may require too much
\r
5445 effort. Instead, the <span class=Flag><span style='font-size:10.0pt'>‑eval-order-uncon</span></span>
\r
5446 flag may be used to prevent reporting of undefined behavior due to the order of
\r
5447 evaluation of unconstrained functions. Figure 16 illustrates detection of undefined behavior.</p>
\r
5450 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
5451 style='margin-left:18.9pt;border-collapse:collapse;margin-left:-2.25pt;
\r
5452 margin-right:-2.25pt'>
\r
5454 <td valign=top style='border:solid black 1.5pt;
\r
5455 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5456 <p class=TextFontCX align=center
\r
5457 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
5458 color:white'>loop.c</span></b></span></p>
\r
5460 <td valign=top style='border-top:solid black 1.5pt;
\r
5461 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
5462 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5463 <p class=TextFontCX align=center
\r
5464 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
5467 <tr style='height:143.1pt'>
\r
5468 <td valign=top style='border:solid black 1.5pt;
\r
5469 border-top:none;padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>
\r
5470 <p class=Verbatim>extern int glob1, glob2;</p>
\r
5471 <p class=Verbatim>extern int f (void)</p>
\r
5472 <p class=Verbatim> /*@globals glob1@*/</p>
\r
5473 <p class=Verbatim> /*@modifies nothing@*/;</p>
\r
5474 <p class=Verbatim>extern void g (void)</p>
\r
5475 <p class=Verbatim> /*@modifies glob2@*/ ;</p>
\r
5476 <p class=Verbatim>extern void h (void) ;</p>
\r
5477 <p class=Verbatim> </p>
\r
5478 <p class=Verbatim>void upto (int x)</p>
\r
5479 <p class=Verbatim>{</p>
\r
5480 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>14</span></span>
\r
5481 while (x > f ()) g();</p>
\r
5482 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>15</span></span>
\r
5483 while (f () < 3) h();</p>
\r
5484 <p class=Verbatim>}</p>
\r
5486 <td valign=top style='border-top:none;border-left:
\r
5487 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
5488 padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>
\r
5489 <p class=lclintrun>> splint loop.c +infloopsuncon </p>
\r
5490 <p class=lclintrun>loop.c:14: Suspected infinite loop. No value used in</p>
\r
5491 <p class=lclintrun> loop test (x, glob1) is modified by test or loop</p>
\r
5492 <p class=lclintrun> body.</p>
\r
5493 <p class=lclintrun>loop.c:15: Suspected infinite loop. No condition</p>
\r
5494 <p class=lclintrun> values modified. Modification possible through</p>
\r
5495 <p class=lclintrun> unconstrained calls: h </p>
\r
5496 <p class=TextFontCX style='page-break-after:
\r
5497 avoid'><i>An error is reported for line 14 since the only value modified by
\r
5498 <br>the loop test or body if </i><span class=CodeText><span style='font-size:
\r
5499 10.0pt'>glob2</span></span><i> and the value of the loop test <br>does not depend
\r
5500 on </i><span class=CodeText><span style='font-size:10.0pt'>glob2</span></span><i>.
\r
5501 The error for line 15 would not be<br> reported without </i><span class=Flag><span
\r
5502 style='font-size:10.0pt'>+infloopsuncon</span></span><i>.</i></p>
\r
5508 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
5510 <td valign=top style='padding-top:0in;padding-right:
\r
5511 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
5512 <p class=MsoCaption><a name="_Toc534824621"></a><a name="_Ref534823256">Figure
\r
5513 17</a>. Infinite Loops</p>
\r
5520 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974989"></a><a
\r
5521 name="_Ref344892701"></a><a name="_Toc344355430">8.3<span style='font:7.0pt "Times New Roman"'>
\r
5524 </span>Problematic Control Structures</a></h2>
\r
5526 <p class=TextFontCX>A number of control structures that are syntactically legal may indicate likely bugs in programs.
\r
5527 Splint can detect errors involving likely infinite loops (Section 8.3.1), fall through cases and missing cases in <span class=CodeText><span
\r
5528 style='font-size:10.0pt'>switch</span></span> statements (Section 8.3.2), <span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
5529 statements within deeply nested loops or switches (Section 8.3.3), clauses of <span
\r
5530 class=CodeText><span style='font-size:10.0pt'>if</span></span>, <span
\r
5531 class=CodeText><span style='font-size:10.0pt'>while</span></span> or <span
\r
5532 class=CodeText><span style='font-size:10.0pt'>for</span></span> statements that
\r
5533 are empty statements or unblocked single statements (Section 8.3.4) and
\r
5534 incomplete if-else logic (Section 8.3.5). Although any of these may appear in
\r
5535 a correct program, depending on the programming style used they may indicate
\r
5536 likely bugs or style violations that should be detected and eliminated.</p>
\r
5538 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974990"></a><a
\r
5539 name="_Ref344810086">8.3.1<span style='font:7.0pt "Times New Roman"'>
\r
5540 </span>Likely Infinite Loops</a></h3>
\r
5542 <p class=TextFontCX>Splint reports an error if it
\r
5543 detects a loop that appears to be infinite. An error is reported for a loop
\r
5544 that does not modify any value used in its condition test inside the body of
\r
5545 the loop or in the condition test itself. This checking is enhanced by
\r
5546 modifies clauses and globals lists (see Section 7) since they <a
\r
5547 name="_Ref344818734">provide more information about what global variable may be
\r
5548 used in the condition test and what values may be modified by function calls in
\r
5549 the loop body.</a></p>
\r
5551 <p class=TextFontCX> </p>
\r
5553 <p class=TextFontCX>Figure 17 shows examples of infinite loops detected by Splint. An error is reported for the loop in line 14, since neither of the values used in the loop condition (<span class=CodeText><span style='font-size:10.0pt'>x</span></span>
\r
5554 directly and <span class=CodeText><span style='font-size:10.0pt'>glob1</span></span>
\r
5555 through the call to <span class=CodeText><span style='font-size:10.0pt'>f</span></span>)
\r
5556 is modified by the body of the loop. If the declaration of <span
\r
5557 class=CodeText><span style='font-size:10.0pt'>g</span></span> is changed to
\r
5558 include <span class=CodeText><span style='font-size:10.0pt'>glob1</span></span>
\r
5559 in the modifies clause no error is reported. (In this example, if we assume
\r
5560 the annotations are correct, then the programmer has probably called the wrong
\r
5561 function in the loop body. This isn
\92t surprising, given the horrible choices
\r
5562 of function and variable names!)</p>
\r
5564 <p class=TextFontCX> </p>
\r
5566 <p class=TextFontCX>If an unconstrained function
\r
5567 is called within the loop body, Splint will assume that it modifies a value
\r
5568 used in the condition test and not report an infinite loop error, unless <span
\r
5569 class=Flag><span style='font-size:10.0pt'>infloopsuncon</span></span> is on. If <span class=Flag><span style='font-size:10.0pt'>infloopsuncon</span></span>
\r
5570 is on, Splint will report infinite loop errors for loops where there is no
\r
5571 explicit modification of a value used in the condition test, but where they may
\r
5572 be an undetected modification through a call to an unconstrained function
\r
5573 (e.g., line 12 in Figure 17). </p>
\r
5575 <p class=TextFontCX> </p>
\r
5577 <p class=TextFontCX> </p>
\r
5579 <p class=TextFontCX align=center
\r
5580 style='text-align:center'><span style='font-size:10.0pt'> </span></p>
\r
5582 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974991"></a><a
\r
5583 name="_Ref349899747"></a><a name="_Ref345591205">8.3.2<span style='font:7.0pt "Times New Roman"'>
\r
5584 </span>Switches</a></h3>
\r
5586 <p class=TextFontCX>The automatic fall through of
\r
5587 C switch statements is almost never the intended behavior.<a
\r
5588 href="#_ftn10" name="_ftnref10" title=""><span class=MsoFootnoteReference><span
\r
5589 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>
\r
5590 Splint detects <span class=CodeText><span style='font-size:10.0pt'>case</span></span>
\r
5591 statements with code that may fall through to the next <span class=CodeText><span
\r
5592 style='font-size:10.0pt'>case</span></span>. The <span class=Flag><span
\r
5593 style='font-size:10.0pt'>casebreak</span></span> flag controls reporting of fall through cases. A single fall through case may be
\r
5594 marked by preceding the <span class=CodeText><span style='font-size:10.0pt'>case</span></span>
\r
5595 keyword with <span class=Annot><span style='font-size:10.0pt'>/*@fallthrough@*/</span></span> to indicate explicitly that execution falls through to this case. See Figure 18 for an example.</p>
\r
5597 <p class=TextFontCX> </p>
\r
5599 <p class=TextFontCX>For switches on <span
\r
5600 class=CodeText><span style='font-size:10.0pt'>enum</span></span> types, Splint
\r
5601 reports an error if a member of the enumerator does not appear as a case in the
\r
5602 switch body (and there is no <span class=CodeText><span style='font-size:10.0pt'>default</span></span>
\r
5603 case). (Controlled by <span class=Flag><span style='font-size:10.0pt'>misscase</span></span>.)</p>
\r
5608 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
5609 style='margin-left:.2in;border-collapse:collapse;margin-left:-2.25pt;
\r
5610 margin-right:-2.25pt'>
\r
5612 <td valign=top style='width:3.0in;border:solid black 1.5pt;
\r
5613 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5614 <p class=TextFontCX align=center
\r
5615 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
5616 color:white'>switch.c</span></b></span></p>
\r
5618 <td valign=top style='border-top:solid black 1.5pt;
\r
5619 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
5620 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5621 <p class=TextFontCX align=center
\r
5622 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
5626 <td valign=top style='border:solid black 1.5pt;
\r
5627 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
5628 <p class=Verbatim>typedef enum {</p>
\r
5629 <p class=Verbatim> YES, NO, DEFINITELY,</p>
\r
5630 <p class=Verbatim> PROBABLY, MAYBE } ynm;</p>
\r
5631 <p class=Verbatim>void decide (ynm y)</p>
\r
5632 <p class=Verbatim>{</p>
\r
5633 <p class=Verbatim> switch (y)</p>
\r
5634 <p class=Verbatim> {</p>
\r
5635 <p class=Verbatim> case PROBABLY:</p>
\r
5636 <p class=Verbatim> case NO: printf ("No!");</p>
\r
5637 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10 </span></span> case
\r
5638 MAYBE: printf ("Maybe");</p>
\r
5639 <p class=Verbatim> /*@fallthrough@*/</p>
\r
5640 <p class=Verbatim> case YES: printf ("Yes!");</p>
\r
5641 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>13 </span></span> }</p>
\r
5642 <p class=Verbatim>}</p>
\r
5644 <td valign=top style='border-top:none;border-left:
\r
5645 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
5646 padding:0in 5.4pt 0in 5.4pt'>
\r
5647 <p class=lclintrun>> splint switch.c</p>
\r
5648 <p class=lclintrun>switch.c:10: Fall through case (no preceding break)</p>
\r
5649 <p class=lclintrun>switch.c:13: Missing case in switch: DEFINITELY</p>
\r
5650 <p class=TextFontCX> </p>
\r
5651 <p class=MsoCaption align=left style='text-align:left'><i><span
\r
5652 style='font-weight:normal'>No fall through error is reported for the </span></i><span
\r
5653 class=CodeText><span style='font-weight:normal'>NO</span></span><i><span
\r
5654 style='font-weight:normal'> case,<br> since there are no statements associated
\r
5655 with the<br> previous case. </span></i></p>
\r
5656 <p class=TextFontCX style='page-break-after:
\r
5657 avoid'><i>The </i><span class=Annot><span style='font-size:10.0pt'>/*@fallthrough@*/</span></span><i>
\r
5658 comment prevents <br>a message from being produced for the<br> </i><span class=Annot><span
\r
5659 style='font-size:10.0pt'>YES</span></span><i> case.</i></p>
\r
5664 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
5666 <td valign=top style='padding-top:0in;padding-right:
\r
5667 9.0pt;padding-bottom:0in;padding-left:9.0pt'>
\r
5668 <p class=MsoCaption><a name="_Toc344355431"></a><a name="_Ref344881581"></a><a
\r
5669 name="_Toc534824622"></a><a name="_Ref534823308">Figure 18</a>. Switch Cases</p>
\r
5675 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974992"></a><a
\r
5676 name="_Ref534971227">8.3.3<span style='font:7.0pt "Times New Roman"'>
\r
5677 </span>Deep Breaks</a></h3>
\r
5679 <p class=TextFontCX>There is no syntax provided
\r
5680 by C (other than <span class=CodeText><span style='font-size:10.0pt'>goto</span></span>)
\r
5681 for breaking out of a nested loop. All <span class=CodeText><span
\r
5682 style='font-size:10.0pt'>break</span></span> and <span class=CodeText><span
\r
5683 style='font-size:10.0pt'>continue</span></span> statements act only on the
\r
5684 innermost surrounding loop or switch. This can lead to serious problems<a
\r
5685 href="#_ftn11" name="_ftnref11" title=""><span class=MsoFootnoteReference><span
\r
5686 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>
\r
5687 when a programmer intends to break the outer loop or switch instead. Splint
\r
5688 optionally reports warnings for <span class=CodeText><span style='font-size:
\r
5689 10.0pt'>break</span></span> and <span class=CodeText><span style='font-size:
\r
5690 10.0pt'>continue</span></span> statements in nested contexts.</p>
\r
5692 <p class=beforelist> </p>
\r
5694 <p class=beforelist>Four types of <span class=CodeText><span style='font-size:
\r
5695 10.0pt'>break</span></span> warnings are reported:</p>
\r
5697 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
5698 style='font:7.0pt "Times New Roman"'> </span></span><span
\r
5699 class=CodeText><span style='font-size:10.0pt'>break</span></span> inside a loop
\r
5700 (<span class=CodeText><span style='font-size:10.0pt'>while</span></span> or <span
\r
5701 class=CodeText><span style='font-size:10.0pt'>for</span></span>) that is inside
\r
5702 a loop. Controlled by <span class=Flag><span style='font-size:10.0pt'>looploopbreak</span></span>. To indicate that a <span
\r
5703 class=CodeText><span style='font-size:10.0pt'>break</span></span> is inside an
\r
5704 inner loop, precede the <span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
5705 by <a href="mailto:/*@innerbreak@*/"><span class=Annot><span style='font-size:
\r
5706 10.0pt'>/*@innerbreak@*/</span></span></a>.</p>
\r
5708 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
5709 style='font:7.0pt "Times New Roman"'> </span></span><span
\r
5710 class=CodeText><span style='font-size:10.0pt'>break</span></span> inside a loop
\r
5711 that is inside a <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>
\r
5712 statement. Controlled by <span class=Flag><span style='font-size:10.0pt'>switchloopbreak</span></span>. To mark the <span
\r
5713 class=CodeText><span style='font-size:10.0pt'>break</span></span> as a loop
\r
5714 break, precede the <span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
5715 by <span class=Annot><span style='font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>
\r
5717 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
5718 style='font:7.0pt "Times New Roman"'> </span></span><span
\r
5719 class=CodeText><span style='font-size:10.0pt'>break</span></span> inside a <span
\r
5720 class=CodeText><span style='font-size:10.0pt'>switch</span></span> statement that
\r
5721 is inside a loop. Controlled by <span class=Flag><span style='font-size:10.0pt'>loopswitchbreak</span></span>. To mark the <span
\r
5722 class=CodeText><span style='font-size:10.0pt'>break</span></span> as a switch
\r
5723 break, precede the <span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
5724 by <span class=Annot><span style='font-size:10.0pt'>/*@switchbreak@*/</span></span>.</p>
\r
5726 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
5727 style='font:7.0pt "Times New Roman"'> </span></span><span
\r
5728 class=CodeText><span style='font-size:10.0pt'>break</span></span> inside a <span
\r
5729 class=CodeText><span style='font-size:10.0pt'>switch</span></span> inside
\r
5730 another <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>.
\r
5731 Controlled by <span class=Flag><span style='font-size:10.0pt'>switchswitchbreak</span></span>. To indicate that the <span
\r
5732 class=CodeText><span style='font-size:10.0pt'>break</span></span> is for the
\r
5733 inner switch, use <span class=Annot><span style='font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>
\r
5735 <p class=afterlist>Since <span class=CodeText><span style='font-size:10.0pt'>continue</span></span>
\r
5736 only makes sense within loops, warnings are only reported for <span
\r
5737 class=CodeText><span style='font-size:10.0pt'>continue</span></span> statements
\r
5738 within nested loops. (Controlled by <span class=Flag><span style='font-size:
\r
5739 10.0pt'>looploopcontinue</span></span>.) A safe inner <span
\r
5740 class=CodeText><span style='font-size:10.0pt'>continue</span></span> may be
\r
5741 preceded by <span class=Annot><span style='font-size:10.0pt'>/*@innercontinue@*/</span></span> to suppress error messages locally. The <span
\r
5742 class=Flag><span style='font-size:10.0pt'>deepbreak</span></span> flag sets all nested break and continue checking flags.</p>
\r
5744 <p class=TextFontCX> </p>
\r
5746 <p class=TextFontCX>Splint warns if the marker
\r
5747 preceding a <span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
5748 is not consistent with its placement. A warning results if <span class=Annot><span
\r
5749 style='font-size:10.0pt'>innerbreak</span></span> precedes a <span
\r
5750 class=CodeText><span style='font-size:10.0pt'>break</span></span> that is not
\r
5751 breaking an inner loop, <span class=Annot><span style='font-size:10.0pt'>switchbreak</span></span>
\r
5752 precedes a <span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
5753 that is not breaking a switch, or <span class=Annot><span style='font-size:
\r
5754 10.0pt'>loopbreak</span></span> precedes a <span class=CodeText><span
\r
5755 style='font-size:10.0pt'>break</span></span> that is not breaking a loop.</p>
\r
5757 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974993"></a><a
\r
5758 name="_Ref347246280">8.3.4<span style='font:7.0pt "Times New Roman"'>
\r
5759 </span></a>Loop and If Bodies</h3>
\r
5761 <p class=beforelist>An empty statement after an <span class=CodeText><span
\r
5762 style='font-size:10.0pt'>if</span></span>, <span class=CodeText><span
\r
5763 style='font-size:10.0pt'>while</span></span> or <span class=CodeText><span
\r
5764 style='font-size:10.0pt'>for</span></span> often indicates a potential bug. A
\r
5765 single statement (i.e., not a compound block) after an <span class=CodeText><span
\r
5766 style='font-size:10.0pt'>if</span></span>, <span class=CodeText><span
\r
5767 style='font-size:10.0pt'>while</span></span> or <span class=CodeText><span
\r
5768 style='font-size:10.0pt'>for</span></span> is not likely to indicate a bug, but
\r
5769 make the code harder to read and edit. Splint can report errors for if or loop
\r
5770 statements with empty bodies or bodies that are not compound statements.
\r
5771 Separate flags control checking for statements following an <span
\r
5772 class=CodeText><span style='font-size:10.0pt'>if</span></span>, <span
\r
5773 class=CodeText><span style='font-size:10.0pt'>while</span></span> or <span
\r
5774 class=CodeText><span style='font-size:10.0pt'>for</span></span>:</p>
\r
5776 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
5777 style='font:7.0pt "Times New Roman"'> </span></span><span
\r
5778 class=Flag><span style='font-size:10.0pt'>[if</span></span>,<span class=Flag><span
\r
5779 style='font-size:10.0pt'> while</span></span>,<span class=Flag><span
\r
5780 style='font-size:10.0pt'> for]empty</span></span>
\97 report errors for empty
\r
5781 bodies (e.g., <span class=CodeText><span style='font-size:10.0pt'>if (x > 3)
\r
5782 ;</span></span> )</p>
\r
5784 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
5785 style='font:7.0pt "Times New Roman"'> </span></span><span
\r
5786 class=Flag><span style='font-size:10.0pt'>[if</span></span>,<span class=Flag><span
\r
5787 style='font-size:10.0pt'> while</span></span>,<span class=Flag><span
\r
5788 style='font-size:10.0pt'> for]block</span></span>
\97 report errors for non-block
\r
5789 bodies (e.g., <span class=CodeText><span style='font-size:10.0pt'>if (x > 3)
\r
5790 x++;</span></span>)</p>
\r
5792 <p class=MsoListBullet style='margin-left:0in;text-indent:0in'><span
\r
5793 class=Keyword><span style='font-size:10.0pt'> </span></span></p>
\r
5795 <p class=afterlist>The <span class=CodeText><span style='font-size:10.0pt'>if</span></span>
\r
5796 statement checks also apply to the body of the <span class=CodeText><span
\r
5797 style='font-size:10.0pt'>else</span></span> clause. No <span class=Flag><span
\r
5798 style='font-size:10.0pt'>ifblock</span></span> warning is reported if the body
\r
5799 of the <span class=CodeText><span style='font-size:10.0pt'>else</span></span>
\r
5800 clause is an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>
\r
5801 statement, to allow conventional <span class=CodeText><span style='font-size:
\r
5802 10.0pt'>else if</span></span> chains. </p>
\r
5804 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974994"></a><a
\r
5805 name="_Ref347246283">8.3.5<span style='font:7.0pt "Times New Roman"'>
\r
5806 </span>Complete Logic</a></h3>
\r
5808 <p class=beforelist>Although it may be perfectly reasonable in many contexts,
\r
5809 an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>-<span
\r
5810 class=CodeText><span style='font-size:10.0pt'>else</span></span> chain with no
\r
5811 final <span class=CodeText><span style='font-size:10.0pt'>else</span></span>
\r
5812 may indicate missing logic or forgetting to check error cases. If <span
\r
5813 class=Flag><span style='font-size:10.0pt'>elseif-complete</span></span> is on, Splint warns when an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>
\r
5814 statement that is the body of an <span class=CodeText><span style='font-size:
\r
5815 10.0pt'>else</span></span> clause does not have a matching <span
\r
5816 class=CodeText><span style='font-size:10.0pt'>else</span></span> clause. For
\r
5817 example, the code,</p>
\r
5819 <p class=Verbatim> if (x == 0) { return "nil"; }</p>
\r
5821 <p class=Verbatim> else if (x == 1) { return "many"; }</p>
\r
5823 <p class=afterlist>results in a warning since the second <span class=CodeText><span
\r
5824 style='font-size:10.0pt'>if</span></span> has no matching <span class=CodeText><span
\r
5825 style='font-size:10.0pt'>else</span></span> branch.</p>
\r
5827 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974995"></a><a
\r
5828 name="_Ref344892802">8.4<span style='font:7.0pt "Times New Roman"'>
\r
5829 </span>Suspicious Statements</a></h2>
\r
5831 <p class=TextFontCX>Splint detects errors involving
\r
5832 statements with no apparent effects (Section 8.4.1) and statements that ignore
\r
5833 the result of a called function (Section 8.4.2). </p>
\r
5835 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974996"></a><a
\r
5836 name="_Ref347247824">8.4.1<span style='font:7.0pt "Times New Roman"'>
\r
5837 </span>Statements with No Effects</a></h3>
\r
5839 <p class=TextFontCX>Splint can report errors for
\r
5840 statements that have no effect. (Controlled by <span class=Flag><span
\r
5841 style='font-size:10.0pt'>no-effect</span></span>.) Because of modifies clauses, Splint can detect more errors than traditional checkers. Unless the <span class=Flag><span style='font-size:10.0pt'>no-effect-uncon</span></span> flag is on, errors are not reported for statements that involve calls to unconstrained functions since the unconstrained function may cause a modification. Figure 19 shows examples of Splint
\92s no effect checking.</p>
\r
5844 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
5845 style='margin-left:5.4pt;border-collapse:collapse;
\r
5846 margin-left:-2.25pt;margin-right:-2.25pt'>
\r
5848 <td valign=top style='border:solid black 1.5pt;
\r
5849 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5850 <p class=TextFontCX align=center
\r
5851 style='text-align:center'><a name="_Ref344893305"></a><a name="_Ref344874935"><span
\r
5852 class=StyleKeywordBold><span style='font-size:10.0pt'>noeffect.c</span></span></a></p>
\r
5854 <td valign=top style='border-top:solid black 1.5pt;
\r
5855 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
5856 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5857 <p class=TextFontCX align=center
\r
5858 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
5862 <td valign=top style='border:solid black 1.5pt;
\r
5863 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
5864 <p class=Verbatim>extern void </p>
\r
5865 <p class=Verbatim> nomodcall (int *x) /*@*/;</p>
\r
5866 <p class=IndentText><i>Recall /*@*/ is shorthand for<br> modifies nothing and use<br>
\r
5867 no globals.</i></p>
\r
5868 <p class=Verbatim>extern void mysterycall (int *x);</p>
\r
5869 <p class=Verbatim> </p>
\r
5870 <p class=Verbatim>int noeffect (int *x, int y)</p>
\r
5871 <p class=Verbatim>{</p>
\r
5872 <p class=Verbatim> y == *x;</p>
\r
5873 <p class=Verbatim> nomodcall (x);</p>
\r
5874 <p class=Verbatim> mysterycall (x);</p>
\r
5875 <p class=Verbatim> return *x;</p>
\r
5876 <p class=Verbatim>}</p>
\r
5878 <td valign=top style='border-top:none;border-left:
\r
5879 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
5880 padding:0in 5.4pt 0in 5.4pt'>
\r
5881 <p class=lclintrun>> splint noeffect.c +noeffectuncon</p>
\r
5882 <p class=lclintrun>noeffect.c:6: Statement has no effect: y == *x</p>
\r
5883 <p class=lclintrun>noeffect.c:7: Statement has no effect: nomodcall(x)</p>
\r
5884 <p class=lclintrun>noeffect.c:8: Statement has no effect (possible</p>
\r
5885 <p class=lclintrun> undetected modification through call to</p>
\r
5886 <p class=lclintrun> unconstrained function mysterycall):</p>
\r
5887 <p class=lclintrun> mysterycall(x)</p>
\r
5888 <p class=IndentText><i> </i></p>
\r
5889 <p class=IndentText style='page-break-after:avoid'><i>The warning for line 8
\r
5890 would not be<br>reported without</i> <span class=Flag><span style='font-size:
\r
5891 10.0pt'>+noeffectuncon</span></span>.</p>
\r
5896 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
5898 <td valign=top style='padding-top:0in;padding-right:
\r
5899 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
5900 <p class=MsoCaption><a name="_Ref534813977"></a><a name="_Toc534824623"></a><a
\r
5901 name="_Ref534823396">Figure 19</a>. Statements with No Effect</p>
\r
5907 <h3 style='margin-left:0in;text-indent:0in'><a name="_Ref534978820"></a><a
\r
5908 name="_Toc534974997">8.4.2<span style='font:7.0pt "Times New Roman"'>
\r
5909 </span>Ignored Return Values</a></h3>
\r
5911 <p class=TextFontCX>Splint reports an error when a return value is ignored. Checking may be controlled based on the type of
\r
5912 the return value: <span class=Flag><span style='font-size:10.0pt'>ret-val-int</span></span>
\r
5913 controls reporting of ignored return values of type <span class=Keyword><span
\r
5914 style='font-size:10.0pt'>int</span></span>, and <span class=Flag><span
\r
5915 style='font-size:10.0pt'>ret-val-bool</span></span> for return values of type <span class=Keyword><span style='font-size:10.0pt'>bool</span></span>,
\r
5916 and <span class=Flag><span style='font-size:10.0pt'>ret-val-others</span></span> for all other types. A function statement may be cast to <span class=Keyword><span
\r
5917 style='font-size:10.0pt'>void</span></span> to prevent this error from being
\r
5920 <p class=TextFontCX> </p>
\r
5922 <p class=TextFontCX>Alternate types (Section 4.4) can be used to declare functions that return values that may safely
\r
5923 be ignored by declaring the result type to alternately be <span class=Keyword><span
\r
5924 style='font-size:10.0pt'>void</span></span>. Several functions in the standard
\r
5925 library are specified to alternately return <span class=Keyword><span
\r
5926 style='font-size:10.0pt'>void</span></span> to prevent ignored return value
\r
5927 errors for standard library functions (e.g., <span class=Keyword><span
\r
5928 style='font-size:10.0pt'>strcpy</span></span>) where the result may be safely
\r
5929 ignored (see Section 14.1). Figure 20 shows examples of ignored return value errors reported by Splint.</p>
\r
5931 <p class=MsoNormal align=left style='text-align:left;background:white'><span
\r
5932 style='font-size:10.0pt'> </span></p>
\r
5935 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
5936 style='margin-left:9.9pt;border-collapse:collapse'>
\r
5938 <td valign=top style='border:solid black 1.5pt;
\r
5939 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5940 <p class=TextFontCX align=center
\r
5941 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
5942 color:white'>ignore.c</span></b></span></p>
\r
5944 <td valign=top style='border-top:solid black 1.5pt;
\r
5945 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
5946 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
5947 <p class=TextFontCX align=center
\r
5948 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
5952 <td valign=top style='border:solid black 1.5pt;
\r
5953 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
5954 <p class=Verbatim># include
\93bool.h
\94</p>
\r
5955 <p class=Verbatim>extern int fi (void);</p>
\r
5956 <p class=Verbatim>extern bool fb (void);</p>
\r
5957 <p class=Verbatim>extern int /*@alt void@*/</p>
\r
5958 <p class=Verbatim> fv (void);</p>
\r
5959 <p class=Verbatim> </p>
\r
5960 <p class=Verbatim>int ignore (void)</p>
\r
5961 <p class=Verbatim>{</p>
\r
5962 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 8</span></span>
\r
5964 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 9</span></span>
\r
5966 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10</span></span>
\r
5968 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>11</span></span>
\r
5970 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>12</span></span>
\r
5972 <p class=Verbatim>}</p>
\r
5974 <td valign=top style='border-top:none;border-left:
\r
5975 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
5976 padding:0in 5.4pt 0in 5.4pt'>
\r
5977 <p class=lclintrun>> splint ignore.c</p>
\r
5978 <p class=lclintrun> </p>
\r
5979 <p class=lclintrun>ignore.c:8: Return value (type int) ignored: fi()</p>
\r
5980 <p class=lclintrun>ignore.c:10: Return value (type bool) ignored: fb()</p>
\r
5981 <p class=lclintrun> </p>
\r
5982 <p class=MsoNormal style='background:white'><i><span style='font-size:10.0pt'>The
\r
5983 message for line 8 would not be reported if </span></i><span class=Flag><span
\r
5984 style='font-size:10.0pt'>‑retvalint</span></span><i><span
\r
5985 style='font-size:10.0pt'> </span></i><i><span
\r
5986 style='font-size:10.0pt'>is set;<br> for line 10, if </span></i><span class=Flag><span
\r
5987 style='font-size:10.0pt'>‑retvalbool</span></span><i><span
\r
5988 style='font-size:10.0pt'> </span></i><i><span
\r
5989 style='font-size:10.0pt'>is set. </span></i></p>
\r
5990 <p class=MsoNormal style='background:white'><i><span style='font-size:10.0pt'> </span></i></p>
\r
5991 <p class=MsoNormal style='background:white'><i><span style='font-size:10.0pt'> No
\r
5992 message is reported for line 9 because the result is cast to </span></i><span
\r
5993 class=CodeText><span style='font-size:10.0pt'>void</span></span><i><span
\r
5994 style='font-size:10.0pt'>,<br> and no message is reported for line 11 because </span></i><span
\r
5995 class=CodeText><span style='font-size:10.0pt'>fv</span></span><i><span
\r
5996 style='font-size:10.0pt'> is declared<br> to alternately return </span></i><span
\r
5997 class=CodeText><span style='font-size:10.0pt'>void</span></span><i><span
\r
5998 style='font-size:10.0pt'>.</span></i></p>
\r
5999 <p class=TextFontCX style='page-break-after:
\r
6007 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
6009 <td valign=top style='padding-top:0in;padding-right:
\r
6010 9.0pt;padding-bottom:0in;padding-left:9.0pt'>
\r
6011 <p class=MsoCaption><a name="_Toc534824624"></a><a name="_Ref534823436">Figure
\r
6012 20</a>. Ignored Return Values</p>
\r
6018 <p class=MsoNormal align=left style='text-align:left;background:white'><span
\r
6019 style='font-size:10.0pt'> </span></p>
\r
6021 <b><span style='font-size:16.0pt;font-family:"Times New Roman"'><br clear=all
\r
6022 style='page-break-before:always'>
\r
6025 <h1 style='margin-left:0in;text-indent:0in;page-break-before:auto'><a
\r
6026 name="_Toc534974998"></a><a name="_Ref534963019"></a><a name="_Ref534962975">9<span
\r
6027 style='font:7.0pt "Times New Roman"'>
\r
6028 </span>Buffer Sizes</a></h1>
\r
6030 <p class=TextFontCX>Buffer overflow errors are a
\r
6031 particularly dangerous type of bug in C programs. They are directly
\r
6032 responsible for about half of all security attacks [Larochelle01]. For
\r
6033 performance reasons, C does not perform run time bounds checking. Referencing
\r
6034 storage outside allocated regions can cause memory corruption and lead to
\r
6035 strange behavior. Moreover, they are particularly insidious because they can
\r
6036 go undetected in testing or normal use, but usually result in security critical
\r
6037 bugs. Reads beyond the end of a buffer can cause the program to leak
\r
6038 information. Writes beyond the end a buffer (buffer overflows) can usually be
\r
6039 exploited make the program run arbitrary code. Attackers can exploit these
\r
6040 programming bugs to replace the return address on the stack and place arbitrary
\r
6041 code in memory thereby gaining full access to the machine. Splint is able to
\r
6042 detect many memory bounds errors.<span class=MsoFootnoteReference> </span><a
\r
6043 href="#_ftn12" name="_ftnref12" title=""><span style='font-size:11.0pt;
\r
6044 font-family:"Times New Roman"'>[12]</span></a> </p>
\r
6046 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974999">9.1<span
\r
6047 style='font:7.0pt "Times New Roman"'>
\r
6048 </span>Checking Accesses</a></h2>
\r
6050 <p class=TextFontCX>Splint models blocks of
\r
6051 contiguous memory using two properties: <span class=Annot><span
\r
6052 style='font-size:10.0pt'>maxSet</span></span> and <span class=Annot><span
\r
6053 style='font-size:10.0pt'>maxRead</span></span>. Given a buffer <span
\r
6054 class=CodeText><i><span style='font-size:10.0pt'>b</span></i></span>, <span
\r
6055 class=Annot><span style='font-size:10.0pt'>maxSet(<i>b</i>)</span></span>
\r
6056 denotes the highest address beyond <span class=CodeText><i><span
\r
6057 style='font-size:10.0pt'>b</span></i></span> that can be safely used as an
\r
6058 lvalue. For the declaration <span class=CodeText><span style='font-size:10.0pt'>char
\r
6059 buf[MAXSIZE]</span></span> we have <span class=Annot><span style='font-size:
\r
6060 10.0pt'>maxSet(buf) </span></span><span class=CodeText><span style='font-size:
\r
6061 10.0pt'>= MAXSIZE - 1</span></span>. Similarly, <span class=Annot><span
\r
6062 style='font-size:10.0pt'>maxRead</span></span> denotes the highest index of a
\r
6063 buffer that can be safely used an rvalue. It is inappropriate to read an
\r
6064 uninitialized element or beyond the <span class=CodeText><span
\r
6065 style='font-size:10.0pt'>NUL</span></span> terminator of a null terminated
\r
6068 <p class=TextFontCX> </p>
\r
6070 <p class=TextFontCX>When a buffer is accessed as
\r
6071 an lvalue, Splint generates a precondition constraint involving the <span
\r
6072 class=Annot><span style='font-size:10.0pt'>maxSet</span></span> property. When
\r
6073 a buffer is accessed as an rvalue, Splint generates a precondition constraint
\r
6074 involving the <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span>
\r
6075 property. For the expression <span class=CodeText><span style='font-size:10.0pt'>*<i>ptr</i></span></span>,
\r
6076 Splint generates the constraints <span class=Annot><span style='font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>
\r
6077 <span class=CodeText><span style='font-size:10.0pt'>>= 0</span></span> or <span
\r
6078 class=Annot><span style='font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span> <span
\r
6079 class=CodeText><span style='font-size:10.0pt'>>= 0</span></span> depending
\r
6080 on whether <span class=CodeText><i><span style='font-size:10.0pt'>ptr</span></i></span>
\r
6081 is used as an lvalue or rvalue. Similarly, for accesses of the form <span
\r
6082 class=CodeText><span style='font-size:10.0pt'>ptr[i]</span></span>, splint
\r
6083 generates the constraints <span class=Annot><span style='font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>
\r
6084 <span class=CodeText><span style='font-size:10.0pt'>>= i</span></span> or <span
\r
6085 class=Annot><span style='font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span> <span
\r
6086 class=CodeText><span style='font-size:10.0pt'>>= i</span></span>. If <span
\r
6087 class=Flag><span style='font-size:10.0pt'>+boundswrite</span></span> is set, Splint
\r
6088 warns if it is unable to resolve a constraint involving <span class=Annot><span
\r
6089 style='font-size:10.0pt'>maxSet</span></span>. If <span class=Flag><span
\r
6090 style='font-size:10.0pt'>+boundsread</span></span> is set, Splint warns about
\r
6091 unresolved <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span>
\r
6092 constraints also.</p>
\r
6094 <p class=TextFontCX> </p>
\r
6096 <p class=TextFontCX>Splint generates
\r
6097 postconditions for statements to help resolve precondition constraints. When a
\r
6098 buffer is written to we know that an element of a buffer is initialized and is
\r
6099 safe to read. We generate the postcondition <span class=Annot><span
\r
6100 style='font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span> <span
\r
6101 class=CodeText><span style='font-size:10.0pt'>>= 0</span></span> if the
\r
6102 buffer is accessed using <span class=CodeText><span style='font-size:10.0pt'>*ptr</span></span>
\r
6103 or <span class=Annot><span style='font-size:10.0pt'>maxRead(ptr)</span></span> <span
\r
6104 class=CodeText><span style='font-size:10.0pt'>>= i</span></span> if the
\r
6105 buffer is accessed using <span class=CodeText><i><span style='font-size:10.0pt'>ptr</span></i></span><span
\r
6106 class=CodeText><span style='font-size:10.0pt'>[<i>i</i>]</span></span>. Splint
\r
6107 generates additional postconditions for a variety of C constructs. For
\r
6108 assignment statements Splint generates a postcondition equating the two
\r
6109 operands. Splint also generates post condition constraints for the <span
\r
6110 class=Annot><span style='font-size:10.0pt'>maxSet</span></span> value of fixed
\r
6113 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975000">9.2<span
\r
6114 style='font:7.0pt "Times New Roman"'>
\r
6115 </span>Annotating Buffer Sizes</a></h2>
\r
6117 <p class=TextFontCX>Function declarations may
\r
6118 include <span class=Annot><span style='font-size:10.0pt'>requires</span></span>
\r
6119 and <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
6120 clauses that specify assumptions about buffer sizes for function preconditions.
\r
6121 They are interpreted like <span class=Annot><span style='font-size:10.0pt'>requires</span></span>
\r
6122 and <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
6123 clauses for simple memory states (see Section 7.5) but can be more expressive. Where a function with a <span
\r
6124 class=Annot><span style='font-size:10.0pt'>requires</span></span> clause is
\r
6125 called, the call site must be checked to satisfy the constraints implied by the
\r
6126 <span class=Annot><span style='font-size:10.0pt'>requires</span></span> clause.
\r
6127 Similarly, an <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
6128 clause can be used to specify function post conditions. If the <span
\r
6129 class=Flag><span style='font-size:10.0pt'>+checkpost</span></span> flag is set,
\r
6130 Splint warns if it cannot verify that a function implementation satisfies its
\r
6131 declared postconditions.</p>
\r
6133 <p class=TextFontCX> </p>
\r
6135 <p class=TextFontCX>Constraints can contain
\r
6136 function parameters as well as global variables and integer constants. The
\r
6137 unary operators, <span class=Annot><span style='font-size:10.0pt'>maxSet</span></span>
\r
6138 and <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span> which
\r
6139 correspond to the properties described above are also supported. Multiple
\r
6140 predicates may be conjoined using <span class=CodeText><span style='font-size:
\r
6141 10.0pt'>/\</span></span>. </p>
\r
6143 <p class=TextFontCX> </p>
\r
6144 <p class=TextFontCX>For example, the standard
\r
6145 library annotates <span class=CodeText><span style='font-size:10.0pt'>strcpy</span></span>:</p>
\r
6147 <p class=MsoPlainText style='line-height:normal'> </p>
\r
6149 <p class=Verbatim style='margin-left:22.5pt'>void /*@alt char * @*/strcpy </p>
\r
6151 <p class=Verbatim style='margin-left:22.5pt;text-indent:13.5pt'>(/*@unique@*/
\r
6152 /*@out@*/ /*@returned@*/ char *s1, char *s2)</p>
\r
6154 <p class=Verbatim style='margin-left:.5in'>/*@modifies *s1@*/</p>
\r
6156 <p class=Verbatim style='margin-left:.5in'>/*@requires maxSet(s1) >=
\r
6157 maxRead(s2) @*/</p>
\r
6159 <p class=Verbatim> /*@ensures maxRead(s1) == maxRead (s2) @*/; </p>
\r
6161 <p class=MsoPlainText style='margin-left:.5in;line-height:normal'><b> </b></p>
\r
6163 <p class=MsoPlainText style='text-align:justify;line-height:normal'>The <span
\r
6164 class=Annot><span style='font-size:10.0pt'>requires</span></span> clause
\r
6165 indicates that the buffer passed as <span class=CodeText><span
\r
6166 style='font-size:10.0pt'>s1</span></span> must be large enough to hold the
\r
6167 string passed as <span class=CodeText><span style='font-size:10.0pt'>s2</span></span>.
\r
6168 The <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
6169 clause specifies that <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span>
\r
6170 of <span class=CodeText><span style='font-size:10.0pt'>s1</span></span> after
\r
6171 the call is equal to <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span>
\r
6172 of <span class=CodeText><span style='font-size:10.0pt'>s2</span></span>. In
\r
6173 cases where the size of <span class=CodeText><span style='font-size:10.0pt'>s2</span></span>
\r
6174 is unknown, programs should use <span class=CodeText><span style='font-size:
\r
6175 10.0pt'>strncpy</span></span>, annotated as: </p>
\r
6177 <p class=Verbatim> </p>
\r
6179 <p class=Verbatim style='margin-left:22.5pt'>void /*@alt char * @*/ strncpy </p>
\r
6181 <p class=Verbatim style='margin-left:22.5pt'> (/*@unique@*/ /*@out@*/
\r
6182 /*@returned@*/ char *s1, char *s2,</p>
\r
6184 <p class=Verbatim style='margin-left:22.5pt;text-indent:13.5pt'> size_t n)</p>
\r
6186 <p class=Verbatim style='margin-left:22.5pt'> /*@modifies *s1@*/ </p>
\r
6188 <p class=Verbatim style='margin-left:22.5pt'> /*@requires maxSet(s1) >= ( n
\r
6191 <p class=Verbatim style='margin-left:22.5pt'> /*@ensures maxRead (s2) >= maxRead(s1)
\r
6192 /\ maxRead (s1) <= n;@*/;</p>
\r
6194 <p class=TextFontCX> </p>
\r
6196 <p class=TextFontCX>The syntax for buffer size
\r
6197 constraint clauses is:</p>
\r
6199 <p class=TextFontCX> </p>
\r
6201 <p class=TextFontCX align=left style='margin-left:
\r
6202 22.5pt;text-align:left'><i><span lang=FR>constraint</span></i><span lang=FR> </span><span
\r
6203 style='font-family:Symbol'>Þ</span><span lang=FR> (</span><span class=Annot><span
\r
6204 style='font-size:10.0pt'>requires</span></span><span lang=FR> | </span><span
\r
6205 class=Annot><span style='font-size:10.0pt'>ensures</span></span><span lang=FR>)
\r
6206 <i>consExpr relOp consExpr</i></span></p>
\r
6208 <p class=TextFontCX align=left style='margin-left:
\r
6209 22.5pt;text-align:left'><i><span lang=FR>relOp</span></i><span lang=FR> </span><span
\r
6210 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
6211 10.0pt'>==</span></span><span lang=FR> | </span><span class=Annot><span
\r
6212 style='font-size:10.0pt'>></span></span><span lang=FR> | </span><span
\r
6213 class=Annot><span style='font-size:10.0pt'>>=</span></span><span lang=FR> | </span><span
\r
6214 class=Annot><span style='font-size:10.0pt'><</span></span><span lang=FR> | </span><span
\r
6215 class=Annot><span style='font-size:10.0pt'><=</span></span></p>
\r
6217 <p class=TextFontCX align=left style='margin-left:
\r
6218 22.5pt;text-align:left'><i><span lang=FR>consExpr </span></i><span
\r
6219 style='font-family:Symbol'>Þ</span> <i><span lang=FR>consExpression binOp
\r
6220 consExpr</span></i><span lang=FR> </span>| <i>unaryOp</i> <span class=Annot><span
\r
6221 style='font-size:10.0pt'>(</span></span><span class=Keyword><span
\r
6222 style='font-size:10.0pt;font-family:"Times New Roman";color:windowtext'> </span></span><i>consExpr</i>
\r
6223 <span class=Annot><span style='font-size:10.0pt'>)</span></span> | <i>term</i></p>
\r
6225 <p class=TextFontCX align=left style='margin-left:
\r
6226 22.5pt;text-align:left'><i>binOp</i> <span style='font-family:Symbol'>Þ</span>
\r
6227 <span class=Annot><span style='font-size:10.0pt'>+</span></span> | <span
\r
6228 class=Annot><span style='font-size:10.0pt'>-</span></span></p>
\r
6230 <p class=TextFontCX align=left style='margin-left:
\r
6231 22.5pt;text-align:left'><i>unaryOp</i> <span style='font-family:Symbol'>Þ</span>
\r
6232 <span class=Annot><span style='font-size:10.0pt'>maxSet</span></span> | <span
\r
6233 class=Annot><span style='font-size:10.0pt'>maxRead</span></span> </p>
\r
6235 <p class=TextFontCX align=left style='margin-left:
\r
6236 22.5pt;text-align:left'><i>term</i> <span style='font-family:Symbol'>Þ</span>
\r
6237 <i>identifier</i> | <i>literal</i> | <span class=Annot><span style='font-size:
\r
6238 10.0pt'>result</span></span></p>
\r
6240 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975001">9.3<span
\r
6241 style='font:7.0pt "Times New Roman"'>
\r
6242 </span>Warnings</a></h2>
\r
6244 <p class=TextFontCX>Since bounds checking is more
\r
6245 complex than other checks done by Splint, memory bounds warnings contain
\r
6246 extensive information about the unresolved constraint. Warning messages for
\r
6247 unresolved constraints contain both the original constraints and the simplified
\r
6248 form of the constraint which cannot be resolved. If the constraint was derived
\r
6249 from a function precondition, the original precondition is included in the
\r
6250 error message. If the <span class=Flag><span style='font-size:10.0pt'>+showconstraintlocation</span></span>
\r
6251 flag is set, the message includes the expression that the constraint is derived
\r
6252 from. The <span class=Flag><span style='font-size:10.0pt'>+showconstraintparens</span></span>
\r
6253 flag directs Splint to display fully parenthesized constraints in warnings to
\r
6254 remove ambiguity.</p>
\r
6256 <p class=TextFontCX> </p>
\r
6258 <p class=TextFontCX>Consider the code excerpt
\r
6259 below containing a trivial out-of-bounds write:</p>
\r
6261 <p class=Verbatim> </p>
\r
6263 <p class=Verbatim style='text-indent:.5in'>int buf[10];</p>
\r
6265 <p class=Verbatim style='text-indent:.5in'>buf[10] = 3;</p>
\r
6266 <p class=TextFontCX> </p>
\r
6267 <p class=TextFontCX style='margin-bottom:6.0pt'>Splint
\r
6270 <p align=left class=lclintrun style='margin-left:.5in'>setChar.c:5:4: Possible
\r
6271 out-of-bounds write to buf: buf[10] = 3</p>
\r
6273 <p class=lclintrun align=left style='margin-left:.5in'> Unable to resolve constraint:
\r
6274 requires 9 >= 10</p>
\r
6276 <p class=lclintrun align=left style='margin-top:0in;margin-right:0in;margin-bottom:6.0pt;
\r
6277 margin-left:.5in'> needed to satisfy precondition: requires maxSet(buf @
\r
6278 setChar.c:5:4) >= 10</p>
\r
6280 <p class=TextFontCX>Splint has simplified the constraint
\r
6281 from the <span class=Annot><span style='font-size:10.0pt'>requires</span></span>
\r
6282 clause to <span class=CodeText><span style='font-size:10.0pt'>9 >= 10</span></span>
\r
6283 by substituting for the known value of <span class=Annot><span
\r
6284 style='font-size:10.0pt'>maxSet(buf)</span></span> and generated a warning
\r
6285 because 9<span class=CodeText><span style='font-size:10.0pt'> </span></span>(the
\r
6286 highest index of <span class=CodeText><span style='font-size:10.0pt'>buf</span></span>
\r
6287 that may be safely written to) is not greater than or equal to 10.</p>
\r
6289 <p class=TextFontCX> </p>
\r
6291 <p class=TextFontCX>A more realistic example is
\r
6292 shown Figure 21. The function <span
\r
6293 class=CodeText><span style='font-size:10.0pt'>updateEnv</span></span> is a
\r
6294 naïve implementation of a function to copy an environmental variable. There is
\r
6295 no standard restriction on the length of the return value of <span
\r
6296 class=CodeText><span style='font-size:10.0pt'>getenv</span></span> so this can
\r
6297 cause a buffer overflow. A safe version of <span class=CodeText><span
\r
6298 style='font-size:10.0pt'>updateEnv</span></span> (such as <span class=CodeText><span
\r
6299 style='font-size:10.0pt'>updateEnvSafe</span></span> in Figure 21) would ensure that the buffer
\r
6300 is large enough to hold the environment variable string before copying.
\r
6302 <p class=TextFontCX> </p>
\r
6304 <p class=TextFontCX> </p>
\r
6306 <p class=TextFontCX>The <span class=Annot><span
\r
6307 style='font-size:10.0pt'>requires</span></span> clause means Splint will report
\r
6308 a warning if a call to <span class=CodeText><span style='font-size:10.0pt'>updateEnvSafe</span></span>
\r
6309 passed in a buffer as <span class=CodeText><span style='font-size:10.0pt'>str</span></span>
\r
6310 that is not big enough to hold the value passed as <span class=CodeText><span
\r
6311 style='font-size:10.0pt'>strSize</span></span> characters.</p>
\r
6313 <p class=TextFontCX> </p>
\r
6315 <p class=TextFontCX>In many cases, functions will
\r
6316 have multiple unresolved constraints which are similar. For example, if a subsequence
\r
6317 statement writes to the next element of a buffer. Usually all these
\r
6318 constraints represent all real problems or are all spurious. If the <span
\r
6319 class=Flag><span style='font-size:10.0pt'>+redundantconstraints</span></span>
\r
6320 flag is set, Splint reports even apparently redundant warning messages. Otherwise,
\r
6321 if satisfying one unresolved constraint would imply satisfying another, Splint
\r
6322 only prints a warning message for the stronger constraint. </p>
\r
6324 <p class=TextFontCX> </p>
\r
6327 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
6328 style='margin-left:9.9pt;border-collapse:collapse'>
\r
6330 <td valign=top style='width:202.5pt;border:solid black 1.5pt;
\r
6331 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>
\r
6332 <p class=TextFontCX align=center
\r
6333 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
6334 color:white'>bounds.c</span></b></span></p>
\r
6336 <td valign=top style='width:3.0in;border-top:solid black 1.5pt;
\r
6337 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
6338 background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>
\r
6339 <p class=TextFontCX align=center
\r
6340 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
6344 <td valign=top style='width:202.5pt;border:solid black 1.5pt;
\r
6345 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
6346 <p class=Verbatim><span style='font-family:Courier'> </span></p>
\r
6347 <p class=Verbatim><span style='font-family:Courier'>void updateEnv(char *
\r
6349 <p class=Verbatim><span style='font-family:Courier'>{</span></p>
\r
6350 <p class=Verbatim><span style='font-family:Courier'> char * tmp;</span></p>
\r
6351 <p class=Verbatim><i><span style='font-size:9.0pt;font-family:Courier'>7</span></i><span
\r
6352 style='font-family:Courier'> tmp = getenv(
\93MYENV
\94);</span></p>
\r
6353 <p class=Verbatim><span style='font-family:Courier'> if (tmp != NULL)</span></p>
\r
6354 <p class=Verbatim><i><span style='font-size:9.0pt;font-family:Courier'>9</span></i><span
\r
6355 style='font-family:Courier'> strcpy (str, tmp);</span></p>
\r
6356 <p class=Verbatim><span style='font-family:Courier'>}</span></p>
\r
6357 <p class=Verbatim><span style='font-family:Courier'> </span></p>
\r
6358 <p class=Verbatim><span style='font-family:Courier'>void updateEnvSafe (char
\r
6360 <p class=Verbatim><span style='font-family:Courier'> size_t
\r
6361 strSize) </span></p>
\r
6362 <p class=Verbatim><span style='font-family:Courier'> </span><a
\r
6363 href="mailto:/*@requires"><span style='font-family:Courier'>/*@requires</span></a><span
\r
6364 style='font-family:Courier'> maxSet(str) </span></p>
\r
6365 <p class=Verbatim><span style='font-family:Courier'> >=
\r
6366 strSize
\961@*/</span></p>
\r
6367 <p class=Verbatim><span style='font-family:Courier'>{</span></p>
\r
6368 <p class=Verbatim><span style='font-family:Courier'> char * tmp;</span></p>
\r
6369 <p class=Verbatim><span style='font-family:Courier'> tmp = getenv(
\93MYENV
\94);</span></p>
\r
6370 <p class=Verbatim><span style='font-family:Courier'> if (tmp != NULL)</span></p>
\r
6371 <p class=Verbatim><span style='font-family:Courier'> {</span></p>
\r
6372 <p class=Verbatim><span style='font-family:Courier'> strncpy (str, tmp,</span></p>
\r
6373 <p class=Verbatim><span style='font-family:Courier'> strSize
\r
6375 <p class=Verbatim><span style='font-family:Courier'> str[strSize -1] =
\r
6376 \91/0
\92;</span></p>
\r
6377 <p class=Verbatim><span style='font-family:Courier'> }</span></p>
\r
6378 <p class=Verbatim><span style='font-family:Courier'>}</span></p>
\r
6380 <td valign=top style='width:3.0in;border-top:none;border-left:none;
\r
6381 border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
6382 <p class=lclintrun>> splint bounds.c +bounds +showconstraintlocation </p>
\r
6383 <p class=lclintrun> </p>
\r
6384 <p class=lclintrun>bounds.c:9: Possible out-of-bounds store:</p>
\r
6385 <p class=lclintrun> strcpy(str, tmp)</p>
\r
6386 <p class=lclintrun> Unable to resolve constraint:</p>
\r
6387 <p class=lclintrun> requires maxSet(str @ bounds.c:9) >=</p>
\r
6388 <p class=lclintrun> maxRead(getenv("MYENV") @ bounds.c:7)</p>
\r
6389 <p class=lclintrun> needed to satisfy precondition:</p>
\r
6390 <p class=lclintrun> requires maxSet(str @ bounds.c:9) >=</p>
\r
6391 <p class=lclintrun> maxRead(tmp @ bounds.c:9)</p>
\r
6392 <p class=lclintrun> derived from strcpy precondition: requires</p>
\r
6393 <p class=lclintrun> maxSet(<parameter 1>) >= </p>
\r
6394 <p class=lclintrun> maxRead(<parameter 2>)</p>
\r
6399 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
6401 <td valign=top style='padding-top:0in;padding-right:
\r
6402 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
6403 <p class=MsoCaption><a name="_Ref534909813"></a><a name="_Ref534909817">Figure
\r
6404 21</a>. Memory Bounds</p>
\r
6412 <p class=TextFontCX>The <span class=Flag><span
\r
6413 style='font-size:10.0pt'>+functionpost</span></span> flag is useful for
\r
6414 determining if array bounds warnings are spurious. If this flag is set, Splint
\r
6415 will print the constraints that it established at the end of the function. If the
\r
6416 warnings are spurious, localized control comments can be used to suppress them.
\r
6419 <p class=TextFontCX> </p>
\r
6421 <p class=TextFontCX> </p>
\r
6423 <p class=TextFontCX> </p>
\r
6425 <h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534975002"></a><a
\r
6426 name="_Ref534642928"></a><a name="_Ref534642285">10<span style='font:7.0pt "Times New Roman"'>
\r
6427 </span>Extensible Checking</a></h1>
\r
6429 <p class=TextFontCX>Splint provides mechanisms
\r
6430 for defining new checks and annotations using metastate definitions.
\r
6431 User-defined checks can be used to check and document properties not supported
\r
6432 by the provided checks.<a href="#_ftn13" name="_ftnref13" title=""><span
\r
6433 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
6434 style='font-size:11.0pt;font-family:"Times New Roman"'>[13]</span></span></span></a>
\r
6437 <p class=TextFontCX> </p>
\r
6439 <p class=TextFontCX>A large class of useful
\r
6440 checks can be described as constraints on attributes associated with program
\r
6441 objects or the global execution state. Unlike types, however, the values of
\r
6442 these attributes can change along an execution path. Splint provides a general
\r
6443 language that lets users define attributes associated with different kinds of
\r
6444 program objects as well as rules that both constrain attributes
\92 values at
\r
6445 interface points and specify how attributes change. </p>
\r
6447 <p class=TextFontCX> </p>
\r
6449 <p class=TextFontCX>Because user-defined
\r
6450 attribute checking is integrated with normal checking, Splint
\92s analysis of
\r
6451 user-defined attributes can take advantage of other analyses, such as alias and
\r
6452 nullness analysis. </p>
\r
6454 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975003">10.1<span
\r
6455 style='font:7.0pt "Times New Roman"'> </span>Defining
\r
6456 Attributes</a></h2>
\r
6458 <p class=TextFontCX>To define an attribute,
\r
6459 create a metastate file (<span class=ProgramNameChar><span style='font-size:
\r
6460 10.0pt'>.mts</span></span>) that defined the possible values and transfer rules
\r
6461 of the attribute. Attributes can either be associated with a particular kind
\r
6462 of program object (for example, all <span class=CodeText><span
\r
6463 style='font-size:10.0pt'>char *</span></span>
\92s) or with the global state
\r
6464 (whether or not the network has been initialized). The <span class=Flag><span
\r
6465 style='font-size:10.0pt'>
\96mts <i><file></i></span></span> flag is used to
\r
6466 direct Splint to read a metastate file (which will be found on the <span
\r
6467 class=CodeText><span style='font-size:10.0pt'>LARCH_PATH</span></span> with
\r
6468 default extension <span class=ProgramNameChar><span style='font-size:10.0pt'>.mts</span></span>).</p>
\r
6470 <p class=TextFontCX> </p>
\r
6472 <p class=TextFontCX>An example attribute
\r
6473 definition is shown in Figure 22. It defines the <span
\r
6474 class=Annot><span style='font-size:10.0pt'>taintedness</span></span> attribute
\r
6475 for recording whether or not a <span class=CodeText><span style='font-size:
\r
6476 10.0pt'>char *</span></span> came from a possibly untrustworthy source.
\r
6477 Knowing whether a value is possibly hostile is useful for preventing several
\r
6478 security vulnerabilities including format string bugs.<a href="#_ftn14"
\r
6479 name="_ftnref14" title=""><span class=MsoFootnoteReference><span
\r
6480 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>
\r
6481 (A simpler way to detect format vulnerabilities is to warn for any format
\r
6482 string that is unknown at compile time. Splint provides this checking, issuing
\r
6483 a warning if the <span class=Flag><span style='font-size:10.0pt'>+formatconst</span></span>
\r
6484 flag is set and finds any unknown format strings at compile time. This can
\r
6485 produce spurious messages, however, because there might be unknown format
\r
6486 strings that are not vulnerable to hostile input.)</p>
\r
6488 <p class=TextFontCX> </p>
\r
6490 <p class=TextFontCX>The first three lines of the
\r
6491 attribute definition define the <span class=Annot><span style='font-size:10.0pt'>taintedness</span></span>
\r
6492 attribute associated with <span class=CodeText><span style='font-size:10.0pt'>char
\r
6493 *</span></span> objects, which can be in one of two states: <span class=Annot><span
\r
6494 style='font-size:10.0pt'>untainted</span></span> or <span class=Annot><span
\r
6495 style='font-size:10.0pt'>tainted</span></span>. The <span class=Annot><span
\r
6496 style='font-size:10.0pt'>context</span></span> clause gives a context selector
\r
6497 for which objects have the attribute. In this case, <span class=Annot><span
\r
6498 style='font-size:10.0pt'>reference char *</span></span> means that every
\r
6499 reference that is a <span class=CodeText><span style='font-size:10.0pt'>char *</span></span>
\r
6500 has an associated <span class=Annot><span style='font-size:10.0pt'>taintedness</span></span>
\r
6501 attribute. Other contexts include <span class=Annot><span style='font-size:
\r
6502 10.0pt'>parameter</span></span> (only parameter declarations), <span
\r
6503 class=Annot><span style='font-size:10.0pt'>literal</span></span> (only string
\r
6504 or number literals), and <span class=Annot><span style='font-size:10.0pt'>null</span></span>
\r
6505 (only known <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>
\r
6506 values). Attribute can also be defined that are not associated with any
\r
6507 particular object, but instead are associated with the global state of a program
\r
6508 execution. The <span class=Annot><span style='font-size:10.0pt'>global</span></span>
\r
6509 keyword is used before <span class=Annot><span style='font-size:10.0pt'>attribute</span></span>
\r
6510 to define a global attribute.</p>
\r
6512 <p class=TextFontCX> </p>
\r
6514 <p class=TextFontCX>The <span class=Annot><span
\r
6515 style='font-size:10.0pt'>oneof</span></span> clause introduces two identifiers
\r
6516 for representing the <span class=Annot><span style='font-size:10.0pt'>taintedness</span></span>
\r
6517 value: <span class=Annot><span style='font-size:10.0pt'>untainted</span></span>
\r
6518 for references that are not derived from untrustworthy input, and <span
\r
6519 class=Annot><span style='font-size:10.0pt'>tainted</span></span> for references
\r
6520 that may contain hostile data. </p>
\r
6522 <p class=TextFontCX> </p>
\r
6524 <p class=TextFontCX>The <span class=Annot><span
\r
6525 style='font-size:10.0pt'>annotations</span></span> clause defines two new
\r
6526 annotations that may be used to describe <span class=Annot><span
\r
6527 style='font-size:10.0pt'>taintedness</span></span> assumptions. In this case,
\r
6528 the annotations match the names of the value choices, but they may be any
\r
6529 identifier. The clause <span class=Annot><span style='font-size:10.0pt'>tainted
\r
6530 <b>reference ==></b> tainted </span></span>defines the <span class=Annot><span
\r
6531 style='font-size:10.0pt'>tainted</span></span> annotation that may be used on a
\r
6532 reference to indicate that it has <span class=Annot><span style='font-size:
\r
6533 10.0pt'>tainted</span></span> state. </p>
\r
6537 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
6539 <td valign=top align=left height=264 style='padding-top:0in;padding-right:
\r
6540 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
6541 <p class=Verbatim><span class=Annot><b>attribute</b></span><span class=Annot>
\r
6542 taintedness</span></p>
\r
6543 <p class=Verbatim><span class=Annot> <b>context</b> <b>reference</b> char *</span></p>
\r
6544 <p class=Verbatim><span class=Annot> <b>oneof</b> untainted, tainted</span></p>
\r
6545 <p class=Verbatim><span class=Annot> <b>annotations</b></span></p>
\r
6546 <p class=Verbatim><span class=Annot> tainted <b>reference ==></b>
\r
6547 tainted</span></p>
\r
6548 <p class=Verbatim><span class=Annot> untainted <b>reference ==></b>
\r
6549 untainted</span></p>
\r
6550 <p class=Verbatim><span class=Annot> <b>transfers</b></span></p>
\r
6551 <p class=Verbatim><span class=Annot> tainted <b>as</b> untainted <b>==>
\r
6552 error</b> "Possibly tainted storage used where untainted required."</span></p>
\r
6553 <p class=Verbatim><span class=Annot> <b>merge</b></span></p>
\r
6554 <p class=Verbatim><span class=Annot> tainted <b>+</b> untainted <b>==></b>
\r
6555 tainted</span></p>
\r
6556 <p class=Verbatim><span class=Annot> <b>defaults</b></span></p>
\r
6557 <p class=Verbatim><span class=Annot> reference <b>==></b> tainted</span></p>
\r
6558 <p class=Verbatim><span class=Annot> literal <b>==></b> untainted</span></p>
\r
6559 <p class=Verbatim><span class=Annot> null <b>==></b> untainted</span></p>
\r
6560 <p class=Verbatim><span class=Annot><b>end</b></span></p>
\r
6561 <p class=MsoCaption><a name="_Ref534921559">Figure 22</a>. Taintedness
\r
6570 <p class=TextFontCX> </p>
\r
6572 <p class=TextFontCX>The <span class=Annot><span
\r
6573 style='font-size:10.0pt'>transfers</span></span> clause defines rules for state
\r
6574 changes and warning when objects are passed as parameters, returned, or
\r
6575 assigned to externally visible references. The rule, <span class=Annot><span
\r
6576 style='font-size:10.0pt'>tainted <b>as</b> untainted <b>==> error</b>
\r
6577 "Possibly tainted storage used where untainted required."</span></span>,
\r
6578 means it is an error to pass a <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>
\r
6579 value as a parameter that has <span class=Annot><span style='font-size:10.0pt'>untainted</span></span>
\r
6580 taintedness. All other transfers are implicitly permitted, and leave the
\r
6581 passed storage in the same state as before the transfer. We may also use a <span
\r
6582 class=Annot><span style='font-size:10.0pt'>transfers</span></span> clause to
\r
6583 indicate that the reference changes state after a transfer. A <span
\r
6584 class=Annot><span style='font-size:10.0pt'>losereference</span></span> clause
\r
6585 (not used in taintedness) is similar to a <span class=Annot><span
\r
6586 style='font-size:10.0pt'>transfers</span></span> clause, except it is used to
\r
6587 provide rules for when a reference to storage is lost, either by leaving the
\r
6588 scope in which it was declared, returning from a function, or assigning it to a
\r
6591 <p class=TextFontCX> </p>
\r
6593 <p class=TextFontCX>The <span class=Annot><span
\r
6594 style='font-size:10.0pt'>merge</span></span> clause defined rules for combining
\r
6595 state along paths. The clause<span class=Annot><span style='font-size:10.0pt'>
\r
6596 merge tainted + untainted ==> tainted</span></span> indicates that combining
\r
6597 <span class=Annot><span style='font-size:10.0pt'>tainted</span></span> and <span
\r
6598 class=Annot><span style='font-size:10.0pt'>untainted</span></span> objects
\r
6599 produces a <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>
\r
6600 object. Thus, if a reference is <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>
\r
6601 along one control path and <span class=Annot><span style='font-size:10.0pt'>untainted</span></span>
\r
6602 along another control path, checking assumes that it is <span class=Annot><span
\r
6603 style='font-size:10.0pt'>tainted</span></span><span class=ProgramCode><span
\r
6604 style='font-size:9.0pt'> </span></span>after the two branches merge. It is also
\r
6605 used to merge taintedness states in function specifications (see the <span
\r
6606 class=CodeText><span style='font-size:10.0pt'>strcat</span></span> example in
\r
6607 the next section). We can also define error combinations so that a warning is
\r
6608 reported if the states on different paths are incompatible.</p>
\r
6610 <p class=TextFontCX> </p>
\r
6612 <p class=TextFontCX>The <span class=Annot><span
\r
6613 style='font-size:10.0pt'>defaults</span></span> clause specifies default values
\r
6614 used for declarators without explicit attribute annotations. We choose default
\r
6615 values to make it easy to start checking an unannotated program. Here we assume
\r
6616 unannotated references are <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>
\r
6617 and Splint will report a warning where unannotated references are passed to
\r
6618 functions that require untainted parameters. The warnings indicate either a
\r
6619 format bug in the code or a place where an <span class=Annot><span
\r
6620 style='font-size:10.0pt'>untainted</span></span> annotation should be added.
\r
6621 Running Splint again after adding the annotation will propagate the newly
\r
6622 documented assumption through the program.</p>
\r
6624 <p class=TextFontCX> </p>
\r
6626 <p class=TextFontCX style='margin-bottom:6.0pt'>The
\r
6627 full grammar for metastate definitions is given in Appendix C.</p>
\r
6629 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975004">10.2<span
\r
6630 style='font:7.0pt "Times New Roman"'> </span>Annotations</a></h2>
\r
6632 <p class=TextFontCX>The annotations defined by
\r
6633 metastate definitions can be used like normal annotations. The context
\r
6634 specifier for an annotation indicates where it may be used. For the
\r
6635 taintedness example, we can use <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>
\r
6636 and <span class=Annot><span style='font-size:10.0pt'>untainted</span></span> as
\r
6637 annotations wherever <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
6638 could be used. This includes <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
6639 and <span class=Annot><span style='font-size:10.0pt'>requires</span></span>
\r
6640 clauses, which allows us to specify functions that modify state associated with
\r
6641 metastate definitions. The syntax <span class=Annot><i><span style='font-size:
\r
6642 10.0pt'><expr></span></i></span><span class=Annot><span style='font-size:
\r
6643 10.0pt'>:<i><attribute></i></span></span> is used to refer to the value
\r
6644 of the user-defined attribute for expression <span class=Annot><i><span
\r
6645 style='font-size:10.0pt'><expr></span></i></span>. </p>
\r
6647 <p class=TextFontCX> </p>
\r
6649 <p class=TextFontCX>It is often necessary to
\r
6650 extend the library specifications with metastate annotations. We don
\92t want to
\r
6651 have different versions of the library for different metastate annotations, so
\r
6652 instead Splint provides a mechanism for adding annotations separately using an <span
\r
6653 class=ProgramNameChar><span style='font-size:10.0pt'>.xh</span></span> file.
\r
6654 For the taintedness example, we do this by providing annotated declarations in
\r
6655 the <span class=ProgramNameChar><span style='font-size:10.0pt'>tainted.xh</span></span>
\r
6656 file. Example specifications in this file include:</p>
\r
6658 <p class=TextFontCX> </p>
\r
6660 <p class=Verbatim>int printf (/*@untainted@*/ char *fmt, ...);</p>
\r
6662 <p class=Verbatim> </p>
\r
6664 <p class=Verbatim>char *fgets (char *s, int n, FILE *stream) /*@ensures tainted
\r
6667 <p class=Verbatim> </p>
\r
6669 <p class=Verbatim>char *strcat (/*@returned@*/ char *s1, char *s2) </p>
\r
6671 <p class=Verbatim> /*@ensures s1:taintedness = s1:taintedness |
\r
6672 s2:taintedness @*/</p>
\r
6674 <p class=TextFontCX> </p>
\r
6676 <p class=TextFontCX>The <span class=CodeText><span
\r
6677 style='font-size:10.0pt'>strcat</span></span> specification uses <span
\r
6678 class=Annot><span style='font-size:10.0pt'>/*@ensures s1:taintedness =
\r
6679 s1:taintedness | s2:taintedness @*/</span></span> to indicate that the
\r
6680 taintedness of <span class=CodeText><span style='font-size:10.0pt'>s1</span></span>
\r
6681 after <span class=CodeText><span style='font-size:10.0pt'>strcat</span></span>
\r
6682 returns is the result of merging the taintedness of <span class=CodeText><span
\r
6683 style='font-size:10.0pt'>s1</span></span> and <span class=CodeText><span
\r
6684 style='font-size:10.0pt'>s2</span></span> before the call. Because the
\r
6685 parameters lack annotations, they are implicitly tainted according to the
\r
6686 default rules and either untainted or tainted references can be passed as
\r
6687 parameters to <span class=CodeText><span style='font-size:10.0pt'>strcat</span></span>.
\r
6688 The <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
6689 clause means that after <span class=CodeText><span style='font-size:10.0pt'>strcat</span></span>
\r
6690 returns the first parameter (and the result, because of the returned annotation
\r
6691 on <span class=CodeText><span style='font-size:10.0pt'>s1</span></span>) will
\r
6692 be tainted if either passed object was tainted. Splint merges the two taintedness
\r
6693 states using the attribute definition rules
\97hence, if the <span class=CodeText><span
\r
6694 style='font-size:10.0pt'>s1</span></span> parameter is untainted and the <span
\r
6695 class=CodeText><span style='font-size:10.0pt'>s2</span></span> parameter is
\r
6696 tainted, the result and first parameter will be tainted after <span
\r
6697 class=CodeText><span style='font-size:10.0pt'>strcat</span></span> returns.</p>
\r
6699 <p class=TextFontCX> </p>
\r
6701 <h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534975006"></a><a
\r
6702 name="_Ref534642895"></a><a name="_Ref534642215">11<span style='font:7.0pt "Times New Roman"'>
\r
6703 </span>Macros</a></h1>
\r
6705 <p class=TextFontCX>Macros are commonly used in C
\r
6706 programs to implement constants or to mimic functions without the overhead of a
\r
6707 function call. Macros that are used to implement functions are a persistent
\r
6708 source of bugs in C programs, since they may not behave like the intended
\r
6709 function when they are invoked with certain parameters or used in certain
\r
6710 syntactic contexts. </p>
\r
6712 <p class=TextFontCX> </p>
\r
6714 <p class=TextFontCX>Splint eliminates most of the
\r
6715 potential problems by detecting macros with dangerous implementations and
\r
6716 dangerous macro invocations. Whether or not a macro definition is checked or
\r
6717 expanded normally depends on flag settings and control comments (see Section 11.3).
\r
6718 Stylized macros can also be used to define control structures for iterating
\r
6719 through many values (see Section 11.4).</p>
\r
6721 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975007"></a><a
\r
6722 name="_Ref361651263"></a><a name="_Ref344916524"></a><a name="_Ref344908437"></a><a
\r
6723 name="_Toc344355419">11.1<span style='font:7.0pt "Times New Roman"'>
\r
6724 </span>Constant Macros</a></h2>
\r
6726 <p class=TextFontCX>Macros may be used to
\r
6727 implement constants. To get type-checking for constant macros, use the <span
\r
6728 class=Annot><span style='font-size:10.0pt'>constant</span></span> annotation.
\r
6731 <p class=example>/*@constant null char *mstring_undefined@*/</p>
\r
6733 <p class=TextFontCX>Declared constants are not
\r
6734 expanded and are checked according to the declaration. A constant with a <span
\r
6735 class=Annot><span style='font-size:10.0pt'>null</span></span> annotation may be used as <span class=Annot><span style='font-size:10.0pt'>only</span></span> storage.</p>
\r
6737 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975008"></a><a
\r
6738 name="_Toc344355420"></a><a name="_Ref343363760">11.2<span style='font:7.0pt "Times New Roman"'>
\r
6739 </span>Function-like Macros</a></h2>
\r
6741 <p class=TextFontCX>Using macros to imitate
\r
6742 functions is notoriously dangerous. Consider this broken macro for squaring a
\r
6745 <p class=example># define square(x) x * x</p>
\r
6747 <p class=TextFontCX>This works fine for a simple
\r
6748 invocation like <span class=CodeText><span style='font-size:10.0pt'>square(i)</span></span>.
\r
6749 It behaves unexpectedly, though, if it is instantiated with a parameter that
\r
6750 has a side effect. For example, <span class=CodeText><span style='font-size:
\r
6751 10.0pt'>square(i++)</span></span> expands to <span class=CodeText><span
\r
6752 style='font-size:10.0pt'>i++ * i++</span></span>. Not only does this give the
\r
6753 incorrect result, it has undefined behavior since the order in which the
\r
6754 operands are evaluated is not defined. (See Section 8.2 for more information
\r
6755 on how expressions exhibiting undefined evaluation order behavior are detected
\r
6756 by Splint.) To correct the problem we either need to rewrite the macro so that
\r
6757 its parameter is evaluated exactly once, or prevent clients from invoking the
\r
6758 macro with a parameter that has a side effect. </p>
\r
6760 <p class=TextFontCX> </p>
\r
6762 <p class=TextFontCX>Another possible problem with
\r
6763 macros is that they may produce unexpected results because of operator
\r
6764 precedence rules. The instantiation, <span class=CodeText><span
\r
6765 style='font-size:10.0pt'>square(i+1)</span></span> expands to <span
\r
6766 class=CodeText><span style='font-size:10.0pt'>i+1*i+1</span></span>, which
\r
6767 evaluates to <span class=CodeText><span style='font-size:10.0pt'>i+i+1</span></span>
\r
6768 instead of the square of <span class=CodeText><span style='font-size:10.0pt'>i+1</span></span>.
\r
6769 To ensure the expected behavior, the macro parameter should be enclosed in
\r
6770 parentheses where it is used in the macro body.</p>
\r
6772 <p class=TextFontCX> </p>
\r
6774 <p class=TextFontCX>Macros may also behave
\r
6775 unexpectedly if they are not syntactically equivalent to an expression.
\r
6776 Consider the macro definition,</p>
\r
6778 <p class=example># define incCounts() ntotal++; ncurrent++;</p>
\r
6780 <p class=TextFontCX>This works fine, unless it is
\r
6781 used as a statement. For example,</p>
\r
6783 <p class=example>if (x < 3) incCounts();</p>
\r
6785 <p class=TextFontCX>increments <span
\r
6786 class=CodeText><span style='font-size:10.0pt'>ntotal</span></span> if <span
\r
6787 class=CodeText><span style='font-size:10.0pt'>x < 3</span></span> but always
\r
6788 increments <span class=CodeText><span style='font-size:10.0pt'>ncurrent</span></span>.</p>
\r
6790 <p class=TextFontCX> </p>
\r
6792 <p class=TextFontCX>One solution is to use the
\r
6793 comma operator to define the macro:</p>
\r
6795 <p class=example># define incCounts() (ntotal++, ncurrent++)</p>
\r
6797 <p class=beforelist>More complicated macros can be written using a <span
\r
6798 class=CodeText><span style='font-size:10.0pt'>do
\85 while</span></span>
\r
6801 <p class=Verbatim> # define incCounts() \</p>
\r
6803 <p class=Verbatim> do { ntotal++; ncurrent++; } while (FALSE)</p>
\r
6805 <p class=afterlist>Splint detects these pitfalls in macro definitions, and
\r
6806 checks that a macro behaves as much like a function as possible. A client
\r
6807 should only be able to tell that a function was implemented by a macro if it
\r
6808 attempts to use the macro as a pointer to a function.</p>
\r
6810 <p class=MsoListBullet> </p>
\r
6812 <p class=beforelist>Splint does these checks on a macro definition
\r
6813 corresponding to a function:</p>
\r
6815 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
6816 style='font:7.0pt "Times New Roman"'> </span></span>Each
\r
6817 parameter to a macro (except those declared to be side effect free, see Section
\r
6818 11.2.1) must be used exactly once in all possible executions of the macro, so
\r
6819 side effecting arguments behave as expected.<a href="#_ftn15" name="_ftnref15"
\r
6820 title=""><span class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
6821 style='font-size:11.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>
\r
6822 (Controlled by <span class=Flag><span style='font-size:10.0pt'>macroparams</span></span>.)</p>
\r
6824 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
6825 style='font:7.0pt "Times New Roman"'> </span></span>A
\r
6826 parameter to a macro may not be used as the left-hand side of an assignment
\r
6827 expression or as the operand of an increment or decrement operator in the macro
\r
6828 text, since this produces non-functional behavior. (Controlled by <span
\r
6829 class=Flag><span style='font-size:10.0pt'>macroassign</span></span>.)</p>
\r
6831 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
6832 style='font:7.0pt "Times New Roman"'> </span></span>Macro
\r
6833 parameters must be enclosed in parentheses when they are used in potentially
\r
6834 dangerous contexts. (Controlled by <span class=Flag><span style='font-size:
\r
6835 10.0pt'>macroparens</span></span>.)</p>
\r
6837 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
6838 style='font:7.0pt "Times New Roman"'> </span></span>A
\r
6839 macro definition must be syntactically equivalent to a statement when it is
\r
6840 invoked followed by a semicolon. (Controlled by <span class=Flag><span
\r
6841 style='font-size:10.0pt'>macrostmt</span></span>.)</p>
\r
6843 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
6844 style='font:7.0pt "Times New Roman"'> </span></span>The
\r
6845 type of the macro body must match the return type of the corresponding
\r
6846 function. If the macro is declared with type <span class=CodeText><span
\r
6847 style='font-size:10.0pt'>void</span></span>, its body may have any type but the
\r
6848 macro value may not be used.</p>
\r
6850 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
6851 style='font:7.0pt "Times New Roman"'> </span></span>All
\r
6852 variables declared in the body of a macro definition must be in the macro
\r
6853 variable namespace, so they do not conflict with variables in the scope where
\r
6854 the macro is invoked (which may be used in the macro parameters). By default,
\r
6855 the macro namespace is all names prefixed by <span class=CodeText><span
\r
6856 style='font-size:10.0pt'>m_</span></span>. (See Section 12.2 for information
\r
6857 on controlling namespaces.)</p>
\r
6859 <p class=afterlist>At the call site, a macro is checked like any other function
\r
6862 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975009"></a><a
\r
6863 name="_Toc344355421"></a><a name="_Ref343109609">11.2.1<span style='font:7.0pt "Times New Roman"'>
\r
6864 </span>Side Effect Free Parameters</a></h3>
\r
6866 <p class=beforelist>Suppose we really do want to implement <span
\r
6867 class=CodeText><span style='font-size:10.0pt'>square</span></span> as a macro,
\r
6868 but want do so in a safe way. One way to do this is to require that it is
\r
6869 never invoked with a parameter that has a side effect. Splint will check that
\r
6870 this constraint holds, if the parameter is annotated to be side effect free.
\r
6871 That is, the expression corresponding to this parameter must not modify any state, so it does not matter how many times it is evaluated. The <span
\r
6872 class=Annot><span style='font-size:10.0pt'>sef</span></span> annotation is used to denote a parameter that may not have any side effects:</p>
\r
6874 <p class=Verbatim><span style='font-size:9.5pt'> extern int square (/*@sef@*/
\r
6875 int x);</span></p>
\r
6877 <p class=Verbatim><span style='font-size:9.5pt'> # define square(x) ((x)
\r
6880 <p class=afterlist>Now, Splint will not report an error checking the definition
\r
6881 of <span class=CodeText><span style='font-size:10.0pt'>square</span></span>
\r
6882 even though <span class=CodeText><span style='font-size:10.0pt'>x</span></span>
\r
6883 is used more than once.</p>
\r
6885 <p class=TextFontCX> </p>
\r
6887 <p class=TextFontCX>A message will be reported,
\r
6888 however, if <span class=CodeText><span style='font-size:10.0pt'>square</span></span>
\r
6889 is invoked with a parameter that has a side effect. For the code fragment,</p>
\r
6891 <p class=example>square (i++)</p>
\r
6893 <p class=beforelist>Splint produces the message:</p>
\r
6895 <p class=Verbatim> <span style='font-family:Arial'>Parameter 1 to square is
\r
6896 declared sef,</span><span style='font-family:Arial'> </span><span
\r
6897 style='font-family:Arial'>but the argument may modify: i++</span></p>
\r
6899 <p class=betweenlists>It is also an error to pass a macro parameter that is not
\r
6900 annotated with <span class=Annot><span style='font-size:10.0pt'>sef</span></span>
\r
6901 as a <span class=Annot><span style='font-size:10.0pt'>sef</span></span> macro
\r
6902 parameter in the body of a macro definition. For example,</p>
\r
6904 <p class=Verbatim><span style='font-size:9.5pt'> extern int sumsquares (int
\r
6905 x, int y);</span></p>
\r
6907 <p class=Verbatim><span style='font-size:9.5pt'> # define sumsquares(x,y)
\r
6908 (square(x) + square(y))</span></p>
\r
6910 <p class=afterlist>Although <span class=CodeText><span style='font-size:10.0pt'>x</span></span>
\r
6911 only appears once in the definition of <span class=CodeText><span
\r
6912 style='font-size:10.0pt'>sumsquares</span></span> it will be evaluated twice
\r
6913 since <span class=CodeText><span style='font-size:10.0pt'>square</span></span>
\r
6916 <p class=TextFontCX> </p>
\r
6918 <p class=TextFontCX>A parameter may be passed as
\r
6919 a <span class=Annot><span style='font-size:10.0pt'>sef</span></span> parameter
\r
6920 without an error being reported, if Splint can determine that evaluating the
\r
6921 parameter has no side effects. For function calls, the modifies clause is used to determine if a side effect is possible.<a href="#_ftn16"
\r
6922 name="_ftnref16" title=""><span class=MsoFootnoteReference><span
\r
6923 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>
\r
6924 To prevent many spurious errors, if the called function has no modifies clause,
\r
6925 Splint will report an error only if <span class=Flag><span style='font-size:
\r
6926 10.0pt'>sef-uncon</span></span> is on. Justifiably paranoid programmers will
\r
6927 insist on setting <span class=Flag><span style='font-size:10.0pt'>sef-uncon</span></span>
\r
6928 on, and will add modifies clauses to unconstrained functions that are used in <span
\r
6929 class=Annot><span style='font-size:10.0pt'>sef</span></span> macro arguments.</p>
\r
6931 <p class=TextFontCX> </p>
\r
6933 <p class=beforelist>One common application of macros is to get around the lack
\r
6934 of polymorphism in C. We can use the <span class=Annot><span style='font-size:
\r
6935 10.0pt'>/*@alt <type>,<sup>+</sup>@></span></span> syntax (see Section 4.4) to indicate that an alternate type may be used. For example,</p>
\r
6937 <p class=Verbatim><span style='font-size:9.5pt'> extern int /*@alt float@*/
\r
6938 square (/*@sef@*/ int /*@alt float@*/ x);</span></p>
\r
6940 <p class=Verbatim><span style='font-size:9.5pt'> # define square(x) ((x) *(x))</span></p>
\r
6942 <p class=afterlist>declares <span class=CodeText><span style='font-size:10.0pt'>square</span></span>
\r
6943 for both <span class=CodeText><span style='font-size:10.0pt'>int</span></span>s
\r
6944 and <span class=CodeText><span style='font-size:10.0pt'>float</span></span>s.
\r
6945 Note however, that the return type is either <span class=CodeText><span
\r
6946 style='font-size:10.0pt'>int</span></span> or <span class=CodeText><span
\r
6947 style='font-size:10.0pt'>float</span></span>, regardless of the actual
\r
6948 parameter type. This is weaker than what is actually known about the return
\r
6951 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975010"></a><a
\r
6952 name="_Ref347227227">11.3<span style='font:7.0pt "Times New Roman"'>
\r
6953 </span>Controlling Macro Checking</a></h2>
\r
6955 <p class=TextFontCX>By default, Splint expands
\r
6956 macros normally and checks the resulting code after macros have been expanded.
\r
6957 Flags and control comments may be used to control which macros are expanded and
\r
6958 which are checked as functions or constants.</p>
\r
6960 <p class=TextFontCX> </p>
\r
6962 <p class=TextFontCX>If the <span class=Flag><span
\r
6963 style='font-size:10.0pt'>fcn-macros</span></span> flag is on, Splint assumes all macros defined with parameter lists implement
\r
6964 functions and checks them accordingly. Parameterized macros are not expanded
\r
6965 and are checked as functions with unknown result and parameter types (or using
\r
6966 the types in the prototype, if one is given). The analogous flag for macros
\r
6967 that define constants is <span class=Flag><span style='font-size:10.0pt'>const-macros</span></span>. If it is on, macros with no parameter lists are assumed to be constants, and checked accordingly. The <span class=Flag><span style='font-size:10.0pt'>all-macros</span></span> flag sets both <span class=Flag><span style='font-size:10.0pt'>fcn-macros</span></span>
\r
6968 and <span class=Flag><span style='font-size:10.0pt'>const-macros</span></span>.
\r
6969 If the <span class=Flag><span style='font-size:10.0pt'>macro-fcn-decl</span></span> flag is set, a message reports parameterized macros with no corresponding function prototype. If the <span class=Flag><span style='font-size:10.0pt'>macro-const-decl</span></span> flag is set, a similar message reports macros with no parameters that have no corresponding constant declaration.</p>
\r
6971 <p class=TextFontCX> </p>
\r
6973 <p class=beforelist>The macro checks described in the previous sections make
\r
6974 sense only for macros that are intended to replace functions or constants.
\r
6975 When <span class=Flag><span style='font-size:10.0pt'>fcnmacros</span></span> or <span class=Flag><span style='font-size:10.0pt'>constmacros</span></span> is on, more general macros need to be marked so they will not be checked as
\r
6976 functions or constants, and will be expanded normally. Macros that are not
\r
6977 meant to behave like functions should be preceded by the /<span class=Annot><span
\r
6978 style='font-size:10.0pt'>*@notfunction@*/</span></span><span class=Annot><span style='font-size:10.0pt'> </span></span>comment. For
\r
6981 <p class=Verbatim><span style='font-size:9.5pt'> /*@notfunction@*/</span></p>
\r
6983 <p class=Verbatim><span style='font-size:9.5pt'> # define forever for(;;)</span></p>
\r
6985 <p class=afterlist>Macros preceded by <span class=Annot><span style='font-size:
\r
6986 10.0pt'>notfunction</span></span> are expanded normally before regular checking
\r
6987 is done. If a macro that is not syntactically equivalent to a statement
\r
6988 without a semi-colon (e.g., a macro which enters a new scope) is not preceded
\r
6989 by <span class=Annot><span style='font-size:10.0pt'>notfunction</span></span>,
\r
6990 parse errors may result when <span class=Flag><span style='font-size:10.0pt'>fcn-macros</span></span> or <span
\r
6991 class=Flag><span style='font-size:10.0pt'>const-macros</span></span> is on.</p>
\r
6993 <h2 style='margin-left:0in;text-indent:0in'><a name="_Ref345771875"></a><a
\r
6994 name="_Ref345489124"></a><a name="_Toc344355423"></a><a name="_Toc534975011"></a><a
\r
6995 name="_Ref361651257"></a><a name="_Ref349897909"></a><a name="_Ref344916532"></a><a
\r
6996 name="_Ref344908410"></a><a name="_Toc344355424">11.4<span style='font:7.0pt "Times New Roman"'>
\r
6997 </span>Iterators</a></h2>
\r
6999 <p class=TextFontCX>It is often useful to be able
\r
7000 to execute the same code for many different values. For example, we may want
\r
7001 to sum all elements in an <span class=CodeText><span style='font-size:10.0pt'>intSet</span></span>
\r
7002 that represents a set of integers. If <span class=CodeText><span
\r
7003 style='font-size:10.0pt'>intSet</span></span> is an abstract type, there is no easy way of doing this in a client module without depending on the
\r
7004 concrete representation of the type. Instead, we could provide such a
\r
7005 mechanism as part of the type
\92s implementation. We call a mechanism for
\r
7006 looping through many values an <i>iterator</i>.</p>
\r
7008 <p class=TextFontCX> </p>
\r
7010 <p class=TextFontCX>The C language provides no
\r
7011 mechanism for creating user-defined iterators. Splint supports a stylized form
\r
7012 of iterators declared using syntactic comments and defined using macros.</p>
\r
7014 <p class=TextFontCX> </p>
\r
7016 <p class=TextFontCX>Iterator declarations are
\r
7017 similar to function declarations except instead of returning a value, they
\r
7018 assign values to their <span class=Annot><span style='font-size:10.0pt'>yield</span></span>
\r
7019 parameters in each iteration. For example, we could add this iterator
\r
7020 declaration to <span class=Keyword><span style='font-size:10.0pt;font-family:
\r
7021 Arial;color:windowtext'>intSet.h</span></span>:</p>
\r
7023 <p class=example>/*@iter intSet_elements (intSet s, yield int el);@*/</p>
\r
7025 <p class=TextFontCX>The <span class=Annot><span
\r
7026 style='font-size:10.0pt'>yield</span></span> annotation means that the variable
\r
7027 passed as the second actual argument is declared as a local variable of type <span
\r
7028 class=CodeText><span style='font-size:10.0pt'>int</span></span> and assigned a
\r
7029 value in each loop iteration.</p>
\r
7031 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975012">11.4.1<span
\r
7032 style='font:7.0pt "Times New Roman"'> </span>Defining
\r
7033 Iterators</a></h3>
\r
7035 <p class=beforelist>An iterator is defined using a macro. Here
\92s one (not
\r
7036 particularly efficient) way of defining <span class=CodeText><span
\r
7037 style='font-size:10.0pt'>intSet_elements</span></span>:</p>
\r
7039 <p class=Verbatim> typedef /*@abstract@*/ struct {</p>
\r
7041 <p class=Verbatim> int nelements;</p>
\r
7043 <p class=Verbatim> int *elements; </p>
\r
7045 <p class=Verbatim> } intSet;</p>
\r
7047 <p class=Verbatim>
\85</p>
\r
7049 <p class=Verbatim> # define intSet_elements(s,m_el) \</p>
\r
7051 <p class=Verbatim> { int m_i; \ </p>
\r
7053 <p class=Verbatim> for (m_i = (0); m_i <= ((s)->nelements); m_i++)
\r
7056 <p class=Verbatim> int m_el = (s)->elements[(m_i)];</p>
\r
7058 <p class=Verbatim> </p>
\r
7060 <p class=Verbatim> # define end_intSet_elements }}</p>
\r
7062 <p class=afterlist>Each time through the loop, the yield parameter <span
\r
7063 class=CodeText><span style='font-size:10.0pt'>m_el</span></span> is assigned to
\r
7064 the next value. After each value has been assigned to <span class=CodeText><span
\r
7065 style='font-size:10.0pt'>m_el</span></span> for one iteration, the loop
\r
7066 terminates. Variables declared by the iterator macro (including the <span
\r
7067 class=Annot><span style='font-size:10.0pt'>yield</span></span> parameter) are
\r
7068 preceded by the macro variable namespace prefix <span class=CodeText><span
\r
7069 style='font-size:10.0pt'>m_</span></span> (see Section 11.2) to avoid conflicts
\r
7070 with variables defined in the scope where the iterator is used.</p>
\r
7072 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975013">11.4.2<span
\r
7073 style='font:7.0pt "Times New Roman"'> </span>Using Iterators</a></h3>
\r
7075 <p class=TextFontCX>The general structure for
\r
7076 using an iterator is,</p>
\r
7078 <p class=example><i>iter</i> (<i><params></i>) stmt; end_<i>iter</i></p>
\r
7080 <p class=beforelist>For example, a client could use <span class=CodeText><span
\r
7081 style='font-size:10.0pt'>intSet_elements</span></span> to sum the elements of
\r
7082 an <span class=CodeText><span style='font-size:10.0pt'>intSet</span></span>:</p>
\r
7084 <p class=Verbatim> intSet s;</p>
\r
7086 <p class=Verbatim> int sum = 0;</p>
\r
7088 <p class=Verbatim> ...</p>
\r
7090 <p class=Verbatim> intSet_elements (s, el) { </p>
\r
7092 <p class=Verbatim style='text-indent:.5in'>sum += el; </p>
\r
7094 <p class=Verbatim> } end_intSet_elements;</p>
\r
7096 <p class=afterlist>The actual parameter corresponding to a yield parameter, <span
\r
7097 class=CodeText><span style='font-size:10.0pt'>el</span></span>, is not declared
\r
7098 in the function scope. Instead, it is declared by the iterator and assigned to
\r
7099 an appropriate value for each iteration.</p>
\r
7101 <p class=TextFontCX> </p>
\r
7103 <p class=beforelist>Splint will do the following checks for uses of stylized
\r
7106 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
7107 style='font:7.0pt "Times New Roman"'> </span></span>An
\r
7108 invocation of the iterator <span class=CodeText><i><span style='font-size:10.0pt'>iter</span></i></span>
\r
7109 must be balanced by a corresponding end, named <span class=CodeText><span
\r
7110 style='font-size:10.0pt'>end_<i>iter</i></span></span>.</p>
\r
7112 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
7113 style='font:7.0pt "Times New Roman"'> </span></span>All
\r
7114 actual parameters must be defined, except those corresponding to yield
\r
7117 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
7118 style='font:7.0pt "Times New Roman"'> </span></span>Yield
\r
7119 parameters must be new identifiers, not declared in the current scope or any
\r
7120 enclosing scope.</p>
\r
7122 <p class=afterlist>Iterators are a bit awkward to implement, but they enable
\r
7123 compact, easily understood client code. For abstract collection types, an
\r
7124 iterator can be used to enable clients to operate on elements of the collection
\r
7125 without breaking data abstraction.<a name="_Ref348845281"></a><a
\r
7126 name="_Toc344355425"></a><a name="_Ref343247905"></a></p>
\r
7128 <h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534975014"></a><a
\r
7129 name="_Ref483663681"></a><a name="_Ref350065611">12<span style='font:7.0pt "Times New Roman"'>
\r
7130 </span>Naming Conventions</a></h1>
\r
7132 <p class=TextFontCX>Naming conventions tend to be
\r
7133 a religious issue. Generally, it doesn't matter too much what naming convention
\r
7134 is followed as long as one is chosen and followed religiously. There are two
\r
7135 kinds of naming conventions supported by Splint. Type-based naming conventions
\r
7136 (Section 12.1) constrain identifier names according to the abstract types that are accessible where the identifier is defined. Prefix naming conventions
\r
7137 (Section 12.2) constrain the initial characters of identifier names according
\r
7138 to what is being declared and its scope. Naming conventions may be combined or
\r
7139 different conventions may be selected for different kinds of identifiers. In
\r
7140 addition, Splint supports checking that names do not conflict with names
\r
7141 reserved for the standard library or implementation (Section 12.3) and are
\r
7142 sufficiently distinguishable from other names. </p>
\r
7144 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975015"></a><a
\r
7145 name="_Ref348079373"></a><a name="_Ref347240654"></a><a name="_Toc344355426">12.1<span
\r
7146 style='font:7.0pt "Times New Roman"'> </span>Type-Based
\r
7147 Naming Conventions</a></h2>
\r
7149 <p class=TextFontCX>Generic naming conventions
\r
7150 constrain valid names of identifiers. By limiting valid names, namespaces may
\r
7151 be preserved and programs may be more easily understood since the name gives
\r
7152 clues as to how and where the name is defined and how it should be used.</p>
\r
7154 <p class=TextFontCX> </p>
\r
7156 <p class=TextFontCX>Names may be constrained by
\r
7157 the scope of the name (external, file static, internal), the file in which the
\r
7158 identifier is defined, the type of the identifier, and global constraints.</p>
\r
7160 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975016"></a><a
\r
7161 name="_Ref347994687">12.1.1<span style='font:7.0pt "Times New Roman"'>
\r
7162 </span>Czech Names</a></h3>
\r
7164 <p class=TextFontCX>Czech<a href="#_ftn17" name="_ftnref17" title=""><span class=MsoFootnoteReference><span
\r
7165 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>
\r
7166 names denote operations and variables of abstract types by preceding the names
\r
7167 by <span class=CodeText><i><span style='font-size:10.0pt'><type></span></i></span><span
\r
7168 class=CodeText><span style='font-size:10.0pt'>_</span></span>. The remainder
\r
7169 of the name should begin with a lowercase character, but may use any other
\r
7170 character besides the underscore. Types may be named using any non-underscore
\r
7173 <p class=TextFontCX> </p>
\r
7175 <p class=TextFontCX style='margin-bottom:6.0pt'>The
\r
7176 Czech naming convention is selected by the <span class=Flag><span
\r
7177 style='font-size:10.0pt'>czech</span></span> flag. If <span
\r
7178 class=Flag><span style='font-size:10.0pt'>access-czech</span></span> is on, a function, variable, constant or iterator named <span class=CodeText><i><span
\r
7179 style='font-size:10.0pt'><type></span></i></span><span class=CodeText><span
\r
7180 style='font-size:10.0pt'>_<i><name></i></span></span> has access to the
\r
7181 abstract type <span
\r
7182 class=CodeText><i><span style='font-size:10.0pt'><type></span></i></span>.
\r
7183 Reporting of violations of the Czech naming convention is controlled by
\r
7184 different flags depending on what is being declared:</p>
\r
7186 <p class=TextFontCX><span class=Flag><span
\r
7187 style='font-size:10.0pt'>czech-fcns</span></span></p>
\r
7189 <p class=TextFontCX style='margin-left:13.5pt'>Functions
\r
7190 and iterators. An error is reported for a function name of the form <span
\r
7191 class=CodeText><i><span style='font-size:10.0pt'><prefix></span></i></span><span
\r
7192 class=CodeText><span style='font-size:10.0pt'>_<i><name></i></span></span>
\r
7193 where <span class=CodeText><i><span style='font-size:10.0pt'><prefix></span></i></span>
\r
7194 is not the name of an accessible type. Note that if <span class=Flag><span
\r
7195 style='font-size:10.0pt'>accessczech</span></span> is on, a type named <span class=CodeText><i><span style='font-size:10.0pt'><prefix></span></i></span>
\r
7196 would be accessible in a function beginning with <span class=CodeText><i><span
\r
7197 style='font-size:10.0pt'><prefix></span></i></span><span class=CodeText><span
\r
7198 style='font-size:10.0pt'>_</span></span>. If <span class=Flag><span
\r
7199 style='font-size:10.0pt'>access-czech</span></span> is off, an error is
\r
7200 reported instead. An error is reported for a function name that does not have
\r
7201 an underscore if any abstract types are accessible where the function is
\r
7204 <p class=TextFontCX><span class=Flag><span
\r
7205 style='font-size:10.0pt'>czech-vars</span></span></p>
\r
7207 <p class=TextFontCX><span class=Flag><span
\r
7208 style='font-size:10.0pt'>czech-constants</span></span></p>
\r
7210 <p class=TextFontCX><span class=Flag><span
\r
7211 style='font-size:10.0pt'>czech-macros</span></span></p>
\r
7213 <p class=IndentText>Variables, constants and expanded macros. An error is
\r
7214 reported if the identifier name starts with <span class=CodeText><i><span
\r
7215 style='font-size:10.0pt'><prefix></span></i></span><span class=CodeText><span
\r
7216 style='font-size:10.0pt'>_</span></span><span class=Keyword><span
\r
7217 style='font-size:10.0pt'> </span></span>and <span class=CodeText><i><span
\r
7218 style='font-size:10.0pt'>prefix</span></i></span> is not the name of an
\r
7219 accessible abstract type, or if an abstract type is accessible and the
\r
7220 identifier name does not begin with <span class=CodeText><i><span
\r
7221 style='font-size:10.0pt'><type></span></i></span><span class=CodeText><span
\r
7222 style='font-size:10.0pt'>_</span></span> where <span class=CodeText><i><span
\r
7223 style='font-size:10.0pt'>type</span></i></span> is the name of an accessible abstract
\r
7224 type. If <span class=Flag><span style='font-size:10.0pt'>access-czech</span></span> is on, the representation of the type is visible in the constant or variable definition.</p>
\r
7226 <p class=TextFontCX><span class=Flag><span
\r
7227 style='font-size:10.0pt'>czech-types</span></span></p>
\r
7229 <p class=TextFontCX style='margin-left:13.5pt'>User-defined
\r
7230 types. An error is reported if a type name includes an underscore character.</p>
\r
7232 <p class=Sidebar align=right>Of course, this is a complete jumble to the uninitiated, and
\r
7233 that
\92s the joke.</p>
\r
7234 <p class=Sidebar align=right style='text-align:right'><i>Charles Simonyi, on
\r
7235 the Hungarian naming convention</i></p>
\r
7237 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975017"></a><a
\r
7238 name="_Ref344878566">12.1.2<span style='font:7.0pt "Times New Roman"'>
\r
7239 </span>Slovak Names</a></h3>
\r
7241 <p class=TextFontCX>Slovak names are similar to Czech names, except they are spelled differently. A Slovak name
\r
7242 is of the form <span class=CodeText><i><span style='font-size:10.0pt'><type><Name></span></i></span>.
\r
7243 The type prefix may not use uppercase characters. The remainder of the name
\r
7244 starts with the first uppercase character.</p>
\r
7246 <p class=TextFontCX> </p>
\r
7248 <p class=TextFontCX>The <span class=Flag><span
\r
7249 style='font-size:10.0pt'>slovak</span></span> flag selects the Slovak naming convention. Like Czech names, it may be used with <span class=Flag><span style='font-size:10.0pt'>access-slovak</span></span> to control access to abstract representations. The <span
\r
7250 class=Flag><span style='font-size:10.0pt'>slovak-fcns</span></span>, <span
\r
7251 class=Flag><span style='font-size:10.0pt'>slovak-vars</span></span>, <span
\r
7252 class=Flag><span style='font-size:10.0pt'>slovak-constants</span></span>, and <span
\r
7253 class=Flag><span style='font-size:10.0pt'>slovak-macros</span></span> flags are analogous to the similar Czech flags. If <span
\r
7254 class=Flag><span style='font-size:10.0pt'>slovak-type</span></span> is on, an
\r
7255 error is reported if a type name includes an uppercase letter.<span class=Flag><span
\r
7256 style='font-size:10.0pt'> </span></span></p>
\r
7258 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975018"></a><a
\r
7259 name="_Ref347994743">12.1.3<span style='font:7.0pt "Times New Roman"'>
\r
7260 </span>Czechoslovak Names</a></h3>
\r
7262 <p class=TextFontCX>Czechoslovak names are a combination of Czech names and Slovak names. Operations may be
\r
7263 named either <span class=CodeText><i><span style='font-size:10.0pt'><type></span></i></span><span
\r
7264 class=CodeText><span style='font-size:10.0pt'>_</span></span> followed by any
\r
7265 sequence of non-underscore characters, or <span class=CodeText><i><span
\r
7266 style='font-size:10.0pt'><type></span></i></span> followed by an
\r
7267 uppercase letter and any sequence of characters. Czechoslovak names have been
\r
7268 out of favor since 1993, but may be necessary for checking legacy code. The <span
\r
7269 class=Flag><span style='font-size:10.0pt'>czechoslovak-fcns</span></span>, <span
\r
7270 class=Flag><span style='font-size:10.0pt'>czechoslovak-vars</span></span>, <span
\r
7271 class=Flag><span style='font-size:10.0pt'>czechoslovak-macros</span></span>, and <span
\r
7272 class=Flag><span style='font-size:10.0pt'>czechoslovak-constants</span></span>
\r
7273 flags are analogous to the similar Czech flags. If <span class=Flag><span
\r
7274 style='font-size:10.0pt'>czechoslovak-type</span></span> is on, an error is reported if a type name contains either an uppercase letter or
\r
7275 an underscore character.</p>
\r
7277 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975019"></a><a
\r
7278 name="_Ref347240687"></a><a name="_Ref347222192">12.2<span style='font:7.0pt "Times New Roman"'>
\r
7279 </span>Namespace Prefixes</a></h2>
\r
7281 <p class=TextFontCX>Another way to restrict names
\r
7282 is to constrain the leading character sequences of various kinds of
\r
7283 identifiers. For example, the names of all user-defined types might begin with
\r
7284 <span class=CodeText><span style='font-size:10.0pt'>T</span></span> followed by
\r
7285 an uppercase letter and all file static names begin with an uppercase letter.
\r
7286 This may be useful for enforcing a namespace (e.g., all names exported by the
\r
7287 X-windows library should begin with <span class=CodeText><span
\r
7288 style='font-size:10.0pt'>X</span></span>) or just making programs easier to
\r
7289 understand by establishing an enforced convention. Splint can be used to
\r
7290 constrain identifiers in this way to detect identifiers inconsistent with
\r
7293 <p class=TextFontCX> </p>
\r
7295 <p class=TextFontCX>All namespace flags are of
\r
7296 the form, <span class=Flag><span style='font-size:10.0pt'>-<i><context></i>prefix
\r
7297 <i><string></i></span></span>. For example, the macro variable namespace
\r
7298 restricting identifiers declared in macro bodies to be preceded by <span
\r
7299 class=CodeText><span style='font-size:10.0pt'>m_</span></span> would be
\r
7300 selected by <span class=Flag><span style='font-size:10.0pt'>-macrovarprefix </span></span><span
\r
7301 class=Flag><span style='font-size:10.0pt'>"m_"</span></span>. The
\r
7302 string may contain regular characters that may appear in a C identifier. These
\r
7303 must match the initial characters of the identifier name. In addition, special
\r
7304 characters (shown in Figure 23) can be used to denote a class of characters.<a
\r
7305 href="#_ftn18" name="_ftnref18" title=""><span class=MsoFootnoteReference><span
\r
7306 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>
\r
7307 The <span class=CodeText><span style='font-size:10.0pt'>*</span></span>
\r
7308 character may be used at the end of a prefix string to specify the rest of the
\r
7309 identifier is zero or more characters matching the character immediately before
\r
7310 the <span class=CodeText><span style='font-size:10.0pt'>*</span></span>. For
\r
7311 example, the prefix string <span class=CodeText><span style='font-size:10.0pt'>T&*</span></span>
\r
7312 matches <span class=CodeText><span style='font-size:10.0pt'>T</span></span> or <span
\r
7313 class=CodeText><span style='font-size:10.0pt'>TWINDOW</span></span> but not <span
\r
7314 class=CodeText><span style='font-size:10.0pt'>Twin</span></span>.</p>
\r
7316 <p class=beforelist> </p>
\r
7318 <p class=beforelist>Different prefixes can be selected for the following
\r
7319 identifier contexts:</p>
\r
7321 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
7322 style='margin-left:.45in;border-collapse:collapse'>
\r
7324 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7325 <p class=TextFontCX><span class=Flag><span
\r
7326 style='font-size:10.0pt'>macro-var-prefix</span></span></p>
\r
7328 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7329 <p class=TextFontCX>Any variable declared inside
\r
7334 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7335 <p class=TextFontCX><span class=Flag><span
\r
7336 style='font-size:10.0pt'>unchecked-macro-prefix</span></span></p>
\r
7338 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7339 <p class=TextFontCX>Any macro that is not
\r
7340 checked as a function or constant (see Section 11.4)</p>
\r
7344 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7345 <p class=TextFontCX><span class=Flag><span
\r
7346 style='font-size:10.0pt'>tag-prefix</span></span></p>
\r
7348 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7349 <p class=TextFontCX>Tags for <span
\r
7350 class=CodeText><span style='font-size:10.0pt'>struct</span></span>, <span
\r
7351 class=CodeText><span style='font-size:10.0pt'>union</span></span> and <span
\r
7352 class=CodeText><span style='font-size:10.0pt'>enum</span></span> declarations</p>
\r
7356 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7357 <p class=TextFontCX><span class=Flag><span
\r
7358 style='font-size:10.0pt'>enum-prefix</span></span></p>
\r
7360 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7361 <p class=TextFontCX>Members of <span
\r
7362 class=CodeText><span style='font-size:10.0pt'>enum</span></span> types</p>
\r
7366 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7367 <p class=TextFontCX><span class=Flag><span
\r
7368 style='font-size:10.0pt'>type-prefix</span></span></p>
\r
7370 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7371 <p class=TextFontCX>Name of a user-defined type</p>
\r
7375 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7376 <p class=TextFontCX><span class=Flag><span
\r
7377 style='font-size:10.0pt'>file-static-prefix</span></span></p>
\r
7379 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7380 <p class=TextFontCX>Any identifier with file
\r
7385 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7386 <p class=TextFontCX><span class=Flag><span
\r
7387 style='font-size:10.0pt'>glob-var-prefix</span></span></p>
\r
7389 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7390 <p class=TextFontCX>Any variable (not of
\r
7391 function type) with global scope</p>
\r
7395 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7396 <p class=TextFontCX><span class=Flag><span
\r
7397 style='font-size:10.0pt'>const-prefix</span></span></p>
\r
7399 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7400 <p class=TextFontCX>Any constant (see Section 11.1)</p>
\r
7404 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7405 <p class=TextFontCX><span class=Flag><span
\r
7406 style='font-size:10.0pt'>iter-prefix</span></span></p>
\r
7408 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7409 <p class=TextFontCX>An iterator (see Section 11.4)</p>
\r
7413 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7414 <p class=TextFontCX><span class=Flag><span
\r
7415 style='font-size:10.0pt'>proto-param-prefix</span></span></p>
\r
7417 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7418 <p class=TextFontCX>A parameter in a function
\r
7419 declaration prototype</p>
\r
7423 <td valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
\r
7424 <p class=TextFontCX><span class=Flag><span
\r
7425 style='font-size:10.0pt'>external-prefix</span></span></p>
\r
7427 <td valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7428 <p class=TextFontCX>Any exported identifier</p>
\r
7433 <p class=afterlist>If an identifier is in more than one of the namespace
\r
7434 contexts, the most specific defined namespace prefix is used (e.g., a global variable is also an exported identifier, so if <span class=Flag><span
\r
7435 style='font-size:10.0pt'>global-var-prefix</span></span> is set, it is checked
\r
7436 against the variable name; if not, the identifier is checked against the <span
\r
7437 class=Flag><span style='font-size:10.0pt'>external-prefix</span></span>.)</p>
\r
7439 <p class=TextFontCX> </p>
\r
7441 <p class=TextFontCX>For each prefix flag, a
\r
7442 corresponding flag named <span class=Flag><i><span style='font-size:10.0pt'><prefixname></span></i></span><span
\r
7443 class=Flag><span style='font-size:10.0pt'>exclude</span></span> controls
\r
7444 whether errors are reported if identifiers in a different namespace match the
\r
7445 namespace prefix. For example, if <span class=Flag><span style='font-size:
\r
7446 10.0pt'>macro-var-prefix-exclude</span></span> is on, Splint checks that no identifier that is not a variable declared inside a macro body uses the macro variable prefix. </p>
\r
7448 <p class=TextFontCX> </p>
\r
7450 <p class=beforelist>Here is a (somewhat draconian) sample naming convention:</p>
\r
7452 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
7453 style='margin-left:5.4pt;border-collapse:collapse'>
\r
7455 <td valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7456 <p class=TextFontCX><span class=Flag><span
\r
7457 style='font-size:10.0pt'>-unchecked-macro-prefix </span></span><span
\r
7458 class=Flag><span style='font-size:10.0pt'>"~*"</span></span></p>
\r
7460 <td valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7461 <p class=TextFontCX>Unchecked macros have no
\r
7462 lowercase letters.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
7466 <td valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7467 <p class=TextFontCX><span class=Flag><span
\r
7468 style='font-size:10.0pt'>-type-prefix </span></span><span
\r
7469 class=Flag><span style='font-size:10.0pt'>"T^&*"</span></span></p>
\r
7471 <td valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7472 <p class=TextFontCX>All type names begin with <span
\r
7473 class=CodeText><span style='font-size:10.0pt'>T</span></span> followed by an
\r
7474 uppercase letter. The rest of the name is all lowercase letters.</p>
\r
7478 <td valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7479 <p class=TextFontCX><span class=Flag><span
\r
7480 style='font-size:10.0pt'>+type-prefix-exclude</span></span></p>
\r
7482 <td valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7483 <p class=TextFontCX>No identifier that does not
\r
7484 name a user-defined type name begins with the type name prefix.</p>
\r
7488 <td valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7489 <p class=TextFontCX><span class=Flag><span
\r
7490 style='font-size:10.0pt'>-file-static-prefix </span></span><span
\r
7491 class=Flag><span style='font-size:10.0pt'>"^&&&"</span></span></p>
\r
7493 <td valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7494 <p class=TextFontCX>File static scope variables
\r
7495 begin with an uppercase letter and three lowercase letters.</p>
\r
7499 <td valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7500 <p class=TextFontCX><span class=Flag><span
\r
7501 style='font-size:10.0pt'>-proto-param-prefix "p_"</span></span></p>
\r
7503 <td valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7504 <p class=TextFontCX>All parameters in
\r
7505 prototypes must begin with <span class=CodeText><span style='font-size:10.0pt'>p_</span></span>.</p>
\r
7509 <td valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7510 <p class=TextFontCX><span class=Flag><span
\r
7511 style='font-size:10.0pt'>-glob-var-prefix "G"</span></span></p>
\r
7513 <td valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7514 <p class=TextFontCX>All global variables start
\r
7515 with <span class=CodeText><span style='font-size:10.0pt'>G</span></span>.</p>
\r
7519 <td valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7520 <p class=TextFontCX><span class=Flag><span
\r
7521 style='font-size:10.0pt'>+glob-var-prefix-exclude</span></span></p>
\r
7523 <td valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
\r
7524 <p class=TextFontCX>No identifier that is not a
\r
7525 global variable starts with <span class=CodeText><span style='font-size:10.0pt'>G</span></span>.</p>
\r
7530 <p class=beforelist> </p>
\r
7532 <p class=beforelist>The prefix for parameters in function prototypes is useful
\r
7533 for making sure parameter names are not in conflict with macros defined before
\r
7534 the function prototype. In most cases, it may be preferable to not name
\r
7535 prototype parameters. If the <span class=Flag><span style='font-size:10.0pt'>proto-param-name</span></span> flag is set, an error is reported for any named parameter in a prototype declaration. If a <span class=Flag><span style='font-size:10.0pt'>proto-param-prefix</span></span> is set, no error is reported for unnamed parameters.</p>
\r
7537 <p class=TextFontCX>It may also be useful to
\r
7538 check the names of prototype parameters correspond to the names in
\r
7539 definitions. While using header files as documentation is not generally
\r
7540 recommended, it is common enough practice that it makes sense to check that
\r
7541 parameter names are consistent. A discrepancy may indicate an error in the
\r
7542 parameter order in the function prototype. If <span class=Flag><span
\r
7543 style='font-size:10.0pt'>proto-param-match</span></span> is set, Splint will report an error if the name of a definition parameter does not match the corresponding prototype parameter (after removing the <span class=Flag><span
\r
7544 style='font-size:10.0pt'>protoparamprefix</span></span>).</p>
\r
7548 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
7549 style='margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt;
\r
7550 margin-right:-2.25pt'>
\r
7552 <td valign=top style='width:22.0pt;border-top:solid black 1.5pt;
\r
7553 border-left:solid black 1.5pt;border-bottom:none;border-right:none;
\r
7554 padding:0in 5.4pt 0in 5.4pt'>
\r
7555 <p class=TextFontCX><span class=CodeText><span
\r
7556 style='font-size:10.0pt'>^</span></span></p>
\r
7558 <td valign=top style='width:401.55pt;border-top:solid black 1.5pt;
\r
7559 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
7560 padding:0in 5.4pt 0in 5.4pt'>
\r
7561 <p class=TextFontCX>Any uppercase letter, <span
\r
7562 class=CodeText><span style='font-size:10.0pt'>A</span></span>-<span
\r
7563 class=CodeText><span style='font-size:10.0pt'>Z</span></span></p>
\r
7567 <td valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;
\r
7568 padding:0in 5.4pt 0in 5.4pt'>
\r
7569 <p class=TextFontCX><span class=CodeText><span
\r
7570 style='font-size:10.0pt'>&</span></span></p>
\r
7572 <td valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;
\r
7573 padding:0in 5.4pt 0in 5.4pt'>
\r
7574 <p class=TextFontCX>Any lowercase letter, <span
\r
7575 class=CodeText><span style='font-size:10.0pt'>a</span></span>-<span
\r
7576 class=CodeText><span style='font-size:10.0pt'>z</span></span></p>
\r
7580 <td valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;
\r
7581 padding:0in 5.4pt 0in 5.4pt'>
\r
7582 <p class=TextFontCX><span class=CodeText><span
\r
7583 style='font-size:10.0pt'>%</span></span></p>
\r
7585 <td valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;
\r
7586 padding:0in 5.4pt 0in 5.4pt'>
\r
7587 <p class=TextFontCX>Any character that is not
\r
7588 an uppercase letter (allows lowercase letters, digits and underscore)</p>
\r
7592 <td valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;
\r
7593 padding:0in 5.4pt 0in 5.4pt'>
\r
7594 <p class=TextFontCX><span class=CodeText><span
\r
7595 style='font-size:10.0pt'>~</span></span></p>
\r
7597 <td valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;
\r
7598 padding:0in 5.4pt 0in 5.4pt'>
\r
7599 <p class=TextFontCX>Any character that is not a
\r
7600 lowercase letter (allows uppercase letters, digits and underscore)</p>
\r
7604 <td valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;
\r
7605 padding:0in 5.4pt 0in 5.4pt'>
\r
7606 <p class=TextFontCX><span class=CodeText><span
\r
7607 style='font-size:10.0pt'>$</span></span></p>
\r
7609 <td valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;
\r
7610 padding:0in 5.4pt 0in 5.4pt'>
\r
7611 <p class=TextFontCX>Any letter (<span
\r
7612 class=CodeText><span style='font-size:10.0pt'>a</span></span>-<span
\r
7613 class=CodeText><span style='font-size:10.0pt'>z</span></span>, <span
\r
7614 class=CodeText><span style='font-size:10.0pt'>A</span></span>-<span
\r
7615 class=CodeText><span style='font-size:10.0pt'>Z</span></span>)</p>
\r
7619 <td valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;
\r
7620 padding:0in 5.4pt 0in 5.4pt'>
\r
7621 <p class=TextFontCX><span class=CodeText><span
\r
7622 style='font-size:10.0pt'>/</span></span></p>
\r
7624 <td valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;
\r
7625 padding:0in 5.4pt 0in 5.4pt'>
\r
7626 <p class=TextFontCX>Any letter or digit (<span
\r
7627 class=CodeText><span style='font-size:10.0pt'>A</span></span>-<span
\r
7628 class=CodeText><span style='font-size:10.0pt'>Z</span></span>, <span
\r
7629 class=CodeText><span style='font-size:10.0pt'>a</span></span>-<span
\r
7630 class=CodeText><span style='font-size:10.0pt'>z</span></span>, <span
\r
7631 class=CodeText><span style='font-size:10.0pt'>0</span></span>-<span
\r
7632 class=CodeText><span style='font-size:10.0pt'>9</span></span>)</p>
\r
7636 <td valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;
\r
7637 padding:0in 5.4pt 0in 5.4pt'>
\r
7638 <p class=TextFontCX><span class=CodeText><span
\r
7639 style='font-size:10.0pt'>?</span></span></p>
\r
7641 <td valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;
\r
7642 padding:0in 5.4pt 0in 5.4pt'>
\r
7643 <p class=TextFontCX>Any character valid in a C
\r
7648 <td valign=top style='width:22.0pt;border-top:none;border-left:solid black 1.5pt;
\r
7649 border-bottom:solid black 1.5pt;border-right:none;padding:0in 5.4pt 0in 5.4pt'>
\r
7650 <p class=TextFontCX><span class=CodeText><span
\r
7651 style='font-size:10.0pt'>#</span></span></p>
\r
7653 <td valign=top style='width:401.55pt;border-top:none;border-left:
\r
7654 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
7655 padding:0in 5.4pt 0in 5.4pt'>
\r
7656 <p class=TextFontCX style='page-break-after:
\r
7657 avoid'>Any digit, <span class=CodeText><span style='font-size:10.0pt'>0</span></span>-<span
\r
7658 class=CodeText><span style='font-size:10.0pt'>9</span></span></p>
\r
7663 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
7665 <td valign=top style='padding-top:0in;padding-right:
\r
7666 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
7667 <p class=MsoCaption><a name="_Toc534824625"></a><a name="_Ref347220245"></a><a
\r
7668 name="_Ref347220226"></a><a name="_Toc347255399"></a><a name="_Ref347222037"></a><a
\r
7669 name="_Ref347222045"></a><a name="_Ref534824531">Figure 23</a>. Prefix Character
\r
7676 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975020"></a><a
\r
7677 name="_Ref348079479"></a><a name="_Ref347240790"></a><a name="_Toc344355427">12.3<span
\r
7678 style='font:7.0pt "Times New Roman"'> </span>Naming
\r
7679 Restrictions</a></h2>
\r
7681 <p class=TextFontCX>Additional naming restrictions can be used to check that names do no conflict with names reserved for the standard library, and that identifier are sufficiently distinct (either for
\r
7682 the compiler and linker, or for the programmer.) Restrictions may be different
\r
7683 for names that are needed by the linker (<i>external</i> names) and names that
\r
7684 are only needed during compilations (<i>internal</i> names). Names of non-<span
\r
7685 class=CodeText><span style='font-size:10.0pt'>static</span></span> functions
\r
7686 and global variables are external; all other names are internal.</p>
\r
7688 <p class=Sidebar align=right><a name="_Ref350062822"></a><a name="_Ref348845288"></a><a
\r
7689 name="_Toc344355429"></a><a name="_Ref343248602"> </a></p>
\r
7690 <p class=Sidebar align=right>The decision to retain the old six-character
\r
7691 case-insensitive restriction on significance was most painful.</p>
\r
7692 <p class=Sidebar align=right style='text-align:right'><i>ANSI C Rationale</i></p>
\r
7694 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975021">12.3.1<span
\r
7695 style='font:7.0pt "Times New Roman"'> </span>Reserved Names</a></h3>
\r
7697 <p class=TextFontCX>Many names are reserved for the implementation and standard library. A complete list of reserved names can be found in [vdL, p. 126-128]. Some name prefixes such as <span
\r
7698 class=CodeText><span style='font-size:10.0pt'>str</span></span> followed by a
\r
7699 lowercase character are reserved for future library extensions. Most C
\r
7700 compilers do not detect naming conflicts, and they can lead to unpredictable
\r
7701 program behavior. If <span class=Flag><span style='font-size:10.0pt'>ansi-reserved</span></span>
\r
7702 is on, Splint warns about external names that conflict with reserved names. If
\r
7703 <span class=Flag><span style='font-size:10.0pt'>ansi-reserved-internal</span></span> is on, warnings are also produced for internal names.</p>
\r
7705 <p class=TextFontCX> </p>
\r
7707 <p class=TextFontCX>If <span class=Flag><span
\r
7708 style='font-size:10.0pt'>+cpp-names</span></span> is set, Splint warns about
\r
7709 identifier names that are keywords or reserved words in C++. This is useful if
\r
7710 the code may later be compiled with a C++ compiler (of course, this is not
\r
7711 enough to ensure the meaning of the code is not changed when it is compiled as
\r
7714 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975022">12.3.2<span
\r
7715 style='font:7.0pt "Times New Roman"'> </span>Distinct Names</a></h3>
\r
7717 <p class=TextFontCX>Splint can check that names differ within a given number of characters, optionally ignoring alphabetic
\r
7718 case and differences between characters that look similar. The number of
\r
7719 significant characters may be different for external and internal names. </p>
\r
7721 <p class=TextFontCX> </p>
\r
7723 <p class=TextFontCX>Using <span class=Flag><span
\r
7724 style='font-size:10.0pt'>+distinct-external-names</span></span> sets the number of significant characters for external names to six and makes alphabetical case insignificant for external names. This is the minimum significance acceptable in an
\r
7725 ANSI-conforming compiler. Most modern compilers exceed these minimums (which
\r
7726 are particularly hard to follow if one uses the Czech or Slovak naming convention). The number of significant characters can be changed using the <span class=Flag><span
\r
7727 style='font-size:10.0pt'>external-name-length <i><number></i></span></span>
\r
7728 flag. If <span class=Flag><span style='font-size:10.0pt'>external-name-case-insensitive</span></span>
\r
7729 is on, alphabetical case is ignored in comparing external names. Splint reports
\r
7730 identifiers that differ only in alphabetic case. </p>
\r
7732 <p class=TextFontCX>For internal identifiers, a
\r
7733 conforming compiler must recognize at least 31 characters and treat
\r
7734 alphabetical cases distinctly. Nevertheless, it may still be useful to check
\r
7735 that internal names are more distinct then required by the compiler to minimize
\r
7736 the likelihood that identifiers are confused in the program. Analogously to
\r
7737 external names, the <span class=Flag><span style='font-size:10.0pt'>internal-name-length</span></span><span class=Flag><span style='font-size:10.0pt'> <i><number></i></span></span>
\r
7738 flag sets the number of significant characters in an internal name and <span
\r
7739 class=Flag><span style='font-size:10.0pt'>internal-name-case-insensitive</span></span>
\r
7740 sets the case sensitivity. The <span class=Flag><span style='font-size:10.0pt'>internal-name-look-alike</span></span>
\r
7741 flag further restricts distinctions between identifiers. When set,
\r
7742 similar-looking characters match
\97 the lowercase letter <span class=CodeText><span
\r
7743 style='font-size:10.0pt'>l</span></span> matches the uppercase letter <span
\r
7744 class=CodeText><span style='font-size:10.0pt'>I</span></span> and the number <span
\r
7745 class=CodeText><span style='font-size:10.0pt'>1</span></span>; the letter <span
\r
7746 class=CodeText><span style='font-size:10.0pt'>O</span></span> or <span
\r
7747 class=CodeText><span style='font-size:10.0pt'>o</span></span> matches the
\r
7748 number <span class=CodeText><span style='font-size:10.0pt'>0</span></span>; <span
\r
7749 class=CodeText><span style='font-size:10.0pt'>5</span></span> matches <span
\r
7750 class=CodeText><span style='font-size:10.0pt'>S</span></span>; and <span
\r
7751 class=CodeText><span style='font-size:10.0pt'>2</span></span> matches <span
\r
7752 class=CodeText><span style='font-size:10.0pt'>Z</span></span>. Identifiers
\r
7753 that are not distinct except for look-alike characters will produce an error
\r
7754 message. External names are also internal names, so they must satisfy both the
\r
7755 external and internal distinct identifier checks. Figure 24 provides some examples of distinct name checking.</p>
\r
7758 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
7759 style='margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt;
\r
7760 margin-right:-2.25pt'>
\r
7762 <td valign=top style='width:166.5pt;border:solid black 1.5pt;
\r
7763 border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
7764 <p class=TextFontCX align=center
\r
7765 style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;
\r
7766 color:white'>names.c</span></b></span></p>
\r
7768 <td valign=top style='width:256.5pt;border-top:solid black 1.5pt;
\r
7769 border-left:none;border-bottom:none;border-right:solid black 1.5pt;
\r
7770 background:black;padding:0in 5.4pt 0in 5.4pt'>
\r
7771 <p class=TextFontCX align=center
\r
7772 style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>
\r
7776 <td valign=top style='width:166.5pt;border:solid black 1.5pt;
\r
7777 border-top:none;padding:0in 5.4pt 0in 5.4pt'>
\r
7778 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> </span></span>char
\r
7779 *stringrev (char *s);</p>
\r
7780 <p class=Verbatim> </p>
\r
7781 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>3</span></span>
\r
7783 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> </span></span> {</p>
\r
7784 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>5</span></span>
\r
7785 int lookalike = 1;</p>
\r
7786 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>6</span></span>
\r
7787 int looka1ike = 2;</p>
\r
7788 <p class=Verbatim> </p>
\r
7789 <p class=Verbatim> if (x > 3)</p>
\r
7790 <p class=Verbatim> {</p>
\r
7791 <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10</span></span>
\r
7792 int x = lookalike;</p>
\r
7793 <p class=Verbatim> x += looka1ike;</p>
\r
7794 <p class=Verbatim> }</p>
\r
7795 <p class=Verbatim> </p>
\r
7796 <p class=Verbatim> return x;</p>
\r
7797 <p class=Verbatim>} </p>
\r
7799 <td valign=top style='width:256.5pt;border-top:none;border-left:
\r
7800 none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;
\r
7801 padding:0in 5.4pt 0in 5.4pt'>
\r
7802 <p class=lclintrun>> splint names.c
\r
7803 +distinctinternalnames </p>
\r
7804 <p class=lclintrun> +internalnamelookalike +isoreserved</p>
\r
7805 <p class=lclintrun> </p>
\r
7806 <p class=lclintrun>names.c:1: Name stringreverse is reserved for future</p>
\r
7807 <p class=lclintrun> library extensions. Functions that begin with</p>
\r
7808 <p class=lclintrun> "str" and a lowercase letter may be added to</p>
\r
7809 <p class=lclintrun> <stdlib.h> or <string.h>. (ISO99:7.26.9)</p>
\r
7810 <p class=lclintrun>names.c:6: Internal identifier looka1ike is not</p>
\r
7811 <p class=lclintrun> distinguishable from lookalike except by lookalike</p>
\r
7812 <p class=lclintrun> characters</p>
\r
7813 <p class=lclintrun> names.c:5: Declaration of lookalike</p>
\r
7814 <p class=lclintrun>names.c:10: Variable x shadows outer declaration</p>
\r
7815 <p class=lclintrun style='page-break-after:avoid'> names.c:3: Previous
\r
7816 declaration of x: int</p>
\r
7821 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
7823 <td valign=top style='padding-top:5.05pt;padding-right:
\r
7824 9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>
\r
7825 <p class=MsoCaption><a name="_Ref343085825"></a><a name="_Ref343085797"></a><a
\r
7826 name="_Ref343065542"></a><a name="_Ref349992283"></a><a name="_Ref534642902"></a><a
\r
7827 name="_Ref534642319"></a><a name="_Toc534824626"></a><a name="_Ref534823650">Figure
\r
7828 24</a>. Distinct Names</p>
\r
7834 <h1 style='margin-left:0in;text-indent:0in'><a name="_Ref534981356"></a><a
\r
7835 name="_Ref534978939"></a><a name="_Toc534975023">13<span style='font:7.0pt "Times New Roman"'>
\r
7836 </span>Completeness</a></h1>
\r
7838 <p class=TextFontCX>Splint can report warnings for unused declarations and exported declarations that are not used externally.</p>
\r
7840 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975024"></a><a
\r
7841 name="_Ref534744216">13.1<span style='font:7.0pt "Times New Roman"'>
\r
7842 </span>Unused Declarations</a></h2>
\r
7844 <p class=TextFontCX>Splint detects constants,
\r
7845 functions, parameters, variables, types, enumerator members, and structure or
\r
7846 union fields that are declared but never used. The flags <span class=Flag><span
\r
7847 style='font-size:10.0pt'>constuse</span></span>, <span
\r
7848 class=Flag><span style='font-size:10.0pt'>fcnuse</span></span>, <span
\r
7849 class=Flag><span style='font-size:10.0pt'>paramuse</span></span>, <span
\r
7850 class=Flag><span style='font-size:10.0pt'>varuse</span></span>, <span
\r
7851 class=Flag><span style='font-size:10.0pt'>typeuse</span></span>, <span
\r
7852 class=Flag><span style='font-size:10.0pt'>enummemuse</span></span> and <span class=Flag><span style='font-size:10.0pt'>fielduse</span></span> control whether unused declaration errors are reported for each kind of
\r
7853 declaration. Errors for exported declarations are reported only if <span
\r
7854 class=Flag><span style='font-size:10.0pt'>topuse</span></span> is on (see Section 13.2).</p>
\r
7856 <p class=TextFontCX><a name="_Ref349900444"></a><a
\r
7857 name="_Ref349850608"></a><a name="_Ref349850429"> </a></p>
\r
7859 <p class=TextFontCX>The <span class=Annot><span
\r
7860 style='font-size:10.0pt'>/*@unused@*/</span></span> annotation can be used before a declaration to indicate that the item declared need
\r
7861 not be used. Unused declaration errors are not reported for identifiers
\r
7862 declared with <span class=Annot><span style='font-size:10.0pt'>unused</span></span><a
\r
7863 name="_Toc344355432"></a><a name="_Ref343110935">.</a></p>
\r
7865 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975025"></a><a
\r
7866 name="_Toc344355433"></a><a name="_Ref343110504">13.2<span style='font:7.0pt "Times New Roman"'>
\r
7867 </span>Complete </a>Programs</h2>
\r
7869 <p class=TextFontCX>Splint can be used on both complete and partial programs. When checking complete programs, additional checks can
\r
7870 be done to ensure that every identifier declared by the program is defined and
\r
7871 used, and that functions that do not need to be exported are declared <span
\r
7872 class=CodeText><span style='font-size:10.0pt'>static</span></span>. </p>
\r
7874 <p class=TextFontCX> </p>
\r
7876 <p class=TextFontCX>Splint checks that all
\r
7877 declared variables and functions are defined (controlled by <span class=Flag><span
\r
7878 style='font-size:10.0pt'>compdef</span></span><span
\r
7879 class=Flag><span style='font-size:10.0pt'>)</span></span>. Declarations of
\r
7880 functions and variables that are defined in an external library, may be
\r
7881 preceded by <span class=Annot><span style='font-size:10.0pt'>/*@external@*/</span></span> to suppress undefined declaration errors.</p>
\r
7883 <p class=TextFontCX> </p>
\r
7885 <p class=TextFontCX>Splint reports external
\r
7886 declarations that are unused (controlled by <span class=Flag><span
\r
7887 style='font-size:10.0pt'>topuse</span></span>). Which declarations are reported also depends on the declaration use flags (Section 13.1). The <span
\r
7888 class=Flag><span style='font-size:10.0pt'>+partial</span></span> flag sets flags for checking a partial system. Top-level unused declarations, undefined declarations, and unnecessary external names are not reported if <span class=Flag><span
\r
7889 style='font-size:10.0pt'>+partial</span></span> is set.</p>
\r
7891 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975026">13.2.1<span
\r
7892 style='font:7.0pt "Times New Roman"'> </span>Unnecessarily
\r
7893 External Names</a></h3>
\r
7895 <p class=TextFontCX>Splint can report variables and functions that are declared with global scope (i.e., without using <span
\r
7896 class=CodeText><span style='font-size:10.0pt'>static</span></span>), that are
\r
7897 not used outside the file in which they are defined. In a stand-alone system,
\r
7898 these identifiers should usually be declared using <span class=CodeText><span
\r
7899 style='font-size:10.0pt'>static</span></span> to limit their scope. If the <span
\r
7900 class=Flag><span style='font-size:10.0pt'>export-static</span></span> flag is
\r
7901 on, Splint will report declarations that could have file scope. It should only
\r
7902 be used when all relevant source files are listed on the Splint command line;
\r
7903 otherwise, variables and functions may be incorrectly identified as only used
\r
7904 in the file scope since Splint did not process the other file in which they are
\r
7907 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975027">13.2.2<span
\r
7908 style='font:7.0pt "Times New Roman"'> </span>Declarations
\r
7909 Missing from Headers</a></h3>
\r
7911 <p class=TextFontCX>A common practice in C
\r
7912 programming styles, is that every function or variable exported by <span
\r
7913 class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span
\r
7914 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
\r
7915 is declared in <span class=Keyword><i><span style='font-size:10.0pt;font-family:
\r
7916 Arial;color:windowtext'>M</span></i></span><span class=Keyword><span
\r
7917 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.
\r
7918 If the <span class=Flag><span style='font-size:10.0pt'>export-header</span></span>
\r
7919 flag is on, Splint will report exported declarations in <span class=Keyword><i><span
\r
7920 style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span
\r
7921 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
\r
7922 that are not declared in <span class=Keyword><i><span style='font-size:10.0pt;
\r
7923 font-family:Arial;color:windowtext'>M</span></i></span><span class=Keyword><span
\r
7924 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.</p>
\r
7926 <h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534975028"></a><a
\r
7927 name="_Ref534642392"></a><a name="_Ref349900301">14<span style='font:7.0pt "Times New Roman"'>
\r
7928 </span>Libraries</a> and Header File Inclusion</h1>
\r
7930 <p class=TextFontCX>Libraries can be used to
\r
7931 record interface information. A library containing information about the
\r
7932 standard C Library is used to enable checking of library calls. Program
\r
7933 libraries can be created to enable fast checking of single modules in a large
\r
7936 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975029"></a><a
\r
7937 name="_Ref534035506"></a><a name="_Ref348801560"></a><a name="_Ref347465531"></a><a
\r
7938 name="_Ref344887939"></a><a name="_Toc344355445">14.1<span style='font:7.0pt "Times New Roman"'>
\r
7939 </span>Standard Librar</a>ies</h2>
\r
7941 <p class=TextFontCX>In order to check calls to library functions, Splint uses an annotated standard library. This
\r
7942 contains more information about function interfaces then is available in the
\r
7943 system header files since it uses annotations. Further, it contains only those
\r
7944 functions documented in the ISO C99 standard. Many systems include extra
\r
7945 functions in their system libraries; programs that use these functions cannot
\r
7946 be compiled on other systems that do not provide them. Certain types defined
\r
7947 by the library are treated as abstract types (e.g., a program should not rely
\r
7948 on how the <span class=CodeText><span style='font-size:10.0pt'>FILE</span></span>
\r
7949 type is implemented). When checking source code, Splint does include system
\r
7950 headers corresponding to files in the library, but instead uses the library
\r
7951 description of the standard library.</p>
\r
7953 <p class=TextFontCX> </p>
\r
7955 <p class=TextFontCX>The Splint distribution
\r
7956 includes several different standard libraries: the ANSI standard library, the
\r
7957 POSIX standard library<a href="#_ftn19" name="_ftnref19" title=""><span
\r
7958 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
7959 style='font-size:11.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>,
\r
7960 and a UNIX library based on the Open Group
\92s Single Unix Specification. Each
\r
7961 library comes in two versions: the standard version and the strict version.</p>
\r
7963 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975030">14.1.1<span
\r
7964 style='font:7.0pt "Times New Roman"'> </span>ISO Standard
\r
7967 <p class=TextFontCX>The default behavior of
\r
7968 Splint is to use the ISO standard library (loaded from <span class=CodeText><span
\r
7969 style='font-size:10.0pt'>standard.lcd</span></span>). This library is based on
\r
7970 the standard library described in the ISO C99 standard. </p>
\r
7972 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975031">14.1.2<span
\r
7973 style='font:7.0pt "Times New Roman"'> </span>POSIX Library</a></h3>
\r
7975 <p class=TextFontCX>The POSIX library is selected
\r
7976 by the <span class=Flag><span style='font-size:10.0pt'>+posixlib</span></span> flag. The POSIX library is based on the IEEE Std 1003.1-1990. </p>
\r
7978 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975032">14.1.3<span
\r
7979 style='font:7.0pt "Times New Roman"'> </span>UNIX Library</a></h3>
\r
7981 <p class=afterlist>The UNIX library is selected by the <span class=Flag><span
\r
7982 style='font-size:10.0pt'>+unixlib</span></span> flag. This library is based on
\r
7983 the Open Group
\92s Single Unix Specification, Version 2.</p>
\r
7985 <p class=TextFontCX> </p>
\r
7987 <p class=MsoListBullet style='margin-left:0in;text-indent:0in'>In the UNIX
\r
7988 library, <span class=CodeText><span style='font-size:10.0pt'>free</span></span>
\r
7989 is declared with a non-null parameter. ISO specifies that <span
\r
7990 class=CodeText><span style='font-size:10.0pt'>free</span></span> should handle
\r
7991 the argument <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>,
\r
7992 but several UNIX platforms crash if <span class=CodeText><span
\r
7993 style='font-size:10.0pt'>NULL</span></span> is passed to <span class=CodeText><span
\r
7994 style='font-size:10.0pt'>free</span></span>.</p>
\r
7996 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975033">14.1.4<span
\r
7997 style='font:7.0pt "Times New Roman"'> </span>Strict Libraries</a></h3>
\r
7999 <p class=TextFontCX>Stricter versions of the
\r
8000 libraries are used is the <span class=Flag><span style='font-size:10.0pt'>-ansi-strict</span></span>, <span class=Flag><span style='font-size:10.0pt'>posix-strict-lib</span></span> or <span class=Flag><span style='font-size:10.0pt'>unix-strict-lib</span></span> flag is used. These libraries use a stricter interpretation of the library.
\r
8001 They will detect more errors in some programs, but may to produce many spurious
\r
8002 errors for typical code.</p>
\r
8004 <p class=TextFontCX> </p>
\r
8006 <p class=beforelist>The differences between the standard libraries and the strict
\r
8007 libraries are:</p>
\r
8009 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
8010 style='font:7.0pt "Times New Roman"'> </span></span>The
\r
8011 standard libraries declare the printing functions (<span class=CodeText><span
\r
8012 style='font-size:10.0pt'>fprintf</span></span>, <span class=CodeText><span
\r
8013 style='font-size:10.0pt'>printf</span></span>, and <span class=CodeText><span
\r
8014 style='font-size:10.0pt'>sprintf</span></span>) that may return error codes to
\r
8015 return <span class=CodeText><span style='font-size:10.0pt'>int</span></span> or
\r
8016 <span class=CodeText><span style='font-size:10.0pt'>void</span></span>. This
\r
8017 prevents typical programs from leading to deluge of ignored return value errors,
\r
8018 but may mean some relevant errors are not detected. In the strict library,
\r
8019 they are declared to return <span class=CodeText><span style='font-size:10.0pt'>int</span></span>,
\r
8020 so ignored return value errors will be reported (depending on other flag
\r
8021 settings). Programs should check that this return value is non-negative. </p>
\r
8023 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
8024 style='font:7.0pt "Times New Roman"'> </span></span>The
\r
8025 standard libraries declare some parameters and return values to be alternate
\r
8026 types (<span class=CodeText><span style='font-size:10.0pt'>int</span></span> or
\r
8027 <span class=CodeText><span style='font-size:10.0pt'>bool</span></span>, or <span
\r
8028 class=CodeText><span style='font-size:10.0pt'>int</span></span> or <span
\r
8029 class=CodeText><span style='font-size:10.0pt'>char</span></span>). The ISO C99
\r
8030 standard specifies these types as <span class=CodeText><span style='font-size:
\r
8031 10.0pt'>int</span></span> to be compatible with older versions of the library,
\r
8032 but logically they make more sense as <span class=CodeText><span
\r
8033 style='font-size:10.0pt'>bool</span></span> or <span class=CodeText><span
\r
8034 style='font-size:10.0pt'>char</span></span>. In the strict library, the
\r
8035 stronger type is used. The parameter to <span class=CodeText><span
\r
8036 style='font-size:10.0pt'>assert</span></span> is <span class=CodeText><span
\r
8037 style='font-size:10.0pt'>int</span></span> or <span class=CodeText><span
\r
8038 style='font-size:10.0pt'>bool</span></span> in the standard library, and <span
\r
8039 class=CodeText><span style='font-size:10.0pt'>bool</span></span> in the strict
\r
8040 library. The parameter to the character functions <span class=CodeText><span
\r
8041 style='font-size:10.0pt'>isalnum</span></span>, <span class=CodeText><span
\r
8042 style='font-size:10.0pt'>isalpha</span></span>, <span class=CodeText><span
\r
8043 style='font-size:10.0pt'>iscntrl</span></span>, <span class=CodeText><span
\r
8044 style='font-size:10.0pt'>isdigit</span></span>, <span class=CodeText><span
\r
8045 style='font-size:10.0pt'>isgraph</span></span>, <span class=CodeText><span
\r
8046 style='font-size:10.0pt'>islower</span></span>, <span class=CodeText><span
\r
8047 style='font-size:10.0pt'>isprint</span></span>, <span class=CodeText><span
\r
8048 style='font-size:10.0pt'>ispunct</span></span>, <span class=CodeText><span
\r
8049 style='font-size:10.0pt'>isspace</span></span>, <span class=CodeText><span
\r
8050 style='font-size:10.0pt'>isupper</span></span>, <span class=CodeText><span
\r
8051 style='font-size:10.0pt'>isxdigit</span></span>, <span class=CodeText><span
\r
8052 style='font-size:10.0pt'>tolower</span></span> and <span class=CodeText><span
\r
8053 style='font-size:10.0pt'>toupper</span></span> is <span class=CodeText><span
\r
8054 style='font-size:10.0pt'>char</span></span> or <span class=CodeText><span
\r
8055 style='font-size:10.0pt'>unsigned char</span></span> or <span class=CodeText><span
\r
8056 style='font-size:10.0pt'>int</span></span> in the standard library and <span
\r
8057 class=CodeText><span style='font-size:10.0pt'>char</span></span> in the strict
\r
8058 library. The type of the return value of the character classification
\r
8059 functions (all of the previous character functions except <span class=CodeText><span
\r
8060 style='font-size:10.0pt'>tolower</span></span> and <span class=CodeText><span
\r
8061 style='font-size:10.0pt'>toupper</span></span>) is <span class=CodeText><span
\r
8062 style='font-size:10.0pt'>bool</span></span> or <span class=CodeText><span
\r
8063 style='font-size:10.0pt'>int</span></span> in the standard library and <span
\r
8064 class=CodeText><span style='font-size:10.0pt'>bool</span></span> in the strict
\r
8065 library. The type of the first parameter to <span class=CodeText><span
\r
8066 style='font-size:10.0pt'>ungetc</span></span> is <span class=CodeText><span
\r
8067 style='font-size:10.0pt'>char</span></span> or <span class=CodeText><span
\r
8068 style='font-size:10.0pt'>int</span></span> in the standard library and <span
\r
8069 class=CodeText><span style='font-size:10.0pt'>char</span></span> in the strict
\r
8070 library (<span class=CodeText><span style='font-size:10.0pt'>EOF</span></span>
\r
8071 should not be passed to <span class=CodeText><span style='font-size:10.0pt'>ungetc</span></span>).
\r
8072 The second parameter to <span class=CodeText><span style='font-size:10.0pt'>strchr</span></span> and <span class=CodeText><span style='font-size:10.0pt'>strrchr</span></span> is <span class=CodeText><span style='font-size:10.0pt'>char</span></span> or <span
\r
8073 class=CodeText><span style='font-size:10.0pt'>int</span></span> in the standard
\r
8074 library and <span class=CodeText><span style='font-size:10.0pt'>char</span></span>
\r
8075 in the strict library.</p>
\r
8077 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
8078 style='font:7.0pt "Times New Roman"'> </span></span>The
\r
8079 global variables <span class=CodeText><span style='font-size:10.0pt'>stdin</span></span>, <span class=CodeText><span style='font-size:10.0pt'>stdout</span></span> and <span class=CodeText><span style='font-size:10.0pt'>stderr</span></span> are declared as <span class=CodeText><span style='font-size:10.0pt'>unchecked</span></span>
\r
8080 variables (see Section 7.2) in the standard libraries. In the strict libraries, they are<span
\r
8081 class=CodeText><span style='font-size:10.0pt'> checked</span></span>.</p>
\r
8083 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
8084 style='font:7.0pt "Times New Roman"'> </span></span>The
\r
8085 global variable <span class=CodeText><span style='font-size:10.0pt'>errno</span></span> is declared <span class=CodeText><span style='font-size:10.0pt'>unchecked</span></span> in the standard libraries, but declared <span class=CodeText><span
\r
8086 style='font-size:10.0pt'>checkedstrict</span></span> in the strict libraries.</p>
\r
8088 <p class=TextFontCX> </p>
\r
8090 <p class=TextFontCX>If no library flag is used,
\r
8091 Splint will load the standard library, <span class=Keyword><span
\r
8092 style='font-size:10.0pt;font-family:Arial;color:windowtext'>standard.lcd</span></span>.
\r
8093 If <span class=Flag><span style='font-size:10.0pt'>+nolib</span></span> is set, no library is loaded. The library source files can easily be modified, and
\r
8094 new libraries created to better suit a particular application.</p>
\r
8096 <h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975034"></a><a
\r
8097 name="_Toc344355447">14.2<span style='font:7.0pt "Times New Roman"'>
\r
8098 </span>Generating Libraries</a></h2>
\r
8100 <p class=TextFontCX>To enable running Splint on
\r
8101 large systems, mechanisms are provided for creating libraries containing
\r
8102 necessary information. This means source files can be checked independently,
\r
8103 after a library has been created. The command line option <span class=Flag><span
\r
8104 style='font-size:10.0pt'>-dump </span></span><span
\r
8105 class=Flag><span style='font-size:10.0pt'><i>library</i></span></span> stores
\r
8106 information in the file <span class=Keyword><i><span style='font-size:10.0pt;
\r
8107 font-family:Arial;color:windowtext'>library</span></i></span> (the default
\r
8108 extension <span class=Keyword><span style='font-size:10.0pt;font-family:Arial;
\r
8109 color:windowtext'>.lcd </span></span>is added). Then, <span class=Flag><span
\r
8110 style='font-size:10.0pt'>-load </span></span><span
\r
8111 class=Flag><span style='font-size:10.0pt'><i>library</i></span></span> loads
\r
8112 the library. The library contains interface information from the files checked
\r
8113 when the library was created.</p>
\r
8115 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975035">14.2.1<span
\r
8116 style='font:7.0pt "Times New Roman"'> </span>Generating the
\r
8117 Standard Libraries</a></h3>
\r
8119 <p class=TextFontCX>The standard libraries are
\r
8120 generated from header files included in the Splint distribution. Some
\r
8121 libraries are generated from more than one header file. Since the POSIX
\r
8122 library subsumes the standard library, the headers for the standard and POSIX
\r
8123 libraries are combined to produce the POSIX library. Similarly, the UNIX library
\r
8124 is composed of the standard, POSIX and UNIX headers. The header files include
\r
8125 some sections that are conditionally selected by defining <span class=CodeText><span
\r
8126 style='font-size:10.0pt'>STRICT</span></span>.</p>
\r
8128 <p class=TextFontCX> </p>
\r
8130 <p class=TextFontCX style='margin-bottom:6.0pt'>The
\r
8131 commands to generate the standard libraries are:</p>
\r
8133 <p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;
\r
8134 margin-left:.2in;margin-bottom:.0001pt'>splint -nolib ansi.h -dump ansi </p>
\r
8136 <p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;
\r
8137 margin-left:.2in;margin-bottom:.0001pt'>splint -nolib -DSTRICT ansi.h -dump
\r
8140 <p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;
\r
8141 margin-left:.2in;margin-bottom:.0001pt'>splint -nolib ansi.h posix.h -dump
\r
8144 <p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;
\r
8145 margin-left:.2in;margin-bottom:.0001pt'>splint -nolib -DSTRICT ansi.h posix.h
\r
8146 -dump posixstrict</p>
\r
8148 <p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;
\r
8149 margin-left:.2in;margin-bottom:.0001pt'>splint -nolib ansi.h posix.h unix.h
\r
8152 <p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;
\r
8153 margin-left:.2in;margin-bottom:.0001pt'>splint -nolib -DSTRICT ansi.h posix.h
\r
8154 unix.h -dump unixstrict</p>
\r
8156 <h2 style='margin-left:0in;text-indent:0in'><a name="_Ref534979539"></a><a
\r
8157 name="_Toc534975036"></a><a name="_Ref348080056"></a><a name="_Toc344355448">14.3<span
\r
8158 style='font:7.0pt "Times New Roman"'> </span>Header
\r
8159 File Inclusion</a></h2>
\r
8161 <p class=TextFontCX>The standard behavior of Splint on encountering </p>
\r
8163 <p class=example><span class=Keyword><span style='font-size:10.0pt'>#include
\r
8164 <<i>X</i>.h></span></span></p>
\r
8166 <p class=TextFontCX>is to search for a file named
\r
8167 <span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;
\r
8168 color:windowtext'>X</span></i></span><span class=Keyword><span
\r
8169 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span> on
\r
8170 the include search path (set using <span class=Flag><span style='font-size:
\r
8171 10.0pt'>
\96I</span></span>) and then the system base include path (read from the <span
\r
8172 class=CodeText><span style='font-size:10.0pt'>include</span></span> environment
\r
8173 variable if set or using a default value, usually <span class=Keyword><span
\r
8174 style='font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>).
\r
8175 If <span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;
\r
8176 color:windowtext'>X</span></i></span><span class=Keyword><span
\r
8177 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span> is
\r
8178 the name of a header file in a loaded standard library and <span class=Keyword><i><span
\r
8179 style='font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span
\r
8180 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
\r
8181 is found in a directory that is a system directory (as set by the <span
\r
8182 class=Flag><span style='font-size:10.0pt'>-sysdirs</span></span> flag; the default is <span
\r
8183 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>),
\r
8184 <span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;
\r
8185 color:windowtext'>X</span></i></span><span class=Keyword><span
\r
8186 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
\r
8187 will not be included if <span class=Flag><span style='font-size:10.0pt'>+skip-iso-headers</span></span> or <span
\r
8188 class=Flag><span style='font-size:10.0pt'>+skip-posix-headers</span></span> (depending on whether <span
\r
8189 class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span
\r
8190 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
\r
8191 is an ISO or POSIX header file) is on (both are on by default). To force all
\r
8192 headers to be included normally, use <span class=Flag><span style='font-size:
\r
8193 10.0pt'>‑skip-iso-headers</span></span>. </p>
\r
8195 <p class=TextFontCX> </p>
\r
8197 <p class=TextFontCX>Sometimes headers in system
\r
8198 directories contain non-standard syntax that Splint is unable to parse. The <span
\r
8199 class=Flag><span style='font-size:10.0pt'>+skip-sys-headers</span></span> flag may be used to prevent any include file in a system directory from being included.</p>
\r
8201 <p class=TextFontCX> </p>
\r
8203 <p class=TextFontCX>Splint is fast enough that it
\r
8204 can be run on medium-size (10,000 line) programs without performance concerns.
\r
8205 Libraries can be used to enable efficient checking of small modules in large
\r
8206 programs. To further improve performance, header file inclusion can be
\r
8209 <p class=TextFontCX> </p>
\r
8211 <p class=TextFontCX>When processing a complete
\r
8212 system in which many files include the same headers, a large fraction of
\r
8213 processing time is wasted re-reading header files unnecessarily. If you are
\r
8214 checking a 100-file program, and every file includes <span class=Flag><span
\r
8215 style='font-size:10.0pt;font-family:Arial;color:windowtext'>utils.h</span></span>,
\r
8216 Splint will have to process <span class=Keyword><span style='font-size:10.0pt;
\r
8217 font-family:Arial;color:windowtext'>utils.h</span></span> 100 times (as would
\r
8218 most C compilers). If the <span class=Flag><span style='font-size:10.0pt'>+single-include</span></span>
\r
8219 flag is used, each header file is processed only once. Single header file
\r
8220 processing produces a significant efficiency improvement when checking large
\r
8221 programs split into many files, but is only safe if the same header file
\r
8222 included in different contexts always has the same meaning (i.e., it does not
\r
8223 depend on preprocessor variable defined differently at different inclusion
\r
8226 <p class=TextFontCX> </p>
\r
8228 <p class=TextFontCX>When processing a single file
\r
8229 in a large system, a large fraction of the time is spent processing included
\r
8230 header files. This can be avoided if the information in the header files is
\r
8231 stored in a library instead. If <span class=Flag><span style='font-size:10.0pt'>+never-include</span></span>
\r
8232 is set, inclusion of files ending in <span class=Flag><span style='font-size:
\r
8233 10.0pt;font-family:Arial;color:windowtext'>.h</span></span> is prevented.
\r
8234 Files with different suffixes are included normally. To do this the header
\r
8235 files must not include any expanded macros. That is, the header file must be
\r
8236 processed with <span class=Flag><span style='font-size:10.0pt'>+all-macros</span></span>, and there must be no <span
\r
8237 class=Annot><span style='font-size:10.0pt'>/*@notfunction@*/</span></span> control comments in the header. Then, the <span
\r
8238 class=Flag><span style='font-size:10.0pt'>+never-include</span></span> flag may
\r
8239 be used to prevent inclusion of header files. Alternately, non-function macros
\r
8240 can be moved to a different file with a name that does not end in <span
\r
8241 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.
\r
8242 Remember, that this file must be included directly from the <span
\r
8243 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
\r
8244 file, since if it is included from an <span class=Keyword><span
\r
8245 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
\r
8246 file indirectly, that <span class=Keyword><span style='font-size:10.0pt;
\r
8247 font-family:Arial;color:windowtext'>.h</span></span> file is ignored so the
\r
8248 other file is never included.</p>
\r
8250 <p class=TextFontCX> </p>
\r
8252 <p class=TextFontCX>These options can be used for
\r
8253 significant performance improvements on large systems. The performance depends
\r
8254 on how the code is structured, but checking a single module in a large program
\r
8255 is several times faster if libraries and <span class=Flag><span
\r
8256 style='font-size:10.0pt'>+noinclude</span></span> are used.</p>
\r
8258 <h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975037">14.3.1<span
\r
8259 style='font:7.0pt "Times New Roman"'> </span>Preprocessing
\r
8260 Constants</a></h3>
\r
8262 <p class=TextFontCX>Splint defines the
\r
8263 preprocessor constant <span class=CodeText><span style='font-size:10.0pt'>S_SPLINT_S</span></span>
\r
8264 when preprocessing source files. If you want to include code that is processed
\r
8265 only when Splint is used, surround the code with </p>
\r
8267 <p class=TextFontCX align=left style='text-align:
\r
8268 left'><span class=Keyword><span style='font-size:10.0pt'> </span></span></p>
\r
8270 <p class=TextFontCX align=left style='text-align:
\r
8271 left'><span class=Keyword><span style='font-size:10.0pt'># ifdef S_SPLINT_S</span></span></p>
\r
8273 <p class=TextFontCX align=left style='text-align:
\r
8276 <p class=TextFontCX><span class=Keyword><span
\r
8277 style='font-size:10.0pt'># endif</span></span></p>
\r
8281 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 align=right>
\r
8283 <td valign=top align=left height=239 style='padding-top:9.35pt;padding-right:
\r
8284 9.35pt;padding-bottom:9.35pt;padding-left:9.35pt'>
\r
8285 <p class=IndentText><span style='font-size:9.0pt;font-family:Arial'>From
\r
8286 bnelson@netcom.com (Bob Nelson)</span></p>
\r
8287 <p class=IndentText><span style='font-size:9.0pt;font-family:Arial'>Subject
\r
8288 Re: NT vs. Linux</span></p>
\r
8289 <p class=IndentText><span style='font-size:9.0pt;font-family:Arial'>Date
\r
8290 </span><span style='font-size:9.0pt;font-family:Arial'>Fri, 5 Jul 1996</span><span
\r
8291 style='font-size:9.0pt;font-family:Arial'> </span><span style='font-size:9.0pt;font-family:Arial'>05:11:22 GMT</span></p>
\r
8292 <p class=IndentText><span style='font-size:9.0pt;font-family:Arial'>Newsgroups
\r
8293 comp.os.linux.advocacy,comp.sys.ibm.pc.hardware, </span></p>
\r
8294 <p class=IndentText style='margin-left:1.0in'><span style='font-size:9.0pt;
\r
8295 font-family:Arial'>comp.os.ms-windows.win95.misc, comp.os.mswindows.nt.misc,
\r
8296 alt.flame,alt.fan.bill-gates,alt.destroy.microsoft</span></p>
\r
8297 <p class=IndentText><i><span style='font-size:9.0pt'>------------------------------------------------------------------------</span></i></p>
\r
8298 <p class=IndentText><i><span style='font-size:9.0pt'>Toni Anzlovar
\r
8299 (toni.anzlovar@kiss.uni-lj.si) wrote:</span></i></p>
\r
8300 <p class=IndentText><i><span style='font-size:9.0pt'> </span></i></p>
\r
8301 <p class=IndentText><i><span style='font-size:9.0pt'>> Why does everybody
\r
8302 want to RUN WORD? Why does nobody want to write and edit</span></i></p>
\r
8303 <p class=IndentText><i><span style='font-size:9.0pt'>> text?</span></i></p>
\r
8304 <p class=IndentText><i><span style='font-size:9.0pt'> </span></i></p>
\r
8305 <p class=IndentText><i><span style='font-size:9.0pt'>Simple. A *tremendous*
\r
8306 number of documents are written using Microsoft Word. One that is
\r
8307 particularly ironic is the guide to LCLint -- a very popular lint tool --
\r
8308 often the lint of choice in the linux world.</span></i></p>
\r
8317 <span style='font-size:11.0pt;font-family:"Times New Roman"'><br clear=all
\r
8318 style='page-break-before:right'>
\r
8321 <div class=Section5>
\r
8323 <p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a
\r
8324 name="_Toc534975038"></a><a name="_Toc344355451"></a><a name="_Ref343065611">Appendix
\r
8325 A<span style='font:7.0pt "Times New Roman"'>
\r
8326 </span>Availability</a></p>
\r
8328 <p class=afterlist>The web home page for Splint is <span class=Keyword><span
\r
8329 style='font-size:10.0pt;font-family:Arial;color:windowtext'><a
\r
8330 href="http://www.splint.org/">http://www.splint.org</a></span></span>. It
\r
8331 includes this guide in HTML format, samples demonstrating Splint, and links to
\r
8332 related web sites. Splint is available as source code and binary executables
\r
8333 for several platforms. Splint may be freely distributed and modified under the
\r
8334 GNU General Public License. The latest development code is available through
\r
8337 <p class=TextFontCX> </p>
\r
8339 <p class=TextFontCX>Splint development is largely
\r
8340 driven by suggestions and comments from users. We are also very interested in
\r
8341 hearing about your experiences using Splint in developing or maintaining
\r
8342 programs, enforcing coding standards, or teaching courses. For general
\r
8343 information, suggestions, and questions on Splint send mail to <span
\r
8344 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>splint@cs.virginia.edu</span></span>.</p>
\r
8346 <p class=TextFontCX> </p>
\r
8348 <p class=TextFontCX>To report a bug in Splint send
\r
8349 a message to <span class=Keyword><span style='font-size:10.0pt;font-family:
\r
8350 Arial;color:windowtext'>splint-bug@cs.virginia.edu</span></span>.</p>
\r
8352 <p class=TextFontCX> </p>
\r
8354 <p class=beforelist>There are two mailing lists associated with Splint:</p>
\r
8356 <p class=URL><span class=Keyword><span style='font-family:Arial;color:windowtext'>splint-announce@virginia.edu</span></span></p>
\r
8358 <p class=IndentText>Reserved for announcements of new releases and bug fixes.
\r
8359 All users should add themselves to this list. </p>
\r
8361 <p class=URL><span class=Keyword><span style='font-family:Arial;color:windowtext'>splint-interest@virginia.edu</span></span></p>
\r
8363 <p class=IndentText>Informal discussions on the use and development of Splint.
\r
8366 <p class=TextFontCX> </p>
\r
8368 <p class=TextFontCX><a name="_Ref344882161"></a><a
\r
8369 name="_Ref344871249"></a><a name="_Ref344870532"></a><a name="_Ref344870294">To
\r
8370 subscribe to a mailing list, send a message to </a><span class=PlainText><span
\r
8371 style='font-size:10.0pt;font-family:Arial'>majordomo@virginia.edu</span></span>
\r
8372 containing the body</p>
\r
8374 <p class=URL><span class=Keyword><span style='font-family:Arial;color:windowtext'>subscribe
\r
8375 splint-announce</span></span><span class=Keyword><span style='font-size:11.0pt;
\r
8376 font-family:"Times New Roman";color:windowtext'> </span></span><span
\r
8377 style='font-size:11.0pt;font-family:"Times New Roman"'>or</span> <span
\r
8378 class=Keyword><span style='font-family:Arial;color:windowtext'>subscribe
\r
8379 splint-interest</span></span><a name="_Ref348343340"></a><a name="_Ref348330382">.</a></p>
\r
8381 <p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a
\r
8382 name="_Toc534975039"></a><a name="_Ref397875360">Appendix B<span
\r
8383 style='font:7.0pt "Times New Roman"'>
\r
8384 </span>Flags</a><a name="_Toc344355437"></a></p>
\r
8386 <p class=beforelist>There are four different types of flags: </p>
\r
8388 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
8389 style='font:7.0pt "Times New Roman"'> </span></span>Global
\r
8390 flags for controlling initializations and global behavior</p>
\r
8392 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
8393 style='font:7.0pt "Times New Roman"'> </span></span>Message
\r
8394 format flags for controlling how messages are displayed</p>
\r
8396 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
8397 style='font:7.0pt "Times New Roman"'> </span></span>Mode
\r
8398 selectors for coarse control of Splint checking</p>
\r
8400 <p class=MsoListBullet><span style='font-family:Symbol'>·<span
\r
8401 style='font:7.0pt "Times New Roman"'> </span></span>Checking
\r
8402 flags that control checking and what classes of messages are reported.</p>
\r
8404 <p class=afterlist>Global flags can be used in initialization files and at the
\r
8405 command line; all other flags may also be used in control comments.</p>
\r
8407 <p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a
\r
8408 name="_Toc534975040">Global Flags</a></p>
\r
8410 <p class=TextFontCX>Global flags can be set at
\r
8411 the command line or in an options file, but cannot be set locally using stylized
\r
8412 comments. These flags control on-line help, initialization files,
\r
8413 pre-processor flags, libraries and output. </p>
\r
8415 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
8416 name="_Toc534975041">Help</a></p>
\r
8418 <p class=beforelist>On-line help provides documentation on Splint operation and
\r
8419 flags. When a help flag is used, no checking is done by Splint. Help flags
\r
8420 may be preceded by <span class=Flag><span style='font-size:10.0pt'>-</span></span>
\r
8421 or <span class=Flag><span style='font-size:10.0pt'>+</span></span>.</p>
\r
8423 <p class=TextFontCX><span class=Flag><span
\r
8424 style='font-size:10.0pt'>help</span></span></p>
\r
8426 <p class=IndentText>Display general help overview, including list of additional
\r
8429 <p class=TextFontCX><span class=Flag><span
\r
8430 style='font-size:10.0pt'>help </span></span><span
\r
8431 class=Flag><span style='font-size:10.0pt'><topic></span></span></p>
\r
8433 <p class=indentbefore>Display help on <i><topic></i>. Available topics:</p>
\r
8435 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
8436 style='width:400.5pt;margin-left:27.9pt;border-collapse:collapse'>
\r
8438 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8439 <p class=TextFontCX style='text-indent:5.4pt'><span
\r
8440 class=Flag><span style='font-size:10.0pt'>annotations</span></span></p>
\r
8442 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8443 <p class=TextFontCX align=left
\r
8444 style='text-align:left'>describe annotations</p>
\r
8448 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8449 <p class=TextFontCX><span class=Flag><span
\r
8450 style='font-size:10.0pt'>comments</span></span></p>
\r
8452 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8453 <p class=TextFontCX align=left
\r
8454 style='text-align:left'>describe control comments</p>
\r
8458 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8459 <p class=TextFontCX><span class=Flag><span
\r
8460 style='font-size:10.0pt'>flags </span></span></p>
\r
8462 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8463 <p class=TextFontCX align=left
\r
8464 style='text-align:left'>describe flag categories</p>
\r
8468 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8469 <p class=TextFontCX><span class=Flag><span
\r
8470 style='font-size:10.0pt'>flags <i><category></i></span></span></p>
\r
8472 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8473 <p class=TextFontCX align=left
\r
8474 style='text-align:left'>all flags pertaining to <category> (one of the
\r
8475 categories listed by <span class=Flag><span style='font-size:10.0pt'>splint
\r
8476 -help flags</span></span>)</p>
\r
8480 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8481 <p class=TextFontCX><span class=Flag><span
\r
8482 style='font-size:10.0pt'>flags alpha</span></span> </p>
\r
8484 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8485 <p class=TextFontCX align=left
\r
8486 style='text-align:left'>all flags in alphabetical order</p>
\r
8490 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8491 <p class=TextFontCX><span class=Flag><span
\r
8492 style='font-size:10.0pt'>flags full</span></span></p>
\r
8494 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8495 <p class=TextFontCX align=left
\r
8496 style='text-align:left'>print a full description of all flags</p>
\r
8500 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8501 <p class=TextFontCX><span class=Flag><span
\r
8502 style='font-size:10.0pt'>mail</span></span></p>
\r
8504 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8505 <p class=TextFontCX align=left
\r
8506 style='text-align:left'>print information on mailing lists</p>
\r
8510 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8511 <p class=TextFontCX><span class=Flag><span
\r
8512 style='font-size:10.0pt'>modes</span></span></p>
\r
8514 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8515 <p class=TextFontCX align=left
\r
8516 style='text-align:left'>flags settings in modes</p>
\r
8520 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8521 <p class=TextFontCX><span class=Flag><span
\r
8522 style='font-size:10.0pt'>prefixcodes</span></span></p>
\r
8524 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8525 <p class=TextFontCX align=left
\r
8526 style='text-align:left'>character codes for setting namespace prefixes</p>
\r
8530 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8531 <p class=TextFontCX><span class=Flag><span
\r
8532 style='font-size:10.0pt'>references</span></span></p>
\r
8534 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8535 <p class=TextFontCX align=left
\r
8536 style='text-align:left'>print references to relevant papers and web sites</p>
\r
8540 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8541 <p class=TextFontCX><span class=Flag><span
\r
8542 style='font-size:10.0pt'>vars</span></span></p>
\r
8544 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8545 <p class=TextFontCX align=left
\r
8546 style='text-align:left'>describe environment variables</p>
\r
8550 <td valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8551 <p class=TextFontCX><span class=Flag><span
\r
8552 style='font-size:10.0pt'>version</span></span></p>
\r
8554 <td valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
\r
8555 <p class=TextFontCX align=left
\r
8556 style='text-align:left'>print maintainer and version information</p>
\r
8557 <p class=TextFontCX align=left
\r
8558 style='text-align:left'> </p>
\r
8563 <p class=afterlist><span class=Flag><span style='font-size:10.0pt'>help </span></span><span
\r
8564 class=Flag><span style='font-size:10.0pt'><flag></span></span></p>
\r
8566 <p class=IndentText>Describe flag <i><flag></i>. (May list several
\r
8569 <p class=TextFontCX><span class=Flag><span
\r
8570 style='font-size:10.0pt'>warn-flags</span></span></p>
\r
8572 <p class=IndentText>Display a warning when a flag is set in a surprising way.
\r
8573 An error is reported if an obsolete flag is set, a flag is set to its current
\r
8574 value (i.e., the <span class=Flag><span style='font-size:10.0pt'>+</span></span>
\r
8575 or <span class=Flag><span style='font-size:10.0pt'>-</span></span> may be
\r
8576 wrong), or a mode selector flag is set after mode checking flags that will be
\r
8577 reset by the mode were set. By default, <span class=Flag><span
\r
8578 style='font-size:10.0pt'>+warn-flags</span></span> is on. To suppress flag
\r
8579 warnings, use <span class=Flag><span style='font-size:10.0pt'>‑warn-flags</span></span>.</p>
\r
8581 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
8582 name="_Toc534975042">Initialization</a></p>
\r
8584 <p class=beforelist>These flags control directories and files used by Splint. They may be used from the command line or in an options file, but may not be used as control comments in the source code. Except where noted. they have the same meaning
\r
8585 preceded by <span class=Flag><span style='font-size:10.0pt'>-</span></span> or <span
\r
8586 class=Flag><span style='font-size:10.0pt'>+</span></span>. </p>
\r
8588 <p class=TextFontCX><span class=Flag><span
\r
8589 style='font-size:10.0pt'>tmpdir </span></span><span
\r
8590 class=Flag><span style='font-size:10.0pt'><i><directory></i></span></span></p>
\r
8592 <p class=IndentText>Set directory for writing temp files. Default is <span
\r
8593 class=ProgramNameChar><span style='font-size:10.0pt'>/tmp/</span></span>.</p>
\r
8595 <p class=TextFontCX><span class=Flag><span
\r
8596 style='font-size:10.0pt'>I<i><directory></i></span></span></p>
\r
8598 <p class=IndentText>Add directory to path searched for C include files. Note
\r
8599 there is no space after the <span class=Flag><span style='font-size:10.0pt'>I</span></span>,
\r
8600 to be consistent with C preprocessor flags.</p>
\r
8602 <p class=TextFontCX><span class=Flag><span
\r
8603 style='font-size:10.0pt'>S<i><directory></i></span></span></p>
\r
8605 <p class=IndentText>Add directory to path search for <span
\r
8606 class=ProgramNameChar><span style='font-size:10.0pt'>.lcl</span></span>
\r
8607 specification files.</p>
\r
8609 <p class=IndentText> </p>
\r
8611 <p class=TextFontCX><span class=Flag><span
\r
8612 style='font-size:10.0pt'>larchpath </span></span><span
\r
8613 class=Flag><span style='font-size:10.0pt'><i><path></i></span></span></p>
\r
8615 <p class=IndentText>Set path to search for library files. Overrides <span
\r
8616 class=CodeText><span style='font-size:10.0pt'>LARCH_PATH</span></span> environment variable.</p>
\r
8618 <p class=TextFontCX><span class=Flag><span
\r
8619 style='font-size:10.0pt'>lclimportdir </span></span><span
\r
8620 class=Flag><span style='font-size:10.0pt'><i><directory></i></span></span></p>
\r
8622 <p class=IndentText>Set directory to search for LCL import files. Overrides<span
\r
8623 class=Keyword><span style='font-size:10.0pt'> </span></span><span
\r
8624 class=CodeText><span style='font-size:10.0pt'>LCLIMPORTDIR</span></span>
\r
8625 environment variable.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
8627 <p class=IndentText> </p>
\r
8629 <p class=TextFontCX><span class=Flag><span
\r
8630 style='font-size:10.0pt'>f </span></span><span
\r
8631 class=Flag><span style='font-size:10.0pt'><i><file></i></span></span></p>
\r
8633 <p class=MsoNormal style='margin-left:13.5pt'>Load options from <span
\r
8634 class=Flag><i><span style='font-size:10.0pt'><file></span></i></span>.
\r
8635 If this flag is used from the command line, the default <span
\r
8636 class=FileNameChar><span style='font-size:10.0pt'>~/.splintrc</span></span> file is not loaded. This flag may be used in an options file to include another options file.</p>
\r
8638 <p class=TextFontCX><span class=Flag><span
\r
8639 style='font-size:10.0pt'>nof</span></span></p>
\r
8641 <p class=IndentText>Prevents the default options files (<span
\r
8642 class=FileNameChar><span style='font-size:10.0pt'>./.splintrc</span></span><span
\r
8643 class=ProgramNameChar><span style='font-size:10.0pt'> </span></span>and <span
\r
8644 class=FileNameChar><span style='font-size:10.0pt'>~/.splintrc</span></span>)
\r
8645 from being loaded. (Setting <span class=Flag><span style='font-size:10.0pt'>-nof</span></span>
\r
8646 overrides <span class=Flag><span style='font-size:10.0pt'>+nof</span></span>,
\r
8647 causing the options files to be loaded normally.)</p>
\r
8649 <p class=TextFontCX><span class=Flag><span
\r
8650 style='font-size:10.0pt'>sys-dirs</span></span></p>
\r
8652 <p class=IndentText>Set directories for system files (default is <span
\r
8653 class=FileNameChar><span style='font-size:10.0pt'>/usr/include</span></span>).
\r
8654 Separate directories with the path separator for your operating system (e.g., semi-colons
\r
8655 for Windows or colons for Unix: <span class=FileNameChar><span
\r
8656 style='font-size:10.0pt'>/usr/include:/usr/local/lib</span></span>). Flag
\r
8657 settings propagate to files in a system directory. If <span class=Flag><span
\r
8658 style='font-size:10.0pt'>-sys-dir-errors</span></span> is set, no errors are reported for files in system directories.</p>
\r
8660 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
8661 name="_Toc534975043"></a><a name="_Ref345883190">Pre-processor</a></p>
\r
8663 <p class=beforelist>These flags are used to define or undefine pre-processor constants. The <span
\r
8664 class=Flag><span style='font-size:10.0pt'>-I<i><directory></i></span></span>
\r
8665 flag is also passed to the C pre-processor.</p>
\r
8667 <p class=TextFontCX><span class=Flag><span
\r
8668 style='font-size:10.0pt'>D<initializer></span></span></p>
\r
8670 <p class=IndentText>Passed to the C pre-processor.</p>
\r
8672 <p class=FileName0 style='margin-left:0in'><span class=Flag>U<initializer></span></p>
\r
8674 <p class=IndentText>Passed to the C pre-processor.</p>
\r
8676 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
8677 name="_Toc534975044">Libraries</a></p>
\r
8679 <p class=beforelist>These flags control the creation and use of libraries.</p>
\r
8681 <p class=TextFontCX><span class=Flag><span
\r
8682 style='font-size:10.0pt'>dump </span></span><span
\r
8683 class=Flag><span style='font-size:10.0pt'><i><file></i></span></span></p>
\r
8685 <p class=IndentText>Save state in <span class=Flag><i><span style='font-size:
\r
8686 10.0pt'><file></span></i></span> for loading. The default extension <span
\r
8687 class=ProgramNameChar><span style='font-size:10.0pt'>.lcd</span></span> is
\r
8688 added if <span class=Flag><i><span style='font-size:10.0pt'><file></span></i></span>
\r
8689 has no extension.</p>
\r
8691 <p class=TextFontCX><span class=Flag><span
\r
8692 style='font-size:10.0pt'>load</span></span><span
\r
8693 class=Flag><span style='font-size:10.0pt'> <i><file></i></span></span></p>
\r
8695 <p class=IndentText>Load state from <span class=Flag><i><span style='font-size:
\r
8696 10.0pt'><file></span></i></span> (created by <span class=Flag><span
\r
8697 style='font-size:10.0pt'>-dump</span></span>). The default extension <span
\r
8698 class=FileNameChar><span style='font-size:10.0pt'>.lcd</span></span> is added
\r
8699 if <span class=Flag><i><span style='font-size:10.0pt'><file></span></i></span>
\r
8700 has no extension. Only one library file may be loaded.</p>
\r
8702 <p class=betweenlists>By default, the standard library is loaded if the <span
\r
8703 class=Flag><span style='font-size:10.0pt'>-load</span></span> flag is not used to load a user library. If no user library is loaded, one of the
\r
8704 following flags may be used to select a different standard library. Precede
\r
8705 the flag by <span class=Flag><span style='font-size:10.0pt'>+</span></span> to
\r
8706 load the described library (or to prevent a library from being loaded using <span
\r
8707 class=Flag><span style='font-size:10.0pt'>no-lib</span></span>). See Section 14.1 for information on the provided libraries.</p>
\r
8709 <p class=TextFontCX><span class=Flag><span
\r
8710 style='font-size:10.0pt'>no-lib</span></span></p>
\r
8712 <p class=IndentText>Do not load any library. This prevents the standard
\r
8713 library from being loaded. </p>
\r
8715 <p class=TextFontCX><span class=Flag><span
\r
8716 style='font-size:10.0pt'>ansi-lib</span></span></p>
\r
8718 <p class=IndentText>Use the ANSI standard library (selected by default). </p>
\r
8720 <p class=TextFontCX><span class=Flag><span
\r
8721 style='font-size:10.0pt'>strict-lib</span></span></p>
\r
8723 <p class=IndentText>Use strict version of the ANSI standard library.</p>
\r
8725 <p class=TextFontCX><span class=Flag><span
\r
8726 style='font-size:10.0pt'>posix-lib</span></span></p>
\r
8728 <p class=IndentText>Use the POSIX standard library. </p>
\r
8730 <p class=TextFontCX><span class=Flag><span
\r
8731 style='font-size:10.0pt'>posix-strict-lib</span></span></p>
\r
8733 <p class=IndentText>Use the strict version of the POSIX standard library. </p>
\r
8735 <p class=TextFontCX><span class=Flag><span
\r
8736 style='font-size:10.0pt'>unix-lib</span></span></p>
\r
8738 <p class=IndentText>Use UNIX version of standard library. </p>
\r
8740 <p class=TextFontCX><span class=Flag><span
\r
8741 style='font-size:10.0pt'>unix-strict-lib</span></span></p>
\r
8743 <p class=IndentText>Use the strict version of the UNIX standard library. </p>
\r
8745 <p class=IndentText> </p>
\r
8747 <p class=TextFontCX><span class=Flag><span
\r
8748 style='font-size:10.0pt'>which-lib</span></span></p>
\r
8750 <p class=IndentText>Print out the standard library filename and creation
\r
8753 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
8754 name="_Toc534975045">Output</a></p>
\r
8756 <p class=beforelist>These flags control what additional information Splint
\r
8757 prints. Setting <span class=Flag><span style='font-size:10.0pt'>+<i><flag></i></span></span>
\r
8758 causes the described information to be printed; setting <span class=Flag><span
\r
8759 style='font-size:10.0pt'>-<i><flag></i></span></span> prevents it. By
\r
8760 default, all these flags are off.</p>
\r
8762 <p class=TextFontCX><span class=Flag><span
\r
8763 style='font-size:10.0pt'>use-stderr</span></span></p>
\r
8765 <p class=IndentText>Send error messages to standard error (instead of standard
\r
8768 <p class=TextFontCX><span class=Flag><span
\r
8769 style='font-size:10.0pt'>show-summary</span></span></p>
\r
8771 <p class=IndentText>Show a summary of all errors reported and suppressed.
\r
8772 Counts of suppressed errors are not necessarily correct since turning a flag
\r
8773 off may prevent some checking from being done to save computation, and errors
\r
8774 that are not reported may propagate differently from when they are reported.</p>
\r
8776 <p class=TextFontCX><span class=Flag><span
\r
8777 style='font-size:10.0pt'>show-scan</span></span></p>
\r
8779 <p class=IndentText>Show file names are they are processed.</p>
\r
8781 <p class=TextFontCX><span class=Flag><span
\r
8782 style='font-size:10.0pt'>show-all-uses</span></span></p>
\r
8784 <p class=IndentText>Show list of uses of all external identifiers sorted by
\r
8785 number of uses.</p>
\r
8787 <p class=TextFontCX><span class=Flag><span
\r
8788 style='font-size:10.0pt'>stats</span></span></p>
\r
8790 <p class=IndentText>Display number of lines processed and checking time.</p>
\r
8792 <p class=TextFontCX><span class=Flag><span
\r
8793 style='font-size:10.0pt'>time-dist</span></span></p>
\r
8795 <p class=IndentText>Display distribution of where checking time is spent.</p>
\r
8797 <p class=TextFontCX><span class=Flag><span
\r
8798 style='font-size:10.0pt'>quiet</span></span></p>
\r
8800 <p class=IndentText>Suppress herald and error count. (If <span class=Flag><span
\r
8801 style='font-size:10.0pt'>quiet</span></span> is not set, Splint prints out a
\r
8802 herald with version information before checking begins, and a line summarizing
\r
8803 the total number of errors reported.)</p>
\r
8805 <p class=TextFontCX><span class=Flag><span
\r
8806 style='font-size:10.0pt'>which-lib</span></span></p>
\r
8808 <p class=IndentText>Print out the standard library filename and creation
\r
8811 <p class=TextFontCX><span class=Flag><span
\r
8812 style='font-size:10.0pt'>limit </span></span><span
\r
8813 class=Flag><span style='font-size:10.0pt'><i><number></i></span></span></p>
\r
8815 <p class=IndentText>At most <span class=Flag><i><span style='font-size:10.0pt'><number></span></i></span>
\r
8816 similar errors are reported consecutively. Further errors are suppressed, and
\r
8817 a message showing the number of suppressed messages is printed.</p>
\r
8819 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
8820 name="_Toc534975046">Expected Errors</a></p>
\r
8822 <p class=beforelist>Normally, Splint will expect to report no errors. The exit
\r
8823 status will be success (<span class=Keyword><span style='font-size:10.0pt'>0</span></span>)
\r
8824 if no errors are reported, and failure if any errors are reported. Flags can
\r
8825 be used to set the expected number of reported errors. Because of the provided
\r
8826 error suppression mechanisms, these options should probably not be used for
\r
8827 final checking real programs but may be useful in developing programs using
\r
8830 <p class=TextFontCX><span class=Flag><span
\r
8831 style='font-size:10.0pt'>expect </span></span><span
\r
8832 class=Flag><span style='font-size:10.0pt'><i><number></i></span></span></p>
\r
8834 <p class=IndentText>Exactly <span class=Flag><i><span style='font-size:10.0pt'><number></span></i></span>
\r
8835 code errors are expected. Splint will exit with failure exit status unless <span
\r
8836 class=Flag><i><span style='font-size:10.0pt'><number></span></i></span>
\r
8837 code errors are detected. </p>
\r
8839 <p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a
\r
8840 name="_Toc534975047">Message Format</a></p>
\r
8842 <p class=beforelist>These flags control how messages are printed. They may be
\r
8843 set at the command line, in options files, or locally in syntactic comments.
\r
8844 The <span class=Flag><span style='font-size:10.0pt'>line-len</span></span> and <span class=Flag><span style='font-size:10.0pt'>limit</span></span> flags may be preceded by <span class=Flag><span style='font-size:10.0pt'>+</span></span>
\r
8845 or <span class=Flag><span style='font-size:10.0pt'>-</span></span> with the
\r
8846 same meaning; for the other flags, <span class=Flag><span style='font-size:
\r
8847 10.0pt'>+</span></span> turns on the describe printing and <span class=Flag><span
\r
8848 style='font-size:10.0pt'>-</span></span> turns it off. The box to the left of
\r
8849 each flag gives its default value.</p>
\r
8853 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
8856 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
8857 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
8858 <p class=TextFontCX align=center
\r
8859 style='text-align:center;background:#CCCCCC'><span class=Flag><span
\r
8860 style='font-size:10.0pt'>+</span></span></p>
\r
8867 <p class=TextFontCX><span class=Flag><span
\r
8868 style='font-size:10.0pt'>show-column</span></span></p>
\r
8870 <p class=IndentText>Show column number where error is found.</p>
\r
8874 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
8877 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
8878 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
8879 <p class=TextFontCX align=center
\r
8880 style='text-align:center;background:#CCCCCC'><span class=Flag><span
\r
8881 style='font-size:10.0pt'>+</span></span></p>
\r
8888 <p class=TextFontCX><span class=Flag><span
\r
8889 style='font-size:10.0pt'>show-func</span></span></p>
\r
8891 <p class=IndentText>Show name of function (or macro) definition containing
\r
8892 error. The function name is printed once before the first message detected in
\r
8893 that function.</p>
\r
8897 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
8900 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
8901 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
8902 <p class=TextFontCX align=center
\r
8903 style='text-align:center;background:#CCCCCC'><span class=Flag><span
\r
8904 style='font-size:10.0pt'>-</span></span></p>
\r
8911 <p class=TextFontCX><span class=Flag><span
\r
8912 style='font-size:10.0pt'>show-all-conjs</span></span></p>
\r
8914 <p class=IndentText>Show all possible alternate types (see Section 4.4).</p>
\r
8918 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
8921 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
8922 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
8923 <p class=TextFontCX align=center
\r
8924 style='text-align:center;background:#CCCCCC'><span class=Flag><span
\r
8925 style='font-size:10.0pt'>-</span></span></p>
\r
8932 <p class=TextFontCX><span class=Flag><span
\r
8933 style='font-size:10.0pt'>paren-file-format</span></span></p>
\r
8935 <p class=IndentText>Use <span class=Flag><i><span style='font-size:10.0pt'><file></span></i></span><span
\r
8936 class=CodeText><span style='font-size:10.0pt'>(</span></span><span class=Flag><i><span
\r
8937 style='font-size:10.0pt'><line></span></i></span><span class=CodeText><span
\r
8938 style='font-size:10.0pt'>)</span></span> format in messages. (Default is + for
\r
8939 Win32 for compatibility with Microsoft VisualStudio.)</p>
\r
8943 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
8946 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
8947 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
8948 <p class=TextFontCX align=center
\r
8949 style='text-align:center;background:#CCCCCC'><span class=Flag><span
\r
8950 style='font-size:10.0pt'>+</span></span></p>
\r
8957 <p class=TextFontCX><span class=Flag><span
\r
8958 style='font-size:10.0pt'>hints</span></span></p>
\r
8960 <p class=IndentText>Provide hints describing an error and how a message may be
\r
8961 suppressed for the first error reported in each error class. </p>
\r
8965 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
8968 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
8969 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
8970 <p class=TextFontCX align=center
\r
8971 style='text-align:center;background:#CCCCCC'><span class=Flag><span
\r
8972 style='font-size:10.0pt'>-</span></span></p>
\r
8979 <p class=TextFontCX><span class=Flag><span
\r
8980 style='font-size:10.0pt'>force-hints</span></span></p>
\r
8982 <p class=IndentText>Provide hints for all errors reported, even if the hint has
\r
8983 already been displayed for the same error class.</p>
\r
8987 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
8990 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
8991 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
8992 <p class=TextFontCX align=center
\r
8993 style='text-align:center;background:#CCCCCC'><span class=Flag><span
\r
8994 style='font-size:10.0pt'>80</span></span></p>
\r
9001 <p class=TextFontCX><span class=Flag><span
\r
9002 style='font-size:10.0pt'>line-len </span></span><span
\r
9003 class=Flag><span style='font-size:10.0pt'><i><number></i></span></span></p>
\r
9005 <p class=IndentText>Set length of maximum message line to <span class=Flag><i><span
\r
9006 style='font-size:10.0pt'><number></span></i></span> characters. Splint
\r
9007 will split messages longer than <span class=Flag><i><span style='font-size:
\r
9008 10.0pt'><number></span></i></span> characters long into multiple lines.</p>
\r
9010 <p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a
\r
9011 name="_Toc534975048">Mode Selector Flags</a></p>
\r
9013 <p class=TextFontCX>Mode selects flags set the
\r
9014 mode checking flags to predefined values. They provide a quick coarse-grain
\r
9015 way of controlling what classes of errors are reported. Specific checking flags
\r
9016 may be set after a mode flag to override the mode settings. Mode flags may be
\r
9017 used locally, however the mode settings will override specific command line
\r
9018 flag settings. A warning is produced if a mode flag is used after a mode
\r
9019 checking flag has been set. </p>
\r
9021 <p class=TextFontCX> </p>
\r
9023 <p class=beforelist>These are brief descriptions to give a general idea of what
\r
9024 each mode does. To see the complete flag settings in each mode, use <span
\r
9025 class=Flag><span style='font-size:10.0pt'>splint -help modes</span></span>. A
\r
9026 mode flag has the same effect when used with either <span class=Flag><span
\r
9027 style='font-size:10.0pt'>+</span></span> or <span class=Flag><span
\r
9028 style='font-size:10.0pt'>-</span></span>.</p>
\r
9030 <p class=TextFontCX><span class=Flag><span
\r
9031 style='font-size:10.0pt'>weak</span></span></p>
\r
9033 <p class=IndentText>Weak checking, intended for typical unannotated C code. No
\r
9034 modifies checking, macro checking, rep exposure, or clean interface checking is
\r
9035 done. Return values of type <span class=CodeText><span style='font-size:10.0pt'>int</span></span>
\r
9036 may be ignored. The types <span class=CodeText><span style='font-size:10.0pt'>bool</span></span>,
\r
9037 <span class=CodeText><span style='font-size:10.0pt'>int</span></span>, <span
\r
9038 class=CodeText><span style='font-size:10.0pt'>char</span></span> and
\r
9039 user-defined <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>
\r
9040 types are all equivalent. Old style declarations are unreported. </p>
\r
9042 <p class=TextFontCX><span class=Flag><span
\r
9043 style='font-size:10.0pt'>standard</span></span></p>
\r
9045 <p class=IndentText>The default mode. All checking done by <span class=Flag><span
\r
9046 style='font-size:10.0pt'>weak</span></span>, plus modifies checking, global,
\r
9047 alias checking, use all parameters, using released storage, ignored return
\r
9048 values or any type, macro checking, unreachable code, infinite loops, and fall
\r
9049 through cases. The types <span class=CodeText><span style='font-size:10.0pt'>bool</span></span>,
\r
9050 <span class=CodeText><span style='font-size:10.0pt'>int</span></span> and <span
\r
9051 class=CodeText><span style='font-size:10.0pt'>char</span></span> are distinct.
\r
9052 Old style declarations are reported.</p>
\r
9054 <p class=TextFontCX> <span class=Flag><span
\r
9055 style='font-size:10.0pt'>checks</span></span></p>
\r
9057 <p class=IndentText>Moderately strict checking. All checking done by <span
\r
9058 class=Flag><span style='font-size:10.0pt'>standard</span></span>, plus must
\r
9059 modification checking, rep exposure, return alias, memory management and
\r
9060 complete interfaces.</p>
\r
9062 <p class=TextFontCX><span class=Flag><span
\r
9063 style='font-size:10.0pt'>strict</span></span></p>
\r
9065 <p class=IndentText>Absurdly strict checking. All checking done by <span
\r
9066 class=Flag><span style='font-size:10.0pt'>checks</span></span>, plus
\r
9067 modifications and global variables used in unspecified functions, strict
\r
9068 standard library, and strict typing of C operators. A special reward will be presented to the first person to produce a real program that produces no
\r
9069 errors with <span class=Flag><span style='font-size:10.0pt'>strict </span></span>checking.</p>
\r
9071 <p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a
\r
9072 name="_Ref344798116"></a><a name="_Toc534975049">Checking Flags</a></p>
\r
9074 <p class=TextFontCX>These flags control checking
\r
9075 done by Splint. They may be set locally using syntactic comments, from the
\r
9076 command line, or in an options file. Some flags directly control whether a
\r
9077 certain class of message is reported. Preceding the flag by <span class=Flag><span
\r
9078 style='font-size:10.0pt'>+</span></span> turns reporting on, and preceding the
\r
9079 flag by <span class=Flag><span style='font-size:10.0pt'>-</span></span> turns
\r
9080 reporting off. Other flags control checking less directly by determining
\r
9081 default values (what annotations are implicit), making types equivalent (to
\r
9082 prevent certain type errors), controlling representation access, etc. For
\r
9083 these flags, the effect of <span class=Flag><span style='font-size:10.0pt'>+</span></span>
\r
9084 is described, and the effect of <span class=Flag><span style='font-size:10.0pt'>-</span></span>
\r
9085 is the opposite (or explicitly explained if there is no clear opposite). The
\r
9086 organization of this section mirrors Sections 2-14.</p>
\r
9088 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
9089 name="_Toc534975050">Key</a></p>
\r
9091 <p class=beforelist>To the left of each flag name is a flag descriptor encoding
\r
9092 what kind of flag it is and its default value. The descriptions are:</p>
\r
9096 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9099 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9100 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9101 <p class=TextFontCX align=center
\r
9102 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9103 </span><span class=Flag><span style='font-size:10.0pt'>-</span></span></p>
\r
9110 <p class=TextFontCX>A <i>plain</i> flag. The
\r
9111 value after the colon gives the default setting (e.g., this flag is off.) </p>
\r
9113 <p class=TextFontCX> </p>
\r
9117 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9120 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9121 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9122 <p class=TextFontCX align=center
\r
9123 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9124 class=Flag><span style='font-size:10.0pt'>--++</span></span></p>
\r
9131 <p class=TextFontCX>A <i>mode checking flag</i>.
\r
9132 The value of the flag is set by the mode selector. The four signs give the
\r
9133 setting in the weak, standard, checks and strict modes. (e.g., this flag is off
\r
9134 in the weak and standard modes, and on in the checks and strict modes.) </p>
\r
9136 <p class=TextFontCX> </p>
\r
9140 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9143 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9144 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9145 <p class=TextFontCX align=center
\r
9146 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
9153 <p class=TextFontCX>A <i>shortcut</i> flag. This
\r
9154 flag sets other flags, so it has no default value.</p>
\r
9156 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
9157 name="_Toc534975051"></a><a name="_Toc534975056">Null Dereferences </a><span
\r
9158 class=TextFontCXChar><span style='font-size:11.0pt;
\r
9159 font-weight:normal'>(Section 2)</span></span> </p>
\r
9163 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9166 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9167 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9168 <p class=TextFontCX align=center
\r
9169 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9170 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9177 <p class=TextFontCX><span
\r
9178 class=Flag><span style='font-size:10.0pt'>null</span></span></p>
\r
9180 <p class=IndentText>A possibly null pointer may be dereferenced, or used
\r
9181 somewhere a non-null pointer is expected.</p>
\r
9183 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
9184 name="_Toc534975055">Use Before Definition </a><span
\r
9185 class=TextFontCXChar><span style='font-size:11.0pt;
\r
9186 font-weight:normal'>(Section 3)</span></span><span
\r
9187 class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
9191 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9194 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9195 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9196 <p class=TextFontCX align=center
\r
9197 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9198 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9205 <p class=TextFontCX><span
\r
9206 class=Flag><span style='font-size:10.0pt'>use-def</span></span></p>
\r
9208 <p class=IndentText>The value of a location that may not be initialized on some
\r
9209 execution path is used.</p>
\r
9213 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9216 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9217 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9218 <p class=TextFontCX align=center
\r
9219 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9220 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
9227 <p class=TextFontCX><span class=Flag><span
\r
9228 style='font-size:10.0pt'>imp-outs</span></span></p>
\r
9230 <p class=IndentText>Allow unannotated pointer parameters to functions to be
\r
9231 implicit out parameters.</p>
\r
9235 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9238 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9239 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9240 <p class=TextFontCX align=center
\r
9241 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9242 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9249 <p class=TextFontCX><span class=Flag><span
\r
9250 style='font-size:10.0pt'>comp-def</span></span></p>
\r
9252 <p class=IndentText>Storage derivable from a parameter, return value or global
\r
9253 variable is not completely defined.</p>
\r
9257 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9260 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9261 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9262 <p class=TextFontCX align=center
\r
9263 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9264 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9271 <p class=TextFontCX><span class=Flag><span
\r
9272 style='font-size:10.0pt'>union-def</span></span></p>
\r
9274 <p class=IndentText>No field of a union is defined. (No error is reported if
\r
9275 at least one union field is defined.)</p>
\r
9279 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9282 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9283 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9284 <p class=TextFontCX align=center
\r
9285 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9286 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9293 <p class=TextFontCX><span class=Flag><span
\r
9294 style='font-size:10.0pt'>must-define</span></span></p>
\r
9296 <p class=IndentText>Parameter declared with <span class=Keyword><span
\r
9297 style='font-size:10.0pt'>out</span></span> is not defined before return or
\r
9300 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'>Types <span
\r
9301 class=TextFontCXChar><span style='font-size:11.0pt;
\r
9302 font-weight:normal'>(Section </span></span><span
\r
9303 class=TextFontCXChar><span style='font-size:11.0pt;
\r
9304 font-weight:normal'>4</span></span><span
\r
9305 class=TextFontCXChar><span style='font-size:11.0pt;
\r
9306 font-weight:normal'>)</span></span></p>
\r
9308 <p class=IndentText> </p>
\r
9312 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9315 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9316 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9317 <p class=TextFontCX align=center
\r
9318 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9319 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
9326 <p class=TextFontCX><span class=Flag><span
\r
9327 style='font-size:10.0pt'>type</span></span></p>
\r
9329 <p class=IndentText>Type mismatch.</p>
\r
9331 <p class=Heading10>Boolean Types <span class=HeadingNote><span
\r
9332 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
9333 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
9334 normal'>4.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
9335 font-weight:normal;font-style:normal'>)</span></span></p>
\r
9337 <p class=TextFontCX>These flags control the type
\r
9338 name used to represent Booleans, and whether the Boolean type is abstract.</p>
\r
9340 <p class=TextFontCX> </p>
\r
9344 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9347 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9348 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9349 <p class=TextFontCX align=center
\r
9350 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9351 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
9358 <p class=TextFontCX><span class=Flag><span
\r
9359 style='font-size:10.0pt'>bool</span></span></p>
\r
9361 <p class=IndentText>Boolean type is an abstract type.</p>
\r
9365 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9368 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9369 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9370 <p class=TextFontCX align=center
\r
9371 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9372 </span><span class=Flag><span style='font-size:10.0pt'>bool</span></span></p>
\r
9379 <p class=TextFontCX><span class=Flag><span
\r
9380 style='font-size:10.0pt'>booltype </span></span><span
\r
9381 class=Flag><span style='font-size:10.0pt'><i><name></i></span></span> </p>
\r
9383 <p class=IndentText>Set name of Boolean type to <i><name></i>.</p>
\r
9387 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9390 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9391 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9392 <p class=TextFontCX align=center
\r
9393 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:</span><span
\r
9394 class=Flag><span style='font-size:10.0pt'>FALSE</span></span></p>
\r
9401 <p class=TextFontCX><span class=Flag><span
\r
9402 style='font-size:10.0pt'>boolfalse </span></span><span
\r
9403 class=Flag><span style='font-size:10.0pt'><i><name></i></span></span></p>
\r
9405 <p class=IndentText>Set name of Boolean false to <i><name></i>.</p>
\r
9409 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9412 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9413 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9414 <p class=TextFontCX align=center
\r
9415 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9416 </span><span class=Flag><span style='font-size:10.0pt'>TRUE</span></span></p>
\r
9423 <p class=TextFontCX><span class=Flag><span
\r
9424 style='font-size:10.0pt'>booltrue </span></span><span
\r
9425 class=Flag><span style='font-size:10.0pt'><i><name></i></span></span></p>
\r
9427 <p class=IndentText>Set name of Boolean true to <i><name></i>.</p>
\r
9429 <p class=Heading10><a name="_Ref344871224">Predicates</a></p>
\r
9433 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9436 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9437 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9438 <p class=TextFontCX align=center
\r
9439 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9440 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
9447 <p class=TextFontCX><span
\r
9448 class=Flag><span style='font-size:10.0pt'>pred-bool-ptr</span></span></p>
\r
9450 <p class=IndentText>Type of condition test is a pointer.</p>
\r
9454 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9457 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9458 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9459 <p class=TextFontCX align=center
\r
9460 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9461 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9468 <p class=TextFontCX><span class=Flag><span
\r
9469 style='font-size:10.0pt'>pred-bool-int</span></span></p>
\r
9471 <p class=IndentText>Type of condition test is an integral type.</p>
\r
9475 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9478 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9479 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9480 <p class=TextFontCX align=center
\r
9481 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9482 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
9489 <p class=TextFontCX><span class=Flag><span
\r
9490 style='font-size:10.0pt'>pred-bool-others</span></span></p>
\r
9492 <p class=IndentText>Type of condition test is not a Boolean, pointer or integral
\r
9497 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9500 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9501 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9502 <p class=TextFontCX align=center
\r
9503 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
9510 <p class=TextFontCX><span class=Flag><span
\r
9511 style='font-size:10.0pt'>pred-bool</span></span></p>
\r
9513 <p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>predboolint</span></span>, <span
\r
9514 class=Flag><span style='font-size:10.0pt'>predboolptr</span></span> and <span class=Flag><span style='font-size:10.0pt'>preboolothers</span></span>.</p>
\r
9518 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9521 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9522 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9523 <p class=TextFontCX align=center
\r
9524 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9525 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
9532 <p class=TextFontCX><span class=Flag><span
\r
9533 style='font-size:10.0pt'>pred-assign</span></span></p>
\r
9535 <p class=IndentText>The condition test is an assignment expression. If an
\r
9536 assignment is intended, add an extra parentheses nesting (e.g., <span
\r
9537 class=CodeText><span style='font-size:10.0pt'>if ((a = b))</span></span> ...).</p>
\r
9539 <p class=Heading10>Primitive Operations</p>
\r
9543 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9546 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9547 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9548 <p class=TextFontCX align=center
\r
9549 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9550 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
9557 <p class=TextFontCX><span
\r
9558 class=Flag><span style='font-size:10.0pt'>ptr-arith</span></span></p>
\r
9560 <p class=IndentText>Arithmetic involving pointer and integer.</p>
\r
9564 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9567 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9568 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9569 <p class=TextFontCX align=center
\r
9570 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9571 class=Keyword><span style='font-size:10.0pt'>++--</span></span></p>
\r
9578 <p class=TextFontCX><span class=Flag><span
\r
9579 style='font-size:10.0pt'>ptr-negate</span></span></p>
\r
9581 <p class=IndentText>Allow the operand of the <span class=CodeText><span
\r
9582 style='font-size:10.0pt'>!</span></span> operator to be a pointer.<span
\r
9583 class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
9587 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9590 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9591 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9592 <p class=TextFontCX align=center
\r
9593 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9594 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
9601 <p class=TextFontCX><span class=Flag><span
\r
9602 style='font-size:10.0pt'>bitwise-signed</span></span><span
\r
9603 class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
9605 <p class=IndentText>An operand to a bitwise operator is not an unsigned value.
\r
9606 This may have unexpected results depending on the signed representations.<span
\r
9607 class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
9611 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9614 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9615 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9616 <p class=TextFontCX align=center
\r
9617 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9618 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9625 <p class=TextFontCX><span class=Flag><span
\r
9626 style='font-size:10.0pt'>shift-signed</span></span></p>
\r
9628 <p class=IndentText>The left operand to a shift operator is not an unsigned
\r
9633 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9636 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9637 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9638 <p class=TextFontCX align=center
\r
9639 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9640 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
9647 <p class=TextFontCX><span class=Flag><span
\r
9648 style='font-size:10.0pt'>strict-ops</span></span></p>
\r
9650 <p class=IndentText>Primitive operation does not type check strictly.</p>
\r
9654 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9657 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9658 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9659 <p class=TextFontCX align=center
\r
9660 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9661 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
9668 <p class=TextFontCX><span class=Flag><span
\r
9669 style='font-size:10.0pt'>sizeof-type</span></span></p>
\r
9671 <p class=IndentText>Operand of <span
\r
9672 class=CodeText><span style='font-size:10.0pt'>sizeof</span></span> operator is
\r
9673 a type. (Safer to use <span class=CodeText><span style='font-size:10.0pt'>int
\r
9674 *x = sizeof (*x);</span></span> instead of <span class=CodeText><span
\r
9675 style='font-size:10.0pt'>sizeof (int)</span></span>.)</p>
\r
9677 <p class=Heading10>Array Formal Parameters</p>
\r
9679 <p class=TextFontCX>These flags control reporting
\r
9680 of common errors caused by confusion about the semantics of array formal
\r
9681 parameters.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
9683 <p class=TextFontCX> </p>
\r
9687 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9690 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9691 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9692 <p class=TextFontCX align=center
\r
9693 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9694 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
9701 <p class=TextFontCX><span class=Flag><span
\r
9702 style='font-size:10.0pt'>sizeof-formal-array</span></span></p>
\r
9704 <p class=IndentText>The <span class=CodeText><span style='font-size:10.0pt'>sizeof</span></span>
\r
9705 operator is used on a parameter declared as an array. (In many instances this
\r
9706 has unexpected behavior, since the result is the size of a pointer to the
\r
9707 element type, not the number of elements in the array.) </p>
\r
9709 <p class=IndentText> </p>
\r
9713 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9716 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9717 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9718 <p class=TextFontCX align=center
\r
9719 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9720 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
9727 <p class=TextFontCX><span class=Flag><span
\r
9728 style='font-size:10.0pt'>fixed-formal-array</span></span></p>
\r
9730 <p class=IndentText>An array formal parameter is declared with a fixed size
\r
9731 (e.g., <span class=CodeText><span style='font-size:10.0pt'>int x[20]</span></span>).
\r
9732 This is likely to be confusing, since the size is ignored.</p>
\r
9736 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9739 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9740 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9741 <p class=TextFontCX align=center
\r
9742 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9743 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
9750 <p class=TextFontCX><span class=Flag><span
\r
9751 style='font-size:10.0pt'>formal-array</span></span></p>
\r
9753 <p class=IndentText>A formal parameter is declared as an array. This is
\r
9754 probably not a problem, but can be confusing since it is treated as a pointer.
\r
9757 <p class=Heading10>Format Codes</p>
\r
9761 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9764 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9765 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9766 <p class=TextFontCX align=center
\r
9767 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9768 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
9775 <p class=TextFontCX><span
\r
9776 class=Flag><span style='font-size:10.0pt'>format-code</span></span></p>
\r
9778 <p class=IndentText>Invalid format code in format string for <span class=Annot><span
\r
9779 style='font-size:10.0pt'>printflike</span></span> or <span class=Annot><span
\r
9780 style='font-size:10.0pt'>scanflike</span></span> function.</p>
\r
9784 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9787 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9788 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9789 <p class=TextFontCX align=center
\r
9790 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9791 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
9798 <p class=TextFontCX><span class=Flag><span
\r
9799 style='font-size:10.0pt'>format-type</span></span></p>
\r
9801 <p class=IndentText>Type-mismatch in parameter corresponding to format code in
\r
9802 a <span class=Annot><span style='font-size:10.0pt'>printflike</span></span> or <span
\r
9803 class=Annot><span style='font-size:10.0pt'>scanflike</span></span> function.</p>
\r
9805 <p class=Heading10>Main</p>
\r
9809 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9812 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9813 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9814 <p class=TextFontCX align=center
\r
9815 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9816 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
9823 <p class=TextFontCX><span
\r
9824 class=Flag><span style='font-size:10.0pt'>main-type</span></span></p>
\r
9826 <p class=IndentText>Type of <span class=CodeText><span style='font-size:10.0pt'>main</span></span>
\r
9827 does not match expected type (function returning an <span class=CodeText><span
\r
9828 style='font-size:10.0pt'>int</span></span>, taking no parameters or two
\r
9829 parameters of type <span class=CodeText><span style='font-size:10.0pt'>int</span></span>
\r
9830 and <span class=CodeText><span style='font-size:10.0pt'>char **</span></span>.)</p>
\r
9832 <p class=Heading10>Comparisons</p>
\r
9836 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9839 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9840 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9841 <p class=TextFontCX align=center
\r
9842 style='text-align:center;background:#CCCCCC'><a name=boolcompare></a><a
\r
9843 name=boolprose><span style='font-size:10.0pt'>m:</span></a><span
\r
9844 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9851 <p class=TextFontCX><span
\r
9852 class=Flag><span style='font-size:10.0pt'>bool-compare</span></span></p>
\r
9854 <p class=IndentText>Comparison between Boolean values. This is dangerous since
\r
9855 there may be multiple true values as any non-zero value is interpreted as true.</p>
\r
9859 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9862 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9863 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9864 <p class=TextFontCX align=center
\r
9865 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9866 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9873 <p class=TextFontCX><span class=Flag><span
\r
9874 style='font-size:10.0pt'>real-compare</span></span></p>
\r
9876 <p class=IndentText>Comparison involving <span class=CodeText><span
\r
9877 style='font-size:10.0pt'>float</span></span> or <span class=CodeText><span
\r
9878 style='font-size:10.0pt'>double</span></span> values. This is dangerous since
\r
9879 it may produce unexpected results because floating point representations are
\r
9884 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9887 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9888 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9889 <p class=TextFontCX align=center
\r
9890 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9891 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9898 <p class=TextFontCX><span class=Flag><span
\r
9899 style='font-size:10.0pt'>ptr-compare</span></span></p>
\r
9901 <p class=IndentText>Comparison between pointer and number.</p>
\r
9903 <p class=Heading10>Type Equivalence</p>
\r
9907 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9910 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9911 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9912 <p class=TextFontCX align=center
\r
9913 style='text-align:center;background:#CCCCCC'><a name=globs></a><span
\r
9914 style='font-size:10.0pt'>m:</span><span class=Keyword><span style='font-size:
\r
9915 10.0pt'>+---</span></span></p>
\r
9922 <p class=TextFontCX><span
\r
9923 class=Flag><span style='font-size:10.0pt'>void-abstract</span></span></p>
\r
9925 <p class=IndentText>Allow <span class=CodeText><span style='font-size:10.0pt'>void
\r
9926 *</span></span> to match pointers to abstract types. (Casting a pointer to an abstract type to a pointer to <span class=CodeText><span
\r
9927 style='font-size:10.0pt'>void</span></span> is okay if <span class=Flag><span
\r
9928 style='font-size:10.0pt'>+void-abstract</span></span> is set.)</p>
\r
9932 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9935 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9936 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9937 <p class=TextFontCX align=center
\r
9938 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
9946 <p class=TextFontCX><span class=Flag><span
\r
9947 style='font-size:10.0pt'>cast-fcn-ptr</span></span></p>
\r
9949 <p class=IndentText> A pointer to a function is cast to (or used as) a pointer
\r
9950 to void (or vice versa).</p>
\r
9954 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9957 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9958 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9959 <p class=TextFontCX align=center
\r
9960 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9961 class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>
\r
9968 <p class=TextFontCX><span class=Flag><span
\r
9969 style='font-size:10.0pt'>forward-decl</span></span></p>
\r
9971 <p class=IndentText>Forward declarations of pointers to abstract representation
\r
9972 match abstract type.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
9976 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
9979 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
9980 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
9981 <p class=TextFontCX align=center
\r
9982 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
9983 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
9990 <p class=TextFontCX><span class=Flag><span
\r
9991 style='font-size:10.0pt'>imp-type </span></span></p>
\r
9993 <p class=IndentText>A variable declaration has no explicit type. The type is
\r
9994 implicitly int.</p>
\r
9998 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10001 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10002 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10003 <p class=TextFontCX align=center
\r
10004 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10005 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
10012 <p class=TextFontCX><span class=Flag><span
\r
10013 style='font-size:10.0pt'>incomplete-type </span></span></p>
\r
10015 <p class=IndentText>A formal parameter is declared with an incomplete type
\r
10016 (e.g., <span class=Keyword><span style='font-size:10.0pt'>int[][]</span></span>).
\r
10021 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10024 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10025 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10026 <p class=TextFontCX align=center
\r
10027 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10028 class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>
\r
10035 <p class=TextFontCX><span class=Flag><span
\r
10036 style='font-size:10.0pt'>char-index</span></span></p>
\r
10038 <p class=IndentText>Allow <span class=CodeText><span style='font-size:10.0pt'>char</span></span>
\r
10039 to index arrays.</p>
\r
10043 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10046 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10047 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10048 <p class=TextFontCX align=center
\r
10049 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10050 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
10057 <p class=TextFontCX><span class=Flag><span
\r
10058 style='font-size:10.0pt'>enum-index</span></span></p>
\r
10060 <p class=IndentText>Allow members of <span class=CodeText><span
\r
10061 style='font-size:10.0pt'>enum</span></span><span class=Keyword><span
\r
10062 style='font-size:10.0pt'> </span></span>type to index arrays.</p>
\r
10066 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10069 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10070 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10071 <p class=TextFontCX align=center
\r
10072 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10073 class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>
\r
10080 <p class=TextFontCX><span class=Flag><span
\r
10081 style='font-size:10.0pt'>bool-int</span></span></p>
\r
10083 <p class=IndentText>Make <span class=CodeText><span style='font-size:10.0pt'>bool</span></span>
\r
10084 and <span class=CodeText><span style='font-size:10.0pt'>int</span></span> are
\r
10085 equivalent. (No type errors are reported when a Boolean is used where an
\r
10086 integral type is expected and vice versa.) </p>
\r
10090 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10093 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10094 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10095 <p class=TextFontCX align=center
\r
10096 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10097 class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>
\r
10104 <p class=TextFontCX><span class=Flag><span
\r
10105 style='font-size:10.0pt'>char-int</span></span></p>
\r
10107 <p class=IndentText>Make <span class=CodeText><span style='font-size:10.0pt'>char</span></span>
\r
10108 and <span class=CodeText><span style='font-size:10.0pt'>int</span></span> types
\r
10113 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10116 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10117 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10118 <p class=TextFontCX align=center
\r
10119 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10120 class=Keyword><span style='font-size:10.0pt'>++--</span></span></p>
\r
10127 <p class=TextFontCX><span class=Flag><span
\r
10128 style='font-size:10.0pt'>enum-int</span></span></p>
\r
10130 <p class=IndentText>Make <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>
\r
10131 and <span class=CodeText><span style='font-size:10.0pt'>int</span></span> types
\r
10136 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10139 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10140 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10141 <p class=TextFontCX align=center
\r
10142 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10143 class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>
\r
10150 <p class=TextFontCX><span class=Flag><span
\r
10151 style='font-size:10.0pt'>float-double </span></span></p>
\r
10153 <p class=IndentText>Make <span class=CodeText><span style='font-size:10.0pt'>float</span></span>
\r
10154 and <span class=CodeText><span style='font-size:10.0pt'>double</span></span>
\r
10155 types equivalent</p>
\r
10159 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10162 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10163 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10164 <p class=TextFontCX align=center
\r
10165 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10166 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
10173 <p class=TextFontCX><span class=Flag><span
\r
10174 style='font-size:10.0pt'>ignore-quals</span></span></p>
\r
10176 <p class=IndentText>Ignore type qualifiers (<span class=CodeText><span
\r
10177 style='font-size:10.0pt'>long</span></span>, <span class=CodeText><span
\r
10178 style='font-size:10.0pt'>short</span></span>, <span class=CodeText><span
\r
10179 style='font-size:10.0pt'>unsigned</span></span>).</p>
\r
10183 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10186 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10187 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10188 <p class=TextFontCX align=center
\r
10189 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10190 class=Keyword><span style='font-size:10.0pt'>++--</span></span></p>
\r
10197 <p class=TextFontCX><span class=Flag><span
\r
10198 style='font-size:10.0pt'>relax-quals</span></span></p>
\r
10200 <p class=IndentText>Report qualifier mismatches only if dangerous (information
\r
10201 may be lost since a larger type is assigned to (or passed as) a smaller one or
\r
10202 a comparison uses <span class=CodeText><span style='font-size:10.0pt'>signed</span></span>
\r
10203 and <span class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>
\r
10208 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10211 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10212 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10213 <p class=TextFontCX align=center
\r
10214 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10215 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
10222 <p class=TextFontCX><span class=Flag><span
\r
10223 style='font-size:10.0pt'>ignore-signs</span></span></p>
\r
10225 <p class=IndentText>Ignore signs in type comparisons (<span class=CodeText><span
\r
10226 style='font-size:10.0pt'>unsigned</span></span> matches <span class=CodeText><span
\r
10227 style='font-size:10.0pt'>signed</span></span>).</p>
\r
10229 <p class=IndentText> </p>
\r
10233 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10236 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10237 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10238 <p class=TextFontCX align=center
\r
10239 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10240 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
10247 <p class=TextFontCX><span class=Flag><span
\r
10248 style='font-size:10.0pt'>long-integral</span></span></p>
\r
10250 <p class=IndentText>Allow long type to match an arbitrary integral type (e.g., <span
\r
10251 class=CodeText><span style='font-size:10.0pt'>dev_t</span></span>).</p>
\r
10255 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10258 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10259 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10260 <p class=TextFontCX align=center
\r
10261 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10262 class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>
\r
10269 <p class=TextFontCX><span class=Flag><span
\r
10270 style='font-size:10.0pt'>long-unsigned-integral</span></span></p>
\r
10272 <p class=IndentText>Allow unsigned long type to match an arbitrary integral
\r
10273 type (e.g., <span class=CodeText><span style='font-size:10.0pt'>dev_t</span></span>).</p>
\r
10277 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10280 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10281 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10282 <p class=TextFontCX align=center
\r
10283 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10284 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
10291 <p class=TextFontCX><span class=Flag><span
\r
10292 style='font-size:10.0pt'>match-any-integral</span></span></p>
\r
10294 <p class=IndentText>Allow any integral type to match an arbitrary </p>
\r
10298 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10301 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10302 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10303 <p class=TextFontCX align=center
\r
10304 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10305 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
10312 <p class=TextFontCX><span class=Flag><span
\r
10313 style='font-size:10.0pt'>long-unsigned-unsigned-integral</span></span></p>
\r
10315 <p class=IndentText>Allow unsigned long type to match an arbitrary unsigned
\r
10316 integral type (e.g., <span class=CodeText><span style='font-size:10.0pt'>size_t</span></span>).</p>
\r
10320 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10323 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10324 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10325 <p class=TextFontCX align=center
\r
10326 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10327 class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>
\r
10334 <p class=TextFontCX><span class=Flag><span
\r
10335 style='font-size:10.0pt'>long-signed-integral</span></span></p>
\r
10337 <p class=IndentText>Allow long type to match an arbitrary signed integral type
\r
10338 (e.g., <span class=CodeText><span style='font-size:10.0pt'>ssize_t</span></span>).</p>
\r
10340 <p class=TextFontCX><span class=Flag><span
\r
10341 style='font-size:10.0pt'> </span></span></p>
\r
10345 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10348 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10349 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10350 <p class=TextFontCX align=center
\r
10351 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10352 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
10359 <p class=TextFontCX><span class=Flag><span
\r
10360 style='font-size:10.0pt'>num-literal</span></span></p>
\r
10362 <p class=IndentText>Integer literals can be used as floats. </p>
\r
10366 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10369 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10370 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10371 <p class=TextFontCX align=center
\r
10372 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10373 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
10380 <p class=TextFontCX><span class=Flag><span
\r
10381 style='font-size:10.0pt'>char-int-literal</span></span></p>
\r
10383 <p class=IndentText>A character constant may be used as an <span
\r
10384 class=CodeText><span style='font-size:10.0pt'>int</span></span>. </p>
\r
10388 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10391 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10392 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10393 <p class=TextFontCX align=center
\r
10394 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10395 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
10402 <p class=TextFontCX><span class=Flag><span
\r
10403 style='font-size:10.0pt'>zero-ptr</span></span></p>
\r
10405 <p class=IndentText>Literal <span class=CodeText><span style='font-size:10.0pt'>0</span></span>
\r
10406 may be used as a pointer.</p>
\r
10410 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10413 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10414 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10415 <p class=TextFontCX align=center
\r
10416 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10417 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
10424 <p class=TextFontCX><span class=Flag><span
\r
10425 style='font-size:10.0pt'>relax-types</span></span></p>
\r
10427 <p class=IndentText>Allow all numeric types to match.</p>
\r
10429 <p class=Heading10><a name="_Toc534975052">Abstract Types </a><span
\r
10430 class=TextFontCXChar><span style='font-size:11.0pt;
\r
10431 font-weight:normal'>(Section </span></span><span
\r
10432 class=TextFontCXChar><span style='font-size:11.0pt;
\r
10433 font-weight:normal'>4.3</span></span><span
\r
10434 class=TextFontCXChar><span style='font-size:11.0pt;
\r
10435 font-weight:normal'>)</span></span></p>
\r
10439 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10442 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10443 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10444 <p class=TextFontCX align=center
\r
10445 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10446 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
10453 <p class=TextFontCX><span class=Flag><span
\r
10454 style='font-size:10.0pt'>abstract</span></span></p>
\r
10456 <p class=IndentText>A data abstraction barrier is violated</p>
\r
10460 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10463 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10464 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10465 <p class=TextFontCX align=center
\r
10466 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10467 </span><span class=Flag><span style='font-size:10.0pt'>-</span></span></p>
\r
10474 <p class=TextFontCX><span
\r
10475 class=Flag><span style='font-size:10.0pt'>imp-abstract</span></span></p>
\r
10477 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>abstract</span></span>
\r
10478 annotation for type declarations that do not use <span class=Annot><span
\r
10479 style='font-size:10.0pt'>concrete</span></span>.</p>
\r
10483 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10486 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10487 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10488 <p class=TextFontCX align=center
\r
10489 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10490 class=Flag><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10497 <p class=TextFontCX><span class=Flag><span
\r
10498 style='font-size:10.0pt'>mut-rep</span></span></p>
\r
10500 <p class=IndentText>Representation of mutable type has sharing semantics.</p>
\r
10502 <p class=Heading10>Access <span
\r
10503 class=TextFontCXChar><span style='font-size:11.0pt;
\r
10504 font-weight:normal'>(Section 4.3.1)</span></span></p>
\r
10508 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10511 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10512 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10513 <p class=TextFontCX align=center
\r
10514 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10522 <p class=TextFontCX><span class=Flag><span
\r
10523 style='font-size:10.0pt'>access-module</span></span></p>
\r
10525 <p class=IndentText>An abstract type defined in <span class=ProgramNameChar><i>M</i></span><span
\r
10526 class=ProgramNameChar>.h</span> (or specified in <span class=ProgramNameChar><i>M</i></span><span
\r
10527 class=ProgramNameChar>.lcl</span>) is accessible in <span
\r
10528 class=ProgramNameChar><i>M</i></span><span class=ProgramNameChar>.c</span>.</p>
\r
10532 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10535 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10536 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10537 <p class=TextFontCX align=center
\r
10538 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10539 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
10546 <p class=TextFontCX><span class=Flag><span
\r
10547 style='font-size:10.0pt'>access-file</span></span></p>
\r
10549 <p class=IndentText>An abstract type named <span class=CodeText><i><span
\r
10550 style='font-size:10.0pt'>type</span></i></span> is accessible in files named <span
\r
10551 class=ProgramNameChar><i>type</i></span><span class=ProgramNameChar>.*</span></p>
\r
10555 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10558 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10559 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10560 <p class=TextFontCX align=center
\r
10561 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10562 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
10569 <p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>access-czech</span></span></p>
\r
10571 <p class=IndentText>An abstract type named <span class=CodeText><i><span
\r
10572 style='font-size:10.0pt'>type</span></i></span> may be accessible in a function
\r
10573 named <span class=CodeText><i><span style='font-size:10.0pt'>type_name</span></i></span>.
\r
10574 (Section 12.1.1)</p>
\r
10578 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10581 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10582 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10583 <p class=TextFontCX align=center
\r
10584 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10585 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
10592 <p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>access-slovak</span></span></p>
\r
10594 <p class=IndentText>An abstract type named <span class=CodeText><i><span
\r
10595 style='font-size:10.0pt'>type</span></i></span> may be accessible in a function
\r
10596 named <span class=CodeText><i><span style='font-size:10.0pt'>typeName</span></i></span>.
\r
10597 (Section.12.1.2)</p>
\r
10601 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10604 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10605 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10606 <p class=TextFontCX align=center
\r
10607 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
10608 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
10615 <p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>access-czechoslovak</span></span></p>
\r
10617 <p class=IndentText>An abstract type named <span class=CodeText><i><span
\r
10618 style='font-size:10.0pt'>type</span></i></span> may be accessible in a function
\r
10619 named <span class=CodeText><i><span style='font-size:10.0pt'>type_name</span></i></span>
\r
10620 or <span class=CodeText><i><span style='font-size:10.0pt'>typeName</span></i></span>.
\r
10621 (Section 12.1.3)</p>
\r
10625 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10628 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10629 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10630 <p class=TextFontCX align=center
\r
10631 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
10638 <p class=TextFontCX><span class=Flag><span
\r
10639 style='font-size:10.0pt'>access-all</span></span></p>
\r
10641 <p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>access-module</span></span>,
\r
10642 <span class=Flag><span style='font-size:10.0pt'>access-file</span></span> and <span
\r
10643 class=Flag><span style='font-size:10.0pt'>access-czech</span></span>.</p>
\r
10645 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
10646 name="_Toc534975053">Memory Management</a> <span
\r
10647 class=TextFontCXChar><span style='font-size:11.0pt;
\r
10648 font-weight:normal'>(Section </span></span><span
\r
10649 class=TextFontCXChar><span style='font-size:11.0pt;
\r
10650 font-weight:normal'>5</span></span><span
\r
10651 class=TextFontCXChar><span style='font-size:11.0pt;
\r
10652 font-weight:normal'>)</span></span></p>
\r
10654 <p class=TextFontCX>Reporting of memory
\r
10655 management errors is controlled by flags setting checking and implicit
\r
10656 annotations and code annotations. </p>
\r
10658 <p class=Heading10>Deallocation Errors <span
\r
10659 class=TextFontCXChar><span style='font-size:11.0pt;
\r
10660 font-weight:normal'>(Section 5.2)</span></span></p>
\r
10664 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10667 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10668 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10669 <p class=TextFontCX align=center
\r
10670 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10671 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10678 <p class=TextFontCX><span class=Flag><span
\r
10679 style='font-size:10.0pt'>use-released</span></span></p>
\r
10681 <p class=IndentText>Storage used after it may have been released.</p>
\r
10685 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10688 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10689 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10690 <p class=TextFontCX align=center
\r
10691 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10692 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
10699 <p class=TextFontCX><span class=Flag><span
\r
10700 style='font-size:10.0pt'>strict-use-released</span></span></p>
\r
10702 <p class=IndentText>An array element used after it may have been released.</p>
\r
10704 <p class=Heading10>Inconsistent Branches</p>
\r
10708 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10711 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10712 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10713 <p class=TextFontCX align=center
\r
10714 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10715 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10722 <p class=TextFontCX><span class=Flag><span
\r
10723 style='font-size:10.0pt'>branch-state</span></span></p>
\r
10725 <p class=IndentText>Storage has inconsistent states of alternate paths through
\r
10726 a branch (e.g., it is released in the true branch of an if-statement, but there
\r
10727 is no else branch.)</p>
\r
10731 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10734 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10735 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10736 <p class=TextFontCX align=center
\r
10737 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10738 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
10745 <p class=TextFontCX><span class=Flag><span
\r
10746 style='font-size:10.0pt'>strict-branch-state</span></span></p>
\r
10748 <p class=IndentText>Storage through array fetch has inconsistent states of
\r
10749 alternate paths through a branch. Since array elements are not checked
\r
10750 accurately, this may lead to spurious errors.</p>
\r
10754 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10757 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10758 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10759 <p class=TextFontCX align=center
\r
10760 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10761 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
10768 <p class=TextFontCX><span class=Flag><span
\r
10769 style='font-size:10.0pt'>dep-arrays</span></span></p>
\r
10771 <p class=IndentText>Treat array elements as <span class=Annot><span
\r
10772 style='font-size:10.0pt'>dependent</span></span> storage. Checking of array
\r
10773 elements cannot be done accurately by Splint. If <span class=Flag><span
\r
10774 style='font-size:10.0pt'>dep-arrays</span></span> is not set, array elements
\r
10775 are assumed to be independent, so code that releases the same element more than
\r
10776 once will produce no error. If <span class=Flag><span style='font-size:10.0pt'>dep-arrays</span></span>
\r
10777 is set, array elements are assumed to be dependent, so code that releases the
\r
10778 same element more that once will produce an error, but code that releases
\r
10779 different elements correctly will produce a spurious error.</p>
\r
10781 <p class=Heading10>Memory Leaks</p>
\r
10785 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10788 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10789 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10790 <p class=TextFontCX align=center
\r
10791 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10792 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10799 <p class=TextFontCX><span
\r
10800 class=Flag><span style='font-size:10.0pt'>must-free</span></span></p>
\r
10802 <p class=IndentText>Allocated storage was not released before return or scope
\r
10803 exit. Errors are reported for <span class=Annot><span style='font-size:10.0pt'>only</span></span>, <span class=Annot><span style='font-size:10.0pt'>fresh</span></span> or <span
\r
10804 class=Annot><span style='font-size:10.0pt'>owned</span></span> storage.</p>
\r
10808 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10811 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10812 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10813 <p class=TextFontCX align=center
\r
10814 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10815 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10822 <p class=TextFontCX><span class=Flag><span
\r
10823 style='font-size:10.0pt'>comp-destroy</span></span></p>
\r
10825 <p class=IndentText>All only references derivable from <span class=Annot><span
\r
10826 style='font-size:10.0pt'>out only</span></span> parameter of type <span
\r
10827 class=CodeText><span style='font-size:10.0pt'>void *</span></span> must be
\r
10828 released. (This is the type of the parameter to <span class=CodeText><span
\r
10829 style='font-size:10.0pt'>free</span></span>, but may also be used for user-defined deallocation functions.)</p>
\r
10833 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10836 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10837 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10838 <p class=TextFontCX align=center
\r
10839 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10840 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
10847 <p class=TextFontCX><span class=Flag><span
\r
10848 style='font-size:10.0pt'>strict-destroy</span></span></p>
\r
10850 <p class=IndentText>Report complete destruction errors for array elements that
\r
10851 may have been released. (If <span class=Flag><span style='font-size:10.0pt'>strict-destroy</span></span>
\r
10852 is not set, Splint will assume that if any array element was released, the
\r
10853 entire array was correctly released.)</p>
\r
10855 <p class=Heading10>Transfer Errors </p>
\r
10857 <p class=beforelist>A transfer error is reported when storage is transferred
\r
10858 (by an assignment, passing a parameter, or returning) in a way that is
\r
10859 inconsistent. </p>
\r
10863 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10866 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10867 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10868 <p class=TextFontCX align=center
\r
10869 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
10876 <p class=TextFontCX><span class=Flag><span
\r
10877 style='font-size:10.0pt'>mem-trans</span></span></p>
\r
10879 <p class=IndentText>Sets all memory transfer errors flags.</p>
\r
10883 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10886 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10887 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10888 <p class=TextFontCX align=center
\r
10889 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10890 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10897 <p class=TextFontCX><span class=Flag><span
\r
10898 style='font-size:10.0pt'>only-trans</span></span></p>
\r
10900 <p class=IndentText>Only storage transferred to non-only reference (memory
\r
10905 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10908 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10909 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10910 <p class=TextFontCX align=center
\r
10911 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10912 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10919 <p class=TextFontCX><span class=Flag><span
\r
10920 style='font-size:10.0pt'>ownedtrans</span></span></p>
\r
10922 <p class=IndentText>Owned storage transferred to non-owned reference (memory leak).</p>
\r
10926 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10929 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10930 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10931 <p class=TextFontCX align=center
\r
10932 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10933 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10940 <p class=TextFontCX><span class=Flag><span
\r
10941 style='font-size:10.0pt'>fresh-trans</span></span></p>
\r
10943 <p class=IndentText>Newly-allocated storage transferred to non-only reference
\r
10944 (memory leak).</p>
\r
10948 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10951 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10952 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10953 <p class=TextFontCX align=center
\r
10954 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10955 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10962 <p class=TextFontCX><span class=Flag><span
\r
10963 style='font-size:10.0pt'>shared-trans</span></span></p>
\r
10965 <p class=IndentText>Shared storage transferred to non-shared reference</p>
\r
10969 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10972 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10973 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10974 <p class=TextFontCX align=center
\r
10975 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10976 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
10983 <p class=TextFontCX><span class=Flag><span
\r
10984 style='font-size:10.0pt'>dependent-trans</span></span></p>
\r
10986 <p class=IndentText>Inconsistent <span class=Annot><span style='font-size:10.0pt'>dependent</span></span> transfer. Dependent storage is transferred to a non-dependent reference.</p>
\r
10990 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
10993 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
10994 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
10995 <p class=TextFontCX align=center
\r
10996 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
10997 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11004 <p class=TextFontCX><span class=Flag><span
\r
11005 style='font-size:10.0pt'>temp-trans</span></span></p>
\r
11007 <p class=IndentText>Temporary storage (associated with a <span class=Annot><span
\r
11008 style='font-size:10.0pt'>temp</span></span> formal parameter) is transferred to a non-temporary reference. The storage may be released or new aliases
\r
11013 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11016 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11017 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11018 <p class=TextFontCX align=center
\r
11019 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11020 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11027 <p class=TextFontCX><span class=Flag><span
\r
11028 style='font-size:10.0pt'>kept-trans</span></span></p>
\r
11030 <p class=IndentText>Kept storage (storage what was passed as <span class=Annot><span
\r
11031 style='font-size:10.0pt'>keep</span></span>) transferred to non-temporary
\r
11036 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11039 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11040 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11041 <p class=TextFontCX align=center
\r
11042 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11043 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11050 <p class=TextFontCX><span class=Flag><span
\r
11051 style='font-size:10.0pt'>keep-trans</span></span></p>
\r
11053 <p class=IndentText>Keep storage is transferred in a way that may add a new
\r
11054 alias to it, or release it.</p>
\r
11058 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11061 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11062 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11063 <p class=TextFontCX align=center
\r
11064 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11065 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11072 <p class=TextFontCX><span class=Flag><span
\r
11073 style='font-size:10.0pt'>refcount-trans</span></span></p>
\r
11075 <p class=IndentText>Reference counted storage is transferred in an inconsistent
\r
11076 way.<span style='font-size:10.5pt'> </span></p>
\r
11080 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11083 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11084 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11085 <p class=TextFontCX align=center
\r
11086 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11087 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11094 <p class=TextFontCX><span class=Flag><span
\r
11095 style='font-size:10.0pt'>newref-trans</span></span></p>
\r
11097 <p class=IndentText>A new reference transferred to a reference counted
\r
11098 reference (reference count is not set correctly).</p>
\r
11102 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11105 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11106 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11107 <p class=TextFontCX align=center
\r
11108 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11109 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11116 <p class=TextFontCX><span class=Flag><span
\r
11117 style='font-size:10.0pt'>immediate-trans</span></span></p>
\r
11119 <p class=IndentText>An immediate address (result of <span class=CodeText><span
\r
11120 style='font-size:10.0pt'>&</span></span>) is transferred inconsistently.</p>
\r
11124 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11127 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11128 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11129 <p class=TextFontCX align=center
\r
11130 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11131 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11138 <p class=TextFontCX><span class=Flag><span
\r
11139 style='font-size:10.0pt'>static-trans</span></span></p>
\r
11141 <p class=IndentText>Static storage is transferred in an inconsistent way.</p>
\r
11145 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11148 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11149 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11150 <p class=TextFontCX align=center
\r
11151 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11152 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11159 <p class=TextFontCX><span class=Flag><span
\r
11160 style='font-size:10.0pt'>expose-trans</span></span></p>
\r
11162 <p class=IndentText>Inconsistent exposure transfer. Exposed storage is
\r
11163 transferred to a non-<span class=Annot><span style='font-size:10.0pt'>exposed</span></span>,
\r
11164 non-<span class=Annot><span style='font-size:10.0pt'>observer</span></span>
\r
11165 reference.<span style='font-size:10.5pt'> </span></p>
\r
11169 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11172 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11173 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11174 <p class=TextFontCX align=center
\r
11175 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11176 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11183 <p class=TextFontCX><span class=Flag><span
\r
11184 style='font-size:10.0pt'>observer-trans</span></span></p>
\r
11186 <p class=IndentText>Inconsistent <span class=Annot><span style='font-size:10.0pt'>observer</span></span>
\r
11187 transfer. Observer storage is transferred to a non-observer reference.</p>
\r
11191 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11194 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11195 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11196 <p class=TextFontCX align=center
\r
11197 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11198 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11205 <p class=TextFontCX><span class=Flag><span
\r
11206 style='font-size:10.0pt'>unqualified-trans</span></span></p>
\r
11208 <p class=IndentText>Unqualified storage is transferred in an inconsistent way.</p>
\r
11210 <p class=Heading11>Initializers</p>
\r
11214 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11217 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11218 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11219 <p class=TextFontCX align=center
\r
11220 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11221 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11228 <p class=TextFontCX><span
\r
11229 class=Flag><span style='font-size:10.0pt'>only-unq-global-trans</span></span></p>
\r
11231 <p class=IndentText>Only storage transferred to an unqualified global or static
\r
11232 reference. This may lead to a memory leak, since the new reference is not
\r
11233 necessarily released.</p>
\r
11237 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11240 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11241 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11242 <p class=TextFontCX align=center
\r
11243 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11244 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11251 <p class=TextFontCX><span class=Flag><span
\r
11252 style='font-size:10.0pt'>static-init-trans</span></span></p>
\r
11254 <p class=IndentText>Static storage is used as an initial value in an
\r
11255 inconsistent way.</p>
\r
11259 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11262 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11263 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11264 <p class=TextFontCX align=center
\r
11265 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11266 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11273 <p class=TextFontCX><span class=Flag><span
\r
11274 style='font-size:10.0pt'>unqualified-init-trans</span></span></p>
\r
11276 <p class=IndentText>Unqualified storage is used as an initial value in an
\r
11277 inconsistent way.</p>
\r
11279 <p class=Heading11>Derived Storage</p>
\r
11283 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11286 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11287 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11288 <p class=TextFontCX align=center
\r
11289 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11290 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11297 <p class=TextFontCX><span class=Flag><span
\r
11298 style='font-size:10.0pt'>comp-mem-pass</span></span></p>
\r
11300 <p class=IndentText>Storage derivable from a parameter does not match the alias
\r
11301 kind expected for the formal parameter.</p>
\r
11303 <p class=Heading11>Stack References</p>
\r
11307 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11310 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11311 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11312 <p class=TextFontCX align=center
\r
11313 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11314 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
11321 <p class=TextFontCX><span class=Flag><span
\r
11322 style='font-size:10.0pt'>stack-ref</span></span></p>
\r
11324 <p class=IndentText>A stack reference is pointed to by an external reference
\r
11325 when the function returns. Since the call frame will be destroyed when the
\r
11326 function returns the return value will point to dead storage. (Section 5.2.6)</p>
\r
11328 <p class=Heading10>Implicit Memory Annotations <span class=HeadingNote><span
\r
11329 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
11330 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
11331 normal'>5.3</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
11332 font-weight:normal;font-style:normal'>)</span></span></p>
\r
11336 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11339 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11340 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11341 <p class=TextFontCX align=center
\r
11342 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
11343 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
11350 <p class=TextFontCX><span
\r
11351 class=Flag><span style='font-size:10.0pt'>glob-imp-only</span></span></p>
\r
11353 <p class=IndentText>Assume unannotated global storage is only.</p>
\r
11357 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11360 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11361 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11362 <p class=TextFontCX align=center
\r
11363 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
11364 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
11371 <p class=TextFontCX><span class=Flag><span
\r
11372 style='font-size:10.0pt'>param-imp-temp</span></span></p>
\r
11374 <p class=IndentText>Assume unannotated parameter is <span class=Annot><span
\r
11375 style='font-size:10.0pt'>temp</span></span>.</p>
\r
11379 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11382 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11383 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11384 <p class=TextFontCX align=center
\r
11385 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
11386 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
11393 <p class=TextFontCX><span class=Flag><span
\r
11394 style='font-size:10.0pt'>ret-imp-only</span></span></p>
\r
11396 <p class=IndentText>Assume unannotated returned storage is <span class=Annot><span
\r
11397 style='font-size:10.0pt'>only</span></span>.</p>
\r
11401 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11404 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11405 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11406 <p class=TextFontCX align=center
\r
11407 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
11408 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
11415 <p class=TextFontCX><span class=Flag><span
\r
11416 style='font-size:10.0pt'>struct-imp-only</span></span></p>
\r
11418 <p class=IndentText>Assume unannotated structure or union field is <span
\r
11419 class=Annot><span style='font-size:10.0pt'>only</span></span>.</p>
\r
11423 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11426 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11427 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11428 <p class=TextFontCX align=center
\r
11429 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
11436 <p class=TextFontCX><span class=Flag><span
\r
11437 style='font-size:10.0pt'>code-imp-only</span></span></p>
\r
11439 <p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>glob-imp-only</span></span>,
\r
11440 <span class=Flag><span style='font-size:10.0pt'>ret-imp-only</span></span> and <span
\r
11441 class=Flag><span style='font-size:10.0pt'>struct-imp-only</span></span>.</p>
\r
11445 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11448 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11449 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11450 <p class=TextFontCX align=center
\r
11451 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11452 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11459 <p class=TextFontCX><span class=Flag><span
\r
11460 style='font-size:10.0pt'>mem-imp</span></span></p>
\r
11462 <p class=IndentText>Report memory errors for unqualified storage.</p>
\r
11466 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11469 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11470 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11471 <p class=TextFontCX align=center
\r
11472 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11473 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
11480 <p class=TextFontCX><span class=Flag><span
\r
11481 style='font-size:10.0pt'>pass-unknown</span></span></p>
\r
11483 <p class=IndentText>Passing a value as an unannotated parameter clears its
\r
11484 annotation. This will prevent many spurious errors from being report for
\r
11485 unannotated programs, but eliminates the possibility of detecting many errors.</p>
\r
11487 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
11488 name="_Toc534975054">Sharing</a> <span
\r
11489 class=TextFontCXChar><span style='font-size:11.0pt;
\r
11490 font-weight:normal'>(Section 6)</span></span></p>
\r
11492 <p class=Heading10>Aliasing <span
\r
11493 class=TextFontCXChar><span style='font-size:11.0pt;
\r
11494 font-weight:normal'>(Section </span></span><span
\r
11495 class=TextFontCXChar><span style='font-size:11.0pt;
\r
11496 font-weight:normal'>6.1</span></span><span
\r
11497 class=TextFontCXChar><span style='font-size:11.0pt;
\r
11498 font-weight:normal'>) </span></span></p>
\r
11502 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11505 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11506 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11507 <p class=TextFontCX align=center
\r
11508 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11509 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11516 <p class=TextFontCX><span
\r
11517 class=Flag><span style='font-size:10.0pt'>alias-unique</span></span></p>
\r
11519 <p class=IndentText>An actual parameter that is passed as a <span class=Annot><span
\r
11520 style='font-size:10.0pt'>unique</span></span> formal parameter is aliased by
\r
11521 another parameter or global variable.</p>
\r
11525 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11528 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11529 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11530 <p class=TextFontCX align=center
\r
11531 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11532 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11539 <p class=TextFontCX><span class=Flag><span
\r
11540 style='font-size:10.0pt'>may-alias-unique</span></span></p>
\r
11542 <p class=IndentText>An actual parameter that is passed as a <span class=Annot><span
\r
11543 style='font-size:10.0pt'>unique</span></span> formal parameter may be aliased
\r
11544 by another parameter or global variable.</p>
\r
11548 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11551 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11552 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11553 <p class=TextFontCX align=center
\r
11554 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11555 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11562 <p class=TextFontCX><span class=Flag><span
\r
11563 style='font-size:10.0pt'>must-not-alias</span></span></p>
\r
11565 <p class=IndentText>An alias has been added to a <span class=Annot><span
\r
11566 style='font-size:10.0pt'>temp</span></span>-qualifier parameter or global that is visible externally when the function returns. </p>
\r
11570 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11573 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11574 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11575 <p class=TextFontCX align=center
\r
11576 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11577 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11584 <p class=TextFontCX><span class=Flag><span
\r
11585 style='font-size:10.0pt'>ret-alias</span></span></p>
\r
11587 <p class=IndentText>A function returns an alias to parameter or global.</p>
\r
11589 <p class=Heading10>Exposure <span class=HeadingNote><span style='font-size:
\r
11590 10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
11591 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
11592 normal'>6.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
11593 font-weight:normal;font-style:normal'>)</span></span><span class=Flag><span
\r
11594 style='font-size:10.5pt;font-family:"Times New Roman";font-weight:normal'> </span></span></p>
\r
11598 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11601 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11602 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11603 <p class=TextFontCX align=center
\r
11604 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
11611 <p class=TextFontCX><span
\r
11612 class=Flag><span style='font-size:10.0pt'>rep-expose</span></span></p>
\r
11614 <p class=IndentText>The internal representation of an abstract type is visible
\r
11615 to the caller. This means clients may have access to a pointer into the
\r
11616 abstract representation. (Sets <span class=Flag><span style='font-size:10.0pt'>assign-expose</span></span>, <span
\r
11617 class=Flag><span style='font-size:10.0pt'>ret-expose</span></span>, and <span
\r
11618 class=Flag><span style='font-size:10.0pt'>cast-expose</span></span>.)</p>
\r
11622 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11625 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11626 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11627 <p class=TextFontCX align=center
\r
11628 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11629 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11636 <p class=TextFontCX><span class=Flag><span
\r
11637 style='font-size:10.0pt'>assign-expose</span></span></p>
\r
11639 <p class=IndentText>Abstract representation is exposed by an assignment or
\r
11640 passed parameter.</p>
\r
11644 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11647 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11648 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11649 <p class=TextFontCX align=center
\r
11650 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11651 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11658 <p class=TextFontCX><span class=Flag><span
\r
11659 style='font-size:10.0pt'>cast-expose</span></span></p>
\r
11661 <p class=IndentText>Abstract representation is exposed through a cast.</p>
\r
11665 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11668 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11669 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11670 <p class=TextFontCX align=center
\r
11671 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11672 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11679 <p class=TextFontCX><span class=Flag><span
\r
11680 style='font-size:10.0pt'>ret-expose</span></span></p>
\r
11682 <p class=IndentText>Abstract representation is exposed by a return value.</p>
\r
11684 <p class=Heading11>Observer Modifications</p>
\r
11688 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11691 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11692 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11693 <p class=TextFontCX align=center
\r
11694 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
11695 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
11702 <p class=TextFontCX><span
\r
11703 class=Flag><span style='font-size:10.0pt'>mod-observer</span></span></p>
\r
11705 <p class=IndentText>Possible modification of observer storage.</p>
\r
11709 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11712 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11713 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11714 <p class=TextFontCX align=center
\r
11715 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11716 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
11723 <p class=TextFontCX><span class=Flag><span
\r
11724 style='font-size:10.0pt'>mod-observer-uncon</span></span></p>
\r
11726 <p class=IndentText>Storage declared with observer may be modified through a
\r
11727 call to an unconstrained function.</p>
\r
11729 <p class=Heading11>String Literals <span
\r
11730 class=TextFontCXChar><span style='font-weight:
\r
11731 normal;font-style:normal'>(Section 6.2.1) </span></span></p>
\r
11735 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11738 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11739 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11740 <p class=TextFontCX align=center
\r
11741 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11742 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11749 <p class=TextFontCX><span
\r
11750 class=Flag><span style='font-size:10.0pt'>read-only-trans</span></span></p>
\r
11752 <p class=IndentText>Report memory transfer errors for initializations to
\r
11753 read-only string literals </p>
\r
11757 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11760 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11761 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11762 <p class=TextFontCX align=center
\r
11763 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11764 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
11771 <p class=TextFontCX><span class=Flag><span
\r
11772 style='font-size:10.0pt'>read-only-strings</span></span></p>
\r
11774 <p class=IndentText>String literals are read-only (ISO semantics). An error is
\r
11775 reported if a string literal may be modified or released.</p>
\r
11777 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'>Function
\r
11778 Interfaces <span class=TextFontCXChar><span
\r
11779 style='font-size:11.0pt;font-weight:normal'>(Section </span></span><span
\r
11780 class=TextFontCXChar><span style='font-size:11.0pt;
\r
11781 font-weight:normal'>7</span></span><span
\r
11782 class=TextFontCXChar><span style='font-size:11.0pt;
\r
11783 font-weight:normal'>)</span></span></p>
\r
11785 <p class=Heading10>Modification <span
\r
11786 class=TextFontCXChar><span style='font-size:11.0pt;
\r
11787 font-weight:normal'>(Section 7.1)</span></span><span class=Flag><span
\r
11788 style='font-size:10.0pt'> </span></span></p>
\r
11792 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11795 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11796 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11797 <p class=TextFontCX align=center
\r
11798 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
11799 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
11806 <p class=TextFontCX><span
\r
11807 class=Flag><span style='font-size:10.0pt'>modifies</span></span></p>
\r
11809 <p class=IndentText>Undocumented modification of caller-visible state. Without
\r
11810 <span class=Flag><span style='font-size:10.0pt'>+moduncon</span></span>, modification errors are only reported in the definitions of functions declared with a modifies clause (or specified).</p>
\r
11814 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11817 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11818 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11819 <p class=TextFontCX align=center
\r
11820 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11821 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
11828 <p class=TextFontCX><span class=Flag><span
\r
11829 style='font-size:10.0pt'>must-mod</span></span></p>
\r
11831 <p class=IndentText>Documented modification is not detected. An object listed
\r
11832 in the modifies clause for a function, is not modified by the implementation.</p>
\r
11836 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11839 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11840 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11841 <p class=TextFontCX align=center
\r
11842 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
11849 <p class=TextFontCX><span class=Flag><span
\r
11850 style='font-size:10.0pt'>mod-uncon</span></span></p>
\r
11852 <p class=IndentText>Report modification errors in functions declared without a
\r
11853 modifies clause.(Sets <span class=Flag><span style='font-size:10.0pt'>mod-nomods</span></span>, <span
\r
11854 class=Flag><span style='font-size:10.0pt'>mod-globs-nomods</span></span> and <span class=Flag><span style='font-size:10.0pt'>mod-strict-globs-nomods</span></span>.)</p>
\r
11858 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11861 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11862 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11863 <p class=TextFontCX align=center
\r
11864 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11865 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
11872 <p class=TextFontCX><span class=Flag><span
\r
11873 style='font-size:10.0pt'>mod-nomods</span></span></p>
\r
11875 <p class=IndentText>Report modification errors (not involving global variables)
\r
11876 in functions declared without a modifies clause.</p>
\r
11880 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11883 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11884 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11885 <p class=TextFontCX align=center
\r
11886 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11887 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
11894 <p class=TextFontCX><span class=Flag><span
\r
11895 style='font-size:10.0pt'>mod-uncon-nomods</span></span></p>
\r
11897 <p class=IndentText>An unconstrained function is called in a function body
\r
11898 where modifications are checked. Since the unconstrained function may modify
\r
11899 anything, there may be undetected modifications in the checked function.</p>
\r
11903 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11906 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11907 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11908 <p class=TextFontCX align=center
\r
11909 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11910 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
11917 <p class=TextFontCX><span class=Flag><span
\r
11918 style='font-size:10.0pt'>mod-internal-strict</span></span></p>
\r
11920 <p class=IndentText>A function that modifies <span class=Annot><span
\r
11921 style='font-size:10.0pt'>internalState</span></span> is called from a function that does not list <span
\r
11922 class=Annot><span style='font-size:10.0pt'>internalState</span></span> in its
\r
11923 modifies clause.</p>
\r
11927 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11930 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11931 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11932 <p class=TextFontCX align=center
\r
11933 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11934 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
11941 <p class=TextFontCX><span class=Flag><span
\r
11942 style='font-size:10.0pt'>mod-file-sys</span></span></p>
\r
11944 <p class=IndentText>A function modifies the file system but does not list <span
\r
11945 class=Annot><span style='font-size:10.0pt'>fileSystem</span></span> in its modifies clause.</p>
\r
11947 <p class=Heading10>Global Variables<i> </i><span class=HeadingNote><span
\r
11948 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
11949 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
11950 normal'>7.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
11951 font-weight:normal;font-style:normal'>)</span></span><span class=Flag><span
\r
11952 style='font-size:10.0pt'> </span></span></p>
\r
11954 <p class=beforelist><a name=globflags></a>Errors involving the use and modification of global and file static variables are reported depending on flag settings, annotations where the global variable is declared, and whether or not the function where the global is used was declared with a globals
\r
11959 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11962 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11963 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11964 <p class=TextFontCX align=center
\r
11965 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
11966 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
11973 <p class=TextFontCX><span class=Flag><span
\r
11974 style='font-size:10.0pt'>globs</span></span></p>
\r
11976 <p class=IndentText>Undocumented use of a checked global variable in a function
\r
11977 with a globals list.</p>
\r
11981 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
11984 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
11985 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
11986 <p class=TextFontCX align=center
\r
11987 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
11988 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
11995 <p class=TextFontCX><span class=Flag><span
\r
11996 style='font-size:10.0pt'>glob-use</span></span></p>
\r
11998 <p class=IndentText>A global listed in the globals list is not used in the
\r
11999 implementation.</p>
\r
12003 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12006 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12007 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12008 <p class=TextFontCX align=center
\r
12009 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12010 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12017 <p class=TextFontCX><span class=Flag><span
\r
12018 style='font-size:10.0pt'>glob-noglobs</span></span></p>
\r
12020 <p class=IndentText>Use of a checked global in a function with no globals list.</p>
\r
12024 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12027 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12028 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12029 <p class=TextFontCX align=center
\r
12030 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12031 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12038 <p class=TextFontCX><span class=Flag><span
\r
12039 style='font-size:10.0pt'>internal-globs</span></span></p>
\r
12041 <p class=IndentText>Undocumented use of internal state (should have <span
\r
12042 class=Annot><span style='font-size:10.0pt'>globals internalState</span></span>).</p>
\r
12046 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12049 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12050 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12051 <p class=TextFontCX align=center
\r
12052 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12053 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12060 <p class=TextFontCX><span class=Flag><span
\r
12061 style='font-size:10.0pt'>internal-globs-noglobs</span></span></p>
\r
12063 <p class=TextFontCX> Use of internal state
\r
12064 in function with no globals list.</p>
\r
12068 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12071 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12072 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12073 <p class=TextFontCX align=center
\r
12074 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12075 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12082 <p class=TextFontCX><span class=Flag><span
\r
12083 style='font-size:10.0pt'>glob-state</span></span></p>
\r
12085 <p class=IndentText>A function returns with global in inconsistent state (null or undefined)</p>
\r
12089 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12092 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12093 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12094 <p class=TextFontCX align=center
\r
12095 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12096 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
12103 <p class=TextFontCX><span class=Flag><span
\r
12104 style='font-size:10.0pt'>all-globs</span></span></p>
\r
12106 <p class=IndentText>Report use and modification errors for globals not
\r
12107 annotated with <span class=Annot><span style='font-size:10.0pt'>unchecked</span></span>.</p>
\r
12111 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12114 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12115 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12116 <p class=TextFontCX align=center
\r
12117 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12118 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
12125 <p class=TextFontCX><span class=Flag><span
\r
12126 style='font-size:10.0pt'>check-strict-globs</span></span></p>
\r
12128 <p class=IndentText>Report use and modification errors for <span class=Annot><span
\r
12129 style='font-size:10.0pt'>checkedstrict</span></span> globals.</p>
\r
12131 <p class=Heading11>Modification of Global Variables</p>
\r
12135 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12138 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12139 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12140 <p class=TextFontCX align=center
\r
12141 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12142 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12149 <p class=TextFontCX><span
\r
12150 class=Flag><span style='font-size:10.0pt'>mod-globs</span></span></p>
\r
12152 <p class=IndentText>Undocumented modification of a checked global variable. </p>
\r
12156 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12159 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12160 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12161 <p class=TextFontCX align=center
\r
12162 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12163 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12170 <p class=TextFontCX><span class=Flag><span
\r
12171 style='font-size:10.0pt'>mod-globs-unchecked</span></span></p>
\r
12173 <p class=IndentText>Undocumented modification of an <span class=Annot><span
\r
12174 style='font-size:10.0pt'>unchecked</span></span> global variable.</p>
\r
12178 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12181 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12182 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12183 <p class=TextFontCX align=center
\r
12184 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12185 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12192 <p class=TextFontCX><span class=Flag><span
\r
12193 style='font-size:10.0pt'>mod-globs-nomods</span></span></p>
\r
12195 <p class=IndentText>Undocumented modification of a checked global variable in a
\r
12196 function with no modifies clause. </p>
\r
12200 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12203 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12204 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12205 <p class=TextFontCX align=center
\r
12206 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12207 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12214 <p class=TextFontCX><span class=Flag><span
\r
12215 style='font-size:10.0pt'>mod-strict-globs-nomods</span></span></p>
\r
12217 <p class=IndentText>Undocumented modification of a <span class=Annot><span
\r
12218 style='font-size:10.0pt'>checkedstrict</span></span> global variable in a function declared with no modifies clause.</p>
\r
12220 <p class=Heading11>Globals Lists and Modifies Clauses</p>
\r
12224 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12227 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12228 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12229 <p class=TextFontCX align=center
\r
12230 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12231 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12238 <p class=TextFontCX><span class=Flag><span
\r
12239 style='font-size:10.0pt'>warn-missing-globs</span></span></p>
\r
12241 <p class=IndentText>Global variable used in modifies clause is not listed in
\r
12242 globals list. (The global is added to the globals list.)</p>
\r
12246 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12249 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12250 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12251 <p class=TextFontCX align=center
\r
12252 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12253 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12260 <p class=TextFontCX><span class=Flag><span
\r
12261 style='font-size:10.0pt'>warn-missing-globs-noglobs</span></span></p>
\r
12263 <p class=IndentText>Global variable used in modifies clause of a function with
\r
12264 no globals list.</p>
\r
12268 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12271 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12272 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12273 <p class=TextFontCX align=center
\r
12274 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12275 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
12282 <p class=TextFontCX><span class=Flag><span
\r
12283 style='font-size:10.0pt'>globs-imp-mods-nothing</span></span></p>
\r
12285 <p class=IndentText>A function declared with a globals list but no modifies
\r
12286 clause is assumed to modify nothing.</p>
\r
12290 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12293 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12294 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12295 <p class=TextFontCX align=center
\r
12296 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12297 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
12304 <p class=TextFontCX><span class=Flag><span
\r
12305 style='font-size:10.0pt'>mods-imp-noglobs</span></span></p>
\r
12307 <p class=IndentText>A function declared with a modifies clause but no globals
\r
12308 list is assumed to use no globals.</p>
\r
12310 <p class=Heading11>Implicit Checking Annotations</p>
\r
12314 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12317 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12318 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12319 <p class=TextFontCX align=center
\r
12320 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12321 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
12328 <p class=TextFontCX><span
\r
12329 class=Flag><span style='font-size:10.0pt'>imp-checked-globs</span></span></p>
\r
12331 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span> annotation on global variables with no checking annotation.</p>
\r
12335 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12338 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12339 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12340 <p class=TextFontCX align=center
\r
12341 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12342 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
12349 <p class=TextFontCX><span class=Flag><span
\r
12350 style='font-size:10.0pt'>imp-checked-statics</span></span></p>
\r
12352 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span> qualifier file static scope variables with no checking annotation. </p>
\r
12356 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12359 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12360 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12361 <p class=TextFontCX align=center
\r
12362 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12363 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
12370 <p class=TextFontCX><span class=Flag><span
\r
12371 style='font-size:10.0pt'>imp-checkmod-globs</span></span></p>
\r
12373 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checkmod</span></span>
\r
12374 qualifier on global variables with no checking annotation.</p>
\r
12376 <p class=IndentText><span class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
12380 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12383 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12384 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12385 <p class=TextFontCX align=center
\r
12386 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12387 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
12394 <p class=TextFontCX><span class=Flag><span
\r
12395 style='font-size:10.0pt'>imp-checkmod-statics</span></span></p>
\r
12397 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checkmod</span></span>
\r
12398 qualifier file static scope variables with no checking annotation.</p>
\r
12402 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12405 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12406 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12407 <p class=TextFontCX align=center
\r
12408 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12409 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12416 <p class=TextFontCX><span class=Flag><span
\r
12417 style='font-size:10.0pt'>imp-checkedstrict-globs</span></span></p>
\r
12419 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span>
\r
12420 qualifier on global variables with no checking annotation.</p>
\r
12424 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12427 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12428 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12429 <p class=TextFontCX align=center
\r
12430 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12431 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12438 <p class=TextFontCX><span class=Flag><span
\r
12439 style='font-size:10.0pt'>imp-checkedstrict-statics</span></span></p>
\r
12441 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span>
\r
12442 qualifier file static scope variables with no checking annotation.</p>
\r
12446 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12449 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12450 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12451 <p class=TextFontCX align=center
\r
12452 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12453 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
12460 <p class=TextFontCX><span class=Flag><span
\r
12461 style='font-size:10.0pt'>imp-checkmod-internals</span></span></p>
\r
12463 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checkmod</span></span>
\r
12464 qualifier on function scope static variables with no checking annotation.</p>
\r
12468 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12471 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12472 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12473 <p class=TextFontCX align=center
\r
12474 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12475 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12482 <p class=IndentText style='margin-left:0in'><span class=Keyword><span
\r
12483 style='font-size:10.0pt'> </span></span></p>
\r
12485 <p class=Heading11>Global Aliasing</p>
\r
12489 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12492 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12493 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12494 <p class=TextFontCX align=center
\r
12495 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
12502 <p class=TextFontCX><span
\r
12503 class=Flag><span style='font-size:10.0pt'>glob-alias</span></span></p>
\r
12505 <p class=IndentText>Function returns with global aliasing external state (sets <span
\r
12506 class=Flag><span style='font-size:10.0pt'>checkstrict-glob-alias</span></span>, <span
\r
12507 class=Flag><span style='font-size:10.0pt'>checked-glob-alias</span></span>, c<span
\r
12508 class=Flag><span style='font-size:10.0pt'>heckmod-glob-alias</span></span> and <span
\r
12509 class=Flag><span style='font-size:10.0pt'>unchecked-glob-alias</span></span>).</p>
\r
12513 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12516 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12517 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12518 <p class=TextFontCX align=center
\r
12519 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12520 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12527 <p class=TextFontCX><span class=Flag><span
\r
12528 style='font-size:10.0pt'>checkstrict-glob-alias</span></span></p>
\r
12530 <p class=IndentText>Function returns with a <span class=Annot><span
\r
12531 style='font-size:10.0pt'>checkedstrict</span></span> global aliasing external state.</p>
\r
12535 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12538 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12539 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12540 <p class=TextFontCX align=center
\r
12541 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12542 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12549 <p class=TextFontCX><span class=Flag><span
\r
12550 style='font-size:10.0pt'>checked-glob-alias</span></span></p>
\r
12552 <p class=IndentText>Function returns with a <span class=Annot><span
\r
12553 style='font-size:10.0pt'>checked</span></span> global aliasing external state.</p>
\r
12557 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12560 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12561 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12562 <p class=TextFontCX align=center
\r
12563 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12564 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12571 <p class=TextFontCX><span class=Flag><span
\r
12572 style='font-size:10.0pt'>checkmod-glob-alias</span></span></p>
\r
12574 <p class=IndentText>Function returns with a <span class=Annot><span
\r
12575 style='font-size:10.0pt'>checkmod</span></span> global aliasing external state.</p>
\r
12579 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12582 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12583 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12584 <p class=TextFontCX align=center
\r
12585 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12586 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
12593 <p class=TextFontCX><span class=Flag><span
\r
12594 style='font-size:10.0pt'>unchecked-glob-alias</span></span></p>
\r
12596 <p class=IndentText>Function returns with an <span class=Annot><span
\r
12597 style='font-size:10.0pt'>unchecked</span></span> global aliasing external state.</p>
\r
12599 <p class=Heading10>Declaration Consistency <span style='font-weight:normal'>(Section
\r
12600 7.3)</span><span class=Flag><i><span style='font-size:10.5pt;font-family:"Times New Roman";
\r
12601 letter-spacing:0pt;font-weight:normal'> </span></i></span></p>
\r
12605 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12608 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12609 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12610 <p class=TextFontCX align=center
\r
12611 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12612 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12619 <p class=TextFontCX><span
\r
12620 class=Flag><span style='font-size:10.0pt'>incon-defs</span></span></p>
\r
12622 <p class=IndentText>Identifier redeclared or redefined with inconsistent type.</p>
\r
12626 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12629 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12630 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12631 <p class=TextFontCX align=center
\r
12632 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12633 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12640 <p class=TextFontCX><span class=Flag><span
\r
12641 style='font-size:10.0pt'>incon-defs-lib</span></span></p>
\r
12643 <p class=IndentText>Identifier defined in a library is redefined with
\r
12644 inconsistent type.</p>
\r
12648 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12651 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12652 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12653 <p class=TextFontCX align=center
\r
12654 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12655 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
12662 <p class=TextFontCX><span class=Flag><span
\r
12663 style='font-size:10.0pt'>overload</span></span></p>
\r
12665 <p class=IndentText>Standard library function overloaded.</p>
\r
12669 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12672 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12673 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12674 <p class=TextFontCX align=center
\r
12675 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12676 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12683 <p class=TextFontCX><span class=Flag><span
\r
12684 style='font-size:10.0pt'>match-fields</span></span></p>
\r
12686 <p class=IndentText>A <span class=CodeText><span style='font-size:10.0pt'>struct</span></span>
\r
12687 or <span class=CodeText><span style='font-size:10.0pt'>enum</span></span> type
\r
12688 is redefined with inconsistent fields or members.</p>
\r
12690 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
12691 name="_Toc534975057">Macros </a><span
\r
12692 class=TextFontCXChar><span style='font-size:11.0pt;
\r
12693 font-weight:normal'>(Section </span></span><span
\r
12694 class=TextFontCXChar><span style='font-size:11.0pt;
\r
12695 font-weight:normal'>11</span></span><span
\r
12696 class=TextFontCXChar><span style='font-size:11.0pt;
\r
12697 font-weight:normal'>)</span></span> </p>
\r
12699 <p class=TextFontCX>These flags control expansion and checking of macro definitions and invocations.</p>
\r
12701 <p class=Heading10>Macro Expansion</p>
\r
12703 <p class=beforelist>These flags control which macros are checked as functions
\r
12704 or constants, and which are expanded in the pre-processing phase. Macros
\r
12705 preceded by <span class=Annot><span style='font-size:10.0pt'>/*@notfunction@*/</span></span> are never expanded regardless of these flag settings. These flags may be used in
\r
12706 source-file control comments.</p>
\r
12710 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12713 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12714 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12715 <p class=TextFontCX align=center
\r
12716 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
12717 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
12724 <p class=TextFontCX><span class=Flag><span
\r
12725 style='font-size:10.0pt'>fcn-macros</span></span></p>
\r
12727 <p class=IndentText>Macros defined with parameter lists are not expanded and
\r
12728 are checked as functions.</p>
\r
12732 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12735 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12736 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12737 <p class=TextFontCX align=center
\r
12738 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
12739 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
12746 <p class=TextFontCX><span class=Flag><span
\r
12747 style='font-size:10.0pt'>const-macros</span></span></p>
\r
12749 <p class=IndentText>Macros defined without parameter lists are not expanded and
\r
12750 are checked as constants.</p>
\r
12754 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12757 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12758 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12759 <p class=TextFontCX align=center
\r
12760 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
12767 <p class=TextFontCX><span class=Flag><span
\r
12768 style='font-size:10.0pt'>all-macros</span></span></p>
\r
12770 <p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>fcn-macros</span></span>
\r
12771 and <span class=Flag><span style='font-size:10.0pt'>const-macros</span></span>.</p>
\r
12775 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12778 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12779 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12780 <p class=TextFontCX align=center
\r
12781 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
12782 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
12789 <p class=TextFontCX><span class=Flag><span
\r
12790 style='font-size:10.0pt'>lib-macros</span></span></p>
\r
12792 <p class=IndentText>Macros defining identifiers declared in a loaded library
\r
12793 are not expanded and are checked according to the library information.<span
\r
12794 class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
12796 <p class=Heading10>Macro Definitions</p>
\r
12798 <p class=beforelist>These flags control what errors are reported in macro
\r
12803 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12806 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12807 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12808 <p class=TextFontCX align=center
\r
12809 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12810 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12817 <p class=TextFontCX><span class=Flag><span
\r
12818 style='font-size:10.0pt'>macro-stmt</span></span></p>
\r
12820 <p class=IndentText>Macro definition is not syntactically equivalent to
\r
12821 function. This means if the macro is used as a statement (e.g., <span
\r
12822 class=CodeText><span style='font-size:10.0pt'>if (test) macro();</span></span>)
\r
12823 unexpected behavior may result. One fix is to surround the macro body with <span
\r
12824 class=CodeText><span style='font-size:10.0pt'>do {
\85 } while (FALSE)</span></span>.<span
\r
12825 class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
12829 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12832 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12833 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12834 <p class=TextFontCX align=center
\r
12835 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12836 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12843 <p class=TextFontCX><span class=Flag><span
\r
12844 style='font-size:10.0pt'>macro-params</span></span></p>
\r
12846 <p class=IndentText>A macro parameter is not used exactly once in all possible
\r
12847 invocations of the macro.</p>
\r
12851 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12854 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12855 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12856 <p class=TextFontCX align=center
\r
12857 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12858 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12865 <p class=TextFontCX><span class=Flag><span
\r
12866 style='font-size:10.0pt'>macro-assign</span></span></p>
\r
12868 <p class=IndentText>A macro parameter is used as the left side of an assignment
\r
12873 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12876 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12877 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12878 <p class=TextFontCX align=center
\r
12879 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12880 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12887 <p class=TextFontCX><span class=Flag><span
\r
12888 style='font-size:10.0pt'>macro-parens</span></span></p>
\r
12890 <p class=IndentText>A macro parameter is used without parentheses (in
\r
12891 potentially dangerous context).</p>
\r
12895 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12898 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12899 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12900 <p class=TextFontCX align=center
\r
12901 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12902 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
12909 <p class=TextFontCX><span class=Flag><span
\r
12910 style='font-size:10.0pt'>macro-empty</span></span></p>
\r
12912 <p class=IndentText>Macro definition of a function is empty. </p>
\r
12916 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12919 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12920 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12921 <p class=TextFontCX align=center
\r
12922 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12923 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12930 <p class=TextFontCX><span class=Flag><span
\r
12931 style='font-size:10.0pt'>macro-redef</span></span></p>
\r
12933 <p class=IndentText>Macro is redefined. There is another macro defined with
\r
12934 the same name.</p>
\r
12938 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12941 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12942 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12943 <p class=TextFontCX align=center
\r
12944 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12945 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
12952 <p class=TextFontCX><span class=Flag><span
\r
12953 style='font-size:10.0pt'>macro-unrecog</span></span> </p>
\r
12955 <p class=IndentText>An unrecognized identifier appears in a macro definition.
\r
12956 Since the identifier may be defined where the macro is used, this could be
\r
12957 okay, but Splint will not be able to check the unrecognized identifier
\r
12958 appropriately.</p>
\r
12960 <p class=Heading11>Corresponding Declarations</p>
\r
12964 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12967 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12968 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12969 <p class=TextFontCX align=center
\r
12970 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
12971 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
12978 <p class=TextFontCX><span class=Flag><span
\r
12979 style='font-size:10.0pt'>macro-match-name</span></span></p>
\r
12981 <p class=IndentText>An <span class=Annot><span style='font-size:10.0pt'>iter</span></span> or <span
\r
12982 class=Annot><span style='font-size:10.0pt'>constant</span></span> macro is defined using a different name from the one used in the previous syntactic comment</p>
\r
12986 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
12989 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
12990 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
12991 <p class=TextFontCX align=center
\r
12992 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
12999 <p class=TextFontCX><span class=Flag><span
\r
13000 style='font-size:10.0pt'>macro-decl</span></span></p>
\r
13002 <p class=IndentText>A macro definition has no corresponding declaration. (Sets
\r
13003 <span class=Flag><span style='font-size:10.0pt'>macrofcndecl</span></span> and <span
\r
13004 class=Flag><span style='font-size:10.0pt'>macroconstdecl</span></span>.)</p>
\r
13008 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13011 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13012 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13013 <p class=TextFontCX align=center
\r
13014 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
13015 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
13022 <p class=TextFontCX><span class=Flag><span
\r
13023 style='font-size:10.0pt'>macro-fcn-decl</span></span></p>
\r
13025 <p class=IndentText>Macro definition with parameter list has no corresponding
\r
13026 function prototype. Without a prototype, the types of the macro result and
\r
13027 parameters are unknown.</p>
\r
13031 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13034 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13035 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13036 <p class=TextFontCX align=center
\r
13037 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
13038 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
13045 <p class=TextFontCX><span class=Flag><span
\r
13046 style='font-size:10.0pt'>macro-const-decl</span></span></p>
\r
13048 <p class=IndentText>A macro definition without parameter list has no
\r
13049 corresponding constant declaration.<span class=Flag><span style='font-size:
\r
13050 10.0pt'> </span></span></p>
\r
13054 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13057 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13058 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13059 <p class=TextFontCX align=center
\r
13060 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13061 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
13068 <p class=TextFontCX><span class=Flag><span
\r
13069 style='font-size:10.0pt'>next-line-macros</span></span></p>
\r
13071 <p class=IndentText>A constant or iter declaration is not immediately followed
\r
13072 by a macro definition.</p>
\r
13074 <p class=Heading10>Side Effect Free Parameters <span class=HeadingNote><span
\r
13075 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
13076 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
13077 normal'>11.2.1</span></span><span class=HeadingNote><span style='font-size:
\r
13078 10.5pt;font-weight:normal;font-style:normal'>)</span></span><span class=Flag><span
\r
13079 style='font-size:10.0pt'> </span></span></p>
\r
13081 <p class=beforelist>These flags control error reporting for parameters with inconsistent side effects in invocations of checked function macros and function calls.</p>
\r
13085 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13088 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13089 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13090 <p class=TextFontCX align=center
\r
13091 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
13092 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
13099 <p class=TextFontCX><span class=Flag><span
\r
13100 style='font-size:10.0pt'>sef-params</span></span></p>
\r
13102 <p class=IndentText>An actual parameter with side effects is passed as a formal
\r
13103 parameter declared with <span class=Annot><span style='font-size:10.0pt'>sef</span></span>.</p>
\r
13107 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13110 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13111 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13112 <p class=TextFontCX align=center
\r
13113 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
13114 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
13121 <p class=TextFontCX><span class=Flag><span
\r
13122 style='font-size:10.0pt'>sef-uncon</span></span></p>
\r
13124 <p class=IndentText>An actual parameter involving a call to an unconstrained
\r
13125 function (declared without modifies clause) that may modify anything is passed
\r
13126 as a <span class=Annot><span style='font-size:10.0pt'>sef</span></span>
\r
13129 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
13130 name="_Toc534975058">Iterators</a></p>
\r
13134 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13137 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13138 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13139 <p class=TextFontCX align=center
\r
13140 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13141 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13148 <p class=TextFontCX><span class=Flag><span
\r
13149 style='font-size:10.0pt'>has-yield</span></span></p>
\r
13151 <p class=IndentText>An iterator has been declared with no parameters annotated with <span
\r
13152 class=Annot><span style='font-size:10.0pt'>yield</span></span>.</p>
\r
13154 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
13155 name="_Toc534975059">Naming Conventions</a> <span
\r
13156 class=TextFontCXChar><span style='font-size:11.0pt;
\r
13157 font-weight:normal'>(Section 12)</span></span></p>
\r
13161 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13164 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13165 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13166 <p class=TextFontCX align=center
\r
13167 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13168 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
13175 <p class=TextFontCX><span class=Flag><span
\r
13176 style='font-size:10.0pt'>name-checks</span></span></p>
\r
13178 <p class=IndentText>Turns all name checking on or off without changing other settings.</p>
\r
13180 <p class=Heading10>Type-Based Naming Conventions <span style='font-size:10.5pt;
\r
13181 font-weight:normal'>(Section 12.1)</span></p>
\r
13183 <p class=Heading11>Czech Naming Convention</p>
\r
13187 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13190 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13191 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13192 <p class=TextFontCX align=center
\r
13193 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
13200 <p class=TextFontCX><span class=Flag><span
\r
13201 style='font-size:10.0pt'>czech</span></span></p>
\r
13203 <p class=IndentText>Selects complete Czech naming convention (sets <span
\r
13204 class=Flag><span style='font-size:10.0pt'>access-czech</span></span>, <span
\r
13205 class=Flag><span style='font-size:10.0pt'>czech-fcns</span></span>, <span
\r
13206 class=Flag><span style='font-size:10.0pt'>czech-vars</span></span>, <span
\r
13207 class=Flag><span style='font-size:10.0pt'>czech-consts</span></span>, <span
\r
13208 class=Flag><span style='font-size:10.0pt'>czech-macros</span></span>, and <span
\r
13209 class=Flag><span style='font-size:10.0pt'>czech-types</span></span>).</p>
\r
13213 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13216 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13217 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13218 <p class=TextFontCX align=center
\r
13219 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13220 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
13227 <p class=TextFontCX><span class=Flag><span
\r
13228 style='font-size:10.0pt'>access-czech</span></span></p>
\r
13230 <p class=IndentText>Allow access to abstract types following Czech naming convention. The representation of an abstract type named <span
\r
13231 class=CodeText><i><span style='font-size:10.0pt'>t</span></i></span> is
\r
13232 accessible in the definition of a function or constant named <span
\r
13233 class=CodeText><i><span style='font-size:10.0pt'>t_name</span></i></span>.</p>
\r
13237 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13240 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13241 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13242 <p class=TextFontCX align=center
\r
13243 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13244 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13251 <p class=TextFontCX><span class=Flag><span
\r
13252 style='font-size:10.0pt'>czech-fcns</span></span></p>
\r
13254 <p class=IndentText>Function or iterator name is not consistent with Czech
\r
13255 naming convention.</p>
\r
13259 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13262 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13263 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13264 <p class=TextFontCX align=center
\r
13265 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13266 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13273 <p class=TextFontCX><span class=Flag><span
\r
13274 style='font-size:10.0pt'>czech-vars</span></span></p>
\r
13276 <p class=IndentText> Variable name is not consistent with Czech naming
\r
13281 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13284 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13285 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13286 <p class=TextFontCX align=center
\r
13287 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13288 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13295 <p class=TextFontCX><span class=Flag><span
\r
13296 style='font-size:10.0pt'>czech-macros</span></span></p>
\r
13298 <p class=IndentText> Expanded macro name is not consistent with Czech naming
\r
13303 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13306 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13307 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13308 <p class=TextFontCX align=center
\r
13309 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13310 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13317 <p class=TextFontCX><span class=Flag><span
\r
13318 style='font-size:10.0pt'>czech-consts</span></span></p>
\r
13320 <p class=IndentText>Constant name is not consistent with Czech naming
\r
13325 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13328 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13329 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13330 <p class=TextFontCX align=center
\r
13331 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13332 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13339 <p class=TextFontCX><span class=Flag><span
\r
13340 style='font-size:10.0pt'>czech-types</span></span></p>
\r
13342 <p class=IndentText>Type name is not consistent with Czech naming convention.
\r
13343 Czech type names must not use the underscore character.</p>
\r
13345 <p class=Heading11>Slovak Naming Convention</p>
\r
13349 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13352 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13353 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13354 <p class=TextFontCX align=center
\r
13355 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
13362 <p class=TextFontCX><span class=Flag><span
\r
13363 style='font-size:10.0pt'>slovak</span></span></p>
\r
13365 <p class=IndentText>Selects complete Slovak naming convention (sets <span
\r
13366 class=Flag><span style='font-size:10.0pt'>access-slovak</span></span>, <span
\r
13367 class=Flag><span style='font-size:10.0pt'>slovak-fcns</span></span>, <span
\r
13368 class=Flag><span style='font-size:10.0pt'>slovak-vars</span></span>, <span
\r
13369 class=Flag><span style='font-size:10.0pt'>slovak-consts</span></span>, <span
\r
13370 class=Flag><span style='font-size:10.0pt'>slovak-macros</span></span>, and <span
\r
13371 class=Flag><span style='font-size:10.0pt'>slovak-types</span></span>).</p>
\r
13375 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13378 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13379 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13380 <p class=TextFontCX align=center
\r
13381 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13382 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13389 <p class=TextFontCX><span class=Flag><span
\r
13390 style='font-size:10.0pt'>access-slovak</span></span></p>
\r
13392 <p class=IndentText>Allow access to abstract types following Slovak naming convention. The representation of an abstract type named <span
\r
13393 class=CodeText><i><span style='font-size:10.0pt'>t</span></i></span> is
\r
13394 accessible in the definition of a function or constant named <span
\r
13395 class=CodeText><i><span style='font-size:10.0pt'>tName</span></i></span>.</p>
\r
13399 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13402 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13403 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13404 <p class=TextFontCX align=center
\r
13405 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13406 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13413 <p class=TextFontCX><span class=Flag><span
\r
13414 style='font-size:10.0pt'>slovak-fcns</span></span></p>
\r
13416 <p class=IndentText>Function or iterator name is not consistent with Slovak
\r
13417 naming convention.</p>
\r
13421 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13424 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13425 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13426 <p class=TextFontCX align=center
\r
13427 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13428 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13435 <p class=TextFontCX><span class=Flag><span
\r
13436 style='font-size:10.0pt'>slovak-macros</span></span></p>
\r
13438 <p class=IndentText>Expanded macro name is not consistent with Slovak naming
\r
13443 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13446 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13447 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13448 <p class=TextFontCX align=center
\r
13449 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13450 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13457 <p class=TextFontCX><span class=Flag><span
\r
13458 style='font-size:10.0pt'>slovak-vars</span></span></p>
\r
13460 <p class=IndentText> Variable name is not consistent with Slovak naming
\r
13465 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13468 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13469 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13470 <p class=TextFontCX align=center
\r
13471 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13472 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13479 <p class=TextFontCX><span class=Flag><span
\r
13480 style='font-size:10.0pt'>slovak-consts</span></span></p>
\r
13482 <p class=IndentText> Constant name is not consistent with Slovak naming
\r
13487 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13490 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13491 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13492 <p class=TextFontCX align=center
\r
13493 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13494 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13501 <p class=TextFontCX><span class=Flag><span
\r
13502 style='font-size:10.0pt'>slovak-types</span></span></p>
\r
13504 <p class=IndentText>Type name is not consistent with Slovak naming convention.
\r
13505 Slovak type names may not include uppercase letters.</p>
\r
13507 <p class=Heading11>Czechoslovak Naming Convention</p>
\r
13511 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13514 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13515 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13516 <p class=TextFontCX align=center
\r
13517 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
13524 <p class=TextFontCX><span class=Flag><span
\r
13525 style='font-size:10.0pt'>czechoslovak</span></span></p>
\r
13527 <p class=IndentText>Selects complete Czechoslovak naming convention (sets <span
\r
13528 class=Flag><span style='font-size:10.0pt'>access-czechoslovak</span></span>, <span
\r
13529 class=Flag><span style='font-size:10.0pt'>czechoslovak-fcns</span></span>, <span
\r
13530 class=Flag><span style='font-size:10.0pt'>czechoslovak-vars</span></span>, <span
\r
13531 class=Flag><span style='font-size:10.0pt'>czechoslovak-consts</span></span>, <span
\r
13532 class=Flag><span style='font-size:10.0pt'>czechoslovak-macros</span></span>, and <span
\r
13533 class=Flag><span style='font-size:10.0pt'>czechoslovak-types</span></span>).</p>
\r
13537 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13540 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13541 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13542 <p class=TextFontCX align=center
\r
13543 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13544 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13551 <p class=TextFontCX><span class=Flag><span
\r
13552 style='font-size:10.0pt'>access-czechoslovak</span></span></p>
\r
13554 <p class=IndentText>Allow access to abstract types by Czechoslovak naming convention. The representation of an abstract type named <span
\r
13555 class=CodeText><i><span style='font-size:10.0pt'>t</span></i></span> is
\r
13556 accessible in the definition of a function or constant named <span
\r
13557 class=CodeText><i><span style='font-size:10.0pt'>t_name</span></i></span> or <span
\r
13558 class=CodeText><i><span style='font-size:10.0pt'>tName</span></i></span>.</p>
\r
13562 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13565 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13566 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13567 <p class=TextFontCX align=center
\r
13568 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13569 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13576 <p class=TextFontCX><span class=Flag><span
\r
13577 style='font-size:10.0pt'>czechoslovak-fcns</span></span></p>
\r
13579 <p class=IndentText> Function name is not consistent with Czechoslovak naming
\r
13584 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13587 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13588 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13589 <p class=TextFontCX align=center
\r
13590 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13591 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13598 <p class=TextFontCX><span class=Flag><span
\r
13599 style='font-size:10.0pt'>czechoslovak-macros</span></span></p>
\r
13601 <p class=IndentText>Expanded macro name is not consistent with Czechoslovak
\r
13602 naming convention.</p>
\r
13606 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13609 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13610 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13611 <p class=TextFontCX align=center
\r
13612 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13613 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13620 <p class=TextFontCX><span class=Flag><span
\r
13621 style='font-size:10.0pt'>czechoslovak-vars</span></span></p>
\r
13623 <p class=IndentText>Variable name is not consistent with Czechoslovak naming
\r
13628 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13631 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13632 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13633 <p class=TextFontCX align=center
\r
13634 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13635 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13642 <p class=TextFontCX><span class=Flag><span
\r
13643 style='font-size:10.0pt'>czechoslovak-consts</span></span></p>
\r
13645 <p class=IndentText>Constant name is not consistent with Czechoslovak naming
\r
13650 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13653 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13654 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13655 <p class=TextFontCX align=center
\r
13656 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13657 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13664 <p class=TextFontCX><span class=Flag><span
\r
13665 style='font-size:10.0pt'>czechoslovak-types</span></span></p>
\r
13667 <p class=IndentText>Type name is not consistent with Czechoslovak naming
\r
13668 convention. Czechoslovak type names may not include uppercase letters or the
\r
13669 underscore character.</p>
\r
13671 <p class=Heading10>Namespace Prefixes <span style='font-size:10.5pt;
\r
13672 font-weight:normal'>(Section 12.2)</span><span class=Flag><span
\r
13673 style='font-size:10.0pt'> </span></span></p>
\r
13675 <p class=TextFontCX><span class=Flag><span
\r
13676 style='font-size:10.0pt'>macro-var-prefix</span></span><span
\r
13677 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13679 <p class=IndentText>Set namespace prefix for variables declared in a macro
\r
13680 body. (Default is <span class=CodeText><span style='font-size:10.0pt'>m_</span></span>.)</p>
\r
13684 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13687 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13688 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13689 <p class=TextFontCX align=center
\r
13690 style='text-align:center;background:#CCCCCC'>P: <span class=Keyword><span
\r
13691 style='font-size:10.0pt'>+</span></span></p>
\r
13698 <p class=TextFontCX><span class=Flag><span
\r
13699 style='font-size:10.0pt'>macro-var-prefix-exclude</span></span></p>
\r
13701 <p class=IndentText>A variable declared outside a macro body starts with the <span
\r
13702 class=Flag><span style='font-size:10.0pt'>macro-var-prefix</span></span>.</p>
\r
13704 <p class=TextFontCX><span class=Flag><span
\r
13705 style='font-size:10.0pt'>tag-prefix</span></span><span
\r
13706 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13708 <p class=IndentText>Set namespace prefix of <span class=CodeText><span
\r
13709 style='font-size:10.0pt'>struct</span></span>, <span class=CodeText><span
\r
13710 style='font-size:10.0pt'>union</span></span> or <span class=CodeText><span
\r
13711 style='font-size:10.0pt'>enum</span></span> tag identifiers.</p>
\r
13715 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13718 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13719 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13720 <p class=TextFontCX align=center
\r
13721 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13722 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13729 <p class=TextFontCX><span class=Flag><span
\r
13730 style='font-size:10.0pt'>tag-prefix-exclude</span></span></p>
\r
13732 <p class=IndentText>An identifier that is not a tag starts with the <span
\r
13733 class=Flag><span style='font-size:10.0pt'>tagprefix</span></span>.</p>
\r
13735 <p class=TextFontCX><span class=Flag><span
\r
13736 style='font-size:10.0pt'>enum-prefix</span></span><span
\r
13737 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13739 <p class=IndentText>Set namespace prefix for <span class=CodeText><span
\r
13740 style='font-size:10.0pt'>enum</span></span> members.</p>
\r
13744 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13747 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13748 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13749 <p class=TextFontCX align=center
\r
13750 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13751 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13758 <p class=TextFontCX><span class=Flag><span
\r
13759 style='font-size:10.0pt'>enum-prefix-exclude</span></span></p>
\r
13761 <p class=IndentText>An identifier that is not an <span class=CodeText><span
\r
13762 style='font-size:10.0pt'>enum</span></span> member starts with the <span
\r
13763 class=Flag><span style='font-size:10.0pt'>enumprefix</span></span>.</p>
\r
13765 <p class=TextFontCX><span class=Flag><span
\r
13766 style='font-size:10.0pt'>file-static-prefix</span></span><span
\r
13767 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13769 <p class=IndentText>Set namespace prefix for file <span class=CodeText><span
\r
13770 style='font-size:10.0pt'>static</span></span> declarations.</p>
\r
13774 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13777 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13778 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13779 <p class=TextFontCX align=center
\r
13780 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13781 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13788 <p class=TextFontCX><span class=Flag><span
\r
13789 style='font-size:10.0pt'>file-static-prefix-exclude</span></span></p>
\r
13791 <p class=IndentText>An identifier that is not file static starts with the <span
\r
13792 class=Flag><span style='font-size:10.0pt'>filestaticprefix</span></span>.</p>
\r
13794 <p class=TextFontCX><span class=Flag><span
\r
13795 style='font-size:10.0pt'>global-prefix</span></span><span
\r
13796 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13798 <p class=IndentText>Set namespace prefix for global variables.</p>
\r
13802 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13805 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13806 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13807 <p class=TextFontCX align=center
\r
13808 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13809 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13816 <p class=TextFontCX><span class=Flag><span
\r
13817 style='font-size:10.0pt'>global-prefix-exclude</span></span></p>
\r
13819 <p class=IndentText>An identifier that is not a global variable starts with the
\r
13820 <span class=Flag><span style='font-size:10.0pt'>globalprefix</span></span>.</p>
\r
13822 <p class=TextFontCX><span class=Flag><span
\r
13823 style='font-size:10.0pt'>type-prefix</span></span><span
\r
13824 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13826 <p class=IndentText>Set namespace prefix for user-defined types.</p>
\r
13830 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13833 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13834 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13835 <p class=TextFontCX align=center
\r
13836 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13837 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13844 <p class=TextFontCX><span class=Flag><span
\r
13845 style='font-size:10.0pt'>type-prefix-exclude</span></span></p>
\r
13847 <p class=IndentText>An identifier that is not a type name starts with the <span
\r
13848 class=Flag><span style='font-size:10.0pt'>typeprefix</span></span>.</p>
\r
13850 <p class=TextFontCX><span class=Flag><span
\r
13851 style='font-size:10.0pt'>external-prefix</span></span><span
\r
13852 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13854 <p class=IndentText>Set namespace prefix for external identifiers.</p>
\r
13858 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13861 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13862 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13863 <p class=TextFontCX align=center
\r
13864 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13865 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13872 <p class=TextFontCX><span class=Flag><span
\r
13873 style='font-size:10.0pt'>external-prefix-exclude</span></span></p>
\r
13875 <p class=IndentText>An identifier that is not external starts with the <span
\r
13876 class=Flag><span style='font-size:10.0pt'>externalprefix</span></span>.</p>
\r
13878 <p class=TextFontCX><span class=Flag><span
\r
13879 style='font-size:10.0pt'>local-prefix</span></span><span
\r
13880 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13882 <p class=IndentText>Set namespace prefix for local variables.</p>
\r
13886 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13889 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13890 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13891 <p class=TextFontCX align=center
\r
13892 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13893 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13900 <p class=TextFontCX><span class=Flag><span
\r
13901 style='font-size:10.0pt'>local-prefix-exclude</span></span></p>
\r
13903 <p class=IndentText> An identifier that is not a local variable starts with the
\r
13904 <span class=Flag><span style='font-size:10.0pt'>localprefix</span></span>.</p>
\r
13906 <p class=TextFontCX><span class=Flag><span
\r
13907 style='font-size:10.0pt'>unchecked-macro-prefix</span></span><span
\r
13908 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13910 <p class=IndentText>Set namespace prefix for unchecked macros.</p>
\r
13914 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13917 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13918 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13919 <p class=TextFontCX align=center
\r
13920 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13921 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13928 <p class=TextFontCX><span class=Flag><span
\r
13929 style='font-size:10.0pt'>unchecked-macro-prefix-exclude</span></span></p>
\r
13931 <p class=IndentText>An identifier that is not the name of an unchecked macro
\r
13932 starts with the <span class=Flag><span style='font-size:10.0pt'>uncheckedmacroprefix</span></span>.</p>
\r
13934 <p class=TextFontCX><span class=Flag><span
\r
13935 style='font-size:10.0pt'>const-prefix</span></span><span
\r
13936 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13938 <p class=IndentText>Set namespace prefix for constants.</p>
\r
13942 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13945 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13946 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13947 <p class=TextFontCX align=center
\r
13948 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13949 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13956 <p class=TextFontCX><span class=Flag><span
\r
13957 style='font-size:10.0pt'>const-prefix-exclude</span></span></p>
\r
13959 <p class=IndentText>An identifier that is not a constant starts with the <span
\r
13960 class=Flag><span style='font-size:10.0pt'>constantprefix</span></span>.</p>
\r
13962 <p class=TextFontCX><span class=Flag><span
\r
13963 style='font-size:10.0pt'>iter-prefix</span></span><span
\r
13964 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13966 <p class=IndentText>Set namespace prefix for iterators.</p>
\r
13970 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
13973 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
13974 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
13975 <p class=TextFontCX align=center
\r
13976 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
13977 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
13984 <p class=TextFontCX><span class=Flag><span
\r
13985 style='font-size:10.0pt'>iter-prefix-exclude</span></span></p>
\r
13987 <p class=IndentText>An identifier that is not an <span class=Flag><span
\r
13988 style='font-size:10.0pt'>iter</span></span> starts with the <span
\r
13989 class=Flag><span style='font-size:10.0pt'>iterprefix</span></span>. </p>
\r
13991 <p class=TextFontCX><span class=Flag><span
\r
13992 style='font-size:10.0pt'>proto-param-prefix</span></span><span
\r
13993 class=Flag><span style='font-size:10.0pt'> <i><prefix string></i></span></span></p>
\r
13995 <p class=IndentText>Set namespace prefix for parameters in function prototypes.</p>
\r
13999 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14002 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14003 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14004 <p class=TextFontCX align=center
\r
14005 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
14006 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
14013 <p class=TextFontCX><span class=Flag><span
\r
14014 style='font-size:10.0pt'>proto-param-prefix-exclude</span></span></p>
\r
14016 <p class=IndentText>An identifier that is not a parameter in a function
\r
14017 prototype starts with the <span class=Flag><span style='font-size:10.0pt'>protoprarmprefix</span></span>. </p>
\r
14021 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14024 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14025 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14026 <p class=TextFontCX align=center
\r
14027 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14028 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
14035 <p class=TextFontCX><span class=Flag><span
\r
14036 style='font-size:10.0pt'>proto-param-name</span></span></p>
\r
14038 <p class=IndentText>A parameter in a function prototype has a name (can
\r
14039 interfere with macro definitions). </p>
\r
14043 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14046 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14047 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14048 <p class=TextFontCX align=center
\r
14049 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14050 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14057 <p class=TextFontCX><span class=Flag><span
\r
14058 style='font-size:10.0pt'>proto-param-match</span></span></p>
\r
14060 <p class=IndentText>The name of a parameter in a function definition does not
\r
14061 match the corresponding name of the parameter in a function prototype (after
\r
14062 removing the <span class=Flag><span style='font-size:10.0pt'>protoparamprefix</span></span>).</p>
\r
14064 <p class=Heading10>Naming Restrictions <span style='font-size:10.5pt;
\r
14065 font-weight:normal'>(Section 12.3)</span><span class=Flag><span
\r
14066 style='font-size:10.0pt'> </span></span></p>
\r
14070 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14073 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14074 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14075 <p class=TextFontCX align=center
\r
14076 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14077 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
14084 <p class=TextFontCX><span class=Flag><span
\r
14085 style='font-size:10.0pt'>shadow</span></span></p>
\r
14087 <p class=IndentText>Declaration reuses name visible in outer scope.</p>
\r
14089 <p class=Heading11>Reserved Names</p>
\r
14093 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14096 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14097 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14098 <p class=TextFontCX align=center
\r
14099 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14100 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
14107 <p class=TextFontCX><span class=Flag><span
\r
14108 style='font-size:10.0pt'>ansi-reserved</span></span></p>
\r
14110 <p class=IndentText>External name conflicts with name reserved for the compiler
\r
14111 or standard library.</p>
\r
14115 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14118 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14119 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14120 <p class=TextFontCX align=center
\r
14121 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14122 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14129 <p class=TextFontCX><span class=Flag><span
\r
14130 style='font-size:10.0pt'>ansi-reserved-internal</span></span></p>
\r
14132 <p class=IndentText> Internal name conflicts with name reserved for the
\r
14133 compiler or standard library.</p>
\r
14137 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14140 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14141 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14142 <p class=TextFontCX align=center
\r
14143 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14144 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
14151 <p class=TextFontCX><span class=Flag><span
\r
14152 style='font-size:10.0pt'>cpp-names</span></span></p>
\r
14154 <p class=IndentText>Internal or external name conflicts with a C++ reserved
\r
14155 word. (Will cause problems if program is compiled with a C++ compiler.)</p>
\r
14157 <p class=Heading11>Distinct External Names</p>
\r
14161 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14164 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14165 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14166 <p class=TextFontCX align=center
\r
14167 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
14168 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
14175 <p class=TextFontCX><span class=Flag><span
\r
14176 style='font-size:10.0pt'>distinct-external-names</span></span></p>
\r
14178 <p class=IndentText>An external name is not distinguishable from another
\r
14179 external name using<i> </i><span class=Flag><span style='font-size:10.0pt'>externalnamelen</span></span><i> </i>significant characters.</p>
\r
14183 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14186 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14187 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14188 <p class=TextFontCX align=center
\r
14189 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
14197 <p class=TextFontCX><span class=Flag><span
\r
14198 style='font-size:10.0pt'>external-name-len</span></span><span
\r
14199 class=Flag><span style='font-size:10.0pt'> <i><number></i></span></span></p>
\r
14201 <p class=IndentText>Sets the number of significant characters in an external
\r
14202 name (ANSI default minimum is 6). Sets <span class=Flag><span
\r
14203 style='font-size:10.0pt'>+distinct-external-names</span></span>.</p>
\r
14207 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14210 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14211 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14212 <p class=TextFontCX align=center
\r
14213 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
14214 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
14221 <p class=TextFontCX><span class=Flag><span
\r
14222 style='font-size:10.0pt'>external-name-case-insensitive</span></span></p>
\r
14224 <p class=IndentText>Make alphabetic case insignificant in external names.
\r
14225 According to ANSI standard, case need not be significant in an external name.
\r
14226 If <span class=Flag><span style='font-size:10.0pt'>+distinct-external-names</span></span> is not set, sets <span
\r
14227 class=Flag><span style='font-size:10.0pt'>+distinct-external-names</span></span>
\r
14228 with unlimited external name length.</p>
\r
14230 <p class=Heading11>Distinct Internal Names</p>
\r
14234 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14237 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14238 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14239 <p class=TextFontCX align=center
\r
14240 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14241 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
14248 <p class=TextFontCX><span class=Flag><span
\r
14249 style='font-size:10.0pt'>distinct-internal-names</span></span></p>
\r
14251 <p class=IndentText>An internal name is not distinguishable from another
\r
14252 internal name using <span class=Flag><span style='font-size:10.0pt'>internalnamelen</span></span> significant characters. (Also effected by <span
\r
14253 class=Flag><span style='font-size:10.0pt'>internal-name-case-insensitive</span></span> and <span
\r
14254 class=Flag><span style='font-size:10.0pt'>internal-name-lookalike</span></span>.)</p>
\r
14258 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14261 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14262 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14263 <p class=TextFontCX align=center
\r
14264 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
14265 </span><span class=Flag><span style='font-size:10.0pt'>31</span></span></p>
\r
14272 <p class=TextFontCX><span class=Flag><span
\r
14273 style='font-size:10.0pt'>internal-name-len</span></span><span
\r
14274 class=Flag><span style='font-size:10.0pt'> <i><number></i></span></span></p>
\r
14276 <p class=IndentText>Set the number of significant characters in an internal
\r
14277 name. Sets <span class=Flag><span style='font-size:10.0pt'>+distinct-internal-names</span></span>.</p>
\r
14281 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14284 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14285 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14286 <p class=TextFontCX align=center
\r
14287 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
14288 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
14295 <p class=TextFontCX><span class=Flag><span
\r
14296 style='font-size:10.0pt'>internal-name-case-insensitive</span></span></p>
\r
14298 <p class=IndentText>Set whether case is significant an internal names (<span
\r
14299 class=Flag><span style='font-size:10.0pt'>-internal-name-case-insensitive</span></span> means case is significant). If <span
\r
14300 class=Flag><span style='font-size:10.0pt'>+distinct-internal-names</span></span> is not set, sets <span
\r
14301 class=Flag><span style='font-size:10.0pt'>+distinct-internal-names</span></span>
\r
14302 with unlimited internal name length.</p>
\r
14306 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14309 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14310 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14311 <p class=TextFontCX align=center
\r
14312 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
14313 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
14320 <p class=TextFontCX><span class=Flag><span
\r
14321 style='font-size:10.0pt'>internal-name-lookalike</span></span></p>
\r
14323 <p class=IndentText> Set whether similar looking characters (e.g.,
\93<span
\r
14324 class=Keyword><span style='font-size:10.0pt'>1</span></span>
\94 and
\93<span
\r
14325 class=Keyword><span style='font-size:10.0pt'>l</span></span>
\94) match in
\r
14326 internal names.</p>
\r
14328 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'>Control Flow <span
\r
14329 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14330 font-weight:normal'>(Section 8)</span></span></p>
\r
14332 <p class=Heading10>Undefined Evaluation Order <span class=HeadingNote><span
\r
14333 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
14334 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
14335 normal'>8.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
14336 font-weight:normal;font-style:normal'>)</span></span><span class=Flag><i><span
\r
14337 style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;
\r
14338 font-weight:normal'> </span></i></span></p>
\r
14342 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14345 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14346 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14347 <p class=TextFontCX align=center
\r
14348 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14349 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
14356 <p class=Heading10 style='margin:0in;margin-bottom:.0001pt'><span class=Flag><span
\r
14357 style='font-size:10.0pt;font-weight:normal'>eval-order</span></span></p>
\r
14359 <p class=IndentText>Behavior of an expression is unspecified or implementation-dependent because sub-expressions contain interfering side effects that may be evaluated in any order.</p>
\r
14363 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14366 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14367 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14368 <p class=TextFontCX align=center
\r
14369 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14370 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14377 <p class=TextFontCX><span class=Flag><span
\r
14378 style='font-size:10.0pt'>eval-order-uncon</span></span></p>
\r
14380 <p class=IndentText>An expression may be undefined because a sub-expression
\r
14381 contains a call to an unconstrained function (no modifies clause) that may
\r
14382 modify something that may be modified or used by another sub-expression.</p>
\r
14384 <p class=Heading10>Problematic Control Structures <span class=HeadingNote><span
\r
14385 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
14386 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
14387 normal'>8.3</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
14388 font-weight:normal;font-style:normal'>)</span></span><span class=Flag><span
\r
14389 style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;
\r
14390 font-weight:normal'> </span></span></p>
\r
14394 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14397 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14398 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14399 <p class=TextFontCX align=center
\r
14400 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14401 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
14408 <p class=TextFontCX><span
\r
14409 class=Flag><span style='font-size:10.0pt'>inf-loops</span></span></p>
\r
14411 <p class=IndentText>Likely infinite loop is detected (Section 8.3.1).</p>
\r
14415 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14418 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14419 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14420 <p class=TextFontCX align=center
\r
14421 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14422 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
14429 <p class=TextFontCX><span class=Flag><span
\r
14430 style='font-size:10.0pt'>inf-loops-uncon</span></span></p>
\r
14432 <p class=IndentText>Likely infinite loop is detected. Loop test or body calls
\r
14433 an unconstrained function that may produce an undetected modification.</p>
\r
14437 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14440 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14441 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14442 <p class=TextFontCX align=center
\r
14443 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14444 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14451 <p class=TextFontCX><span class=Flag><span
\r
14452 style='font-size:10.0pt'>elseif-complete</span></span></p>
\r
14454 <p class=IndentText>There is no finals else following an else if construct
\r
14455 (Section 8.3.5). </p>
\r
14459 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14462 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14463 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14464 <p class=TextFontCX align=center
\r
14465 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14466 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
14473 <p class=TextFontCX><span class=Flag><span
\r
14474 style='font-size:10.0pt'>case-break</span></span></p>
\r
14476 <p class=IndentText>There is a non-empty case in a switch not followed by a <span
\r
14477 class=CodeText><span style='font-size:10.0pt'>break</span></span><span
\r
14478 class=Keyword><span style='font-size:10.0pt'> </span></span><span
\r
14479 class=HeadingNote><span style='font-size:10.5pt;font-style:normal'>(Section </span></span><span
\r
14480 class=HeadingNote><span style='font-size:10.5pt;font-style:normal'>8.3.2</span></span><span
\r
14481 class=HeadingNote><span style='font-size:10.5pt;font-style:normal'>).</span></span></p>
\r
14485 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14488 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14489 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14490 <p class=TextFontCX align=center
\r
14491 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14492 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
14499 <p class=TextFontCX><span class=Flag><span
\r
14500 style='font-size:10.0pt'>miss-case</span></span></p>
\r
14502 <p class=IndentText>A switch on an <span class=CodeText><span style='font-size:
\r
14503 10.0pt'>enum</span></span> type is missing a case for a member of the
\r
14508 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14511 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14512 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14513 <p class=TextFontCX align=center
\r
14514 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14515 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
14522 <p class=TextFontCX><span class=Flag><span
\r
14523 style='font-size:10.0pt'>loop-exec</span></span></p>
\r
14525 <p class=IndentText>Assume all loops execute at least once. This effects
\r
14526 use-before-definition and memory checking. It should probably not be used
\r
14527 globally, but may be used surrounding a particular loop that is known to always
\r
14528 execute to prevent spurious messages.</p>
\r
14530 <p class=Heading10>Deep Break <span
\r
14531 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14532 font-weight:normal'>(Section </span></span><span
\r
14533 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14534 font-weight:normal'>8.3.3</span></span><span
\r
14535 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14536 font-weight:normal'>)</span></span></p>
\r
14540 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14543 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14544 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14545 <p class=TextFontCX align=center
\r
14546 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
14553 <p class=TextFontCX><span class=Flag><span
\r
14554 style='font-size:10.0pt'>deep-break</span></span></p>
\r
14556 <p class=IndentText>Report errors for <span class=CodeText><span
\r
14557 style='font-size:10.0pt'>break</span></span> statements inside a nested <span
\r
14558 class=CodeText><span style='font-size:10.0pt'>while</span></span>, <span
\r
14559 class=CodeText><span style='font-size:10.0pt'>for</span></span> or <span
\r
14560 class=CodeText><span style='font-size:10.0pt'>switch</span></span>. (Sets all
\r
14561 nested break and continue flags.)</p>
\r
14565 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14568 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14569 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14570 <p class=TextFontCX align=center
\r
14571 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14572 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
14579 <p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>loop-loop-break</span></span></p>
\r
14581 <p class=IndentText><span class=TextFontCXChar>There
\r
14582 is a </span><span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
14583 inside a <span class=CodeText><span style='font-size:10.0pt'>while</span></span>,
\r
14584 <span class=CodeText><span style='font-size:10.0pt'>for</span></span> or
\r
14585 iterator loop that is inside a <span class=CodeText><span style='font-size:
\r
14586 10.0pt'>while</span></span>, <span class=CodeText><span style='font-size:10.0pt'>for</span></span>
\r
14587 or iterator loop. Mark with <span class=Annot><span style='font-size:10.0pt'>/*@innerbreak@*/</span></span> to suppress the message.</p>
\r
14591 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14594 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14595 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14596 <p class=TextFontCX align=center
\r
14597 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14598 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
14605 <p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>switch-loop-break</span></span></p>
\r
14607 <p class=IndentText><span class=TextFontCXChar>There
\r
14608 is a</span><span class=Keyword><span style='font-size:10.5pt;font-family:"Times New Roman"'>
\r
14609 </span></span><span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
14610 inside a <span class=CodeText><span style='font-size:10.0pt'>while</span></span>,
\r
14611 <span class=CodeText><span style='font-size:10.0pt'>for</span></span> or
\r
14612 iterator loop that is inside a <span class=CodeText><span style='font-size:
\r
14613 10.0pt'>switch</span></span> statement. Mark with <span class=Annot><span
\r
14614 style='font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>
\r
14618 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14621 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14622 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14623 <p class=TextFontCX align=center
\r
14624 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14625 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14632 <p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>loop-switch-break</span></span></p>
\r
14634 <p class=IndentText><span class=TextFontCXChar>There
\r
14635 is a</span><span class=Keyword><span style='font-size:10.5pt;font-family:"Times New Roman"'>
\r
14636 </span></span><span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
14637 inside a <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>
\r
14638 statement that is inside a <span class=CodeText><span style='font-size:10.0pt'>while</span></span>,
\r
14639 <span class=CodeText><span style='font-size:10.0pt'>for</span></span> or
\r
14640 iterator loop. Mark with /<span class=Annot><span style='font-size:10.0pt'>*@switchbreak@*/</span></span>.</p>
\r
14644 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14647 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14648 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14649 <p class=TextFontCX align=center
\r
14650 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14651 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14658 <p class=MsoListBullet style='margin-left:0in;text-indent:0in'><span
\r
14659 class=Flag><span style='font-size:10.0pt'>switch-switch-break</span></span></p>
\r
14661 <p class=IndentText><span class=TextFontCXChar>There
\r
14662 is a</span><span class=Keyword><span style='font-size:10.5pt;font-family:"Times New Roman"'>
\r
14663 </span></span><span class=CodeText><span style='font-size:10.0pt'>break</span></span>
\r
14664 inside a <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>
\r
14665 statement that is inside another <span class=CodeText><span style='font-size:
\r
14666 10.0pt'>switch</span></span> statement. Mark with <span class=Annot><span
\r
14667 style='font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>
\r
14671 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14674 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14675 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14676 <p class=TextFontCX align=center
\r
14677 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14678 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14685 <p class=TextFontCX><span class=Flag><span
\r
14686 style='font-size:10.0pt'>loop-loop-continue</span></span></p>
\r
14688 <p class=IndentText>There is a <span class=CodeText><span style='font-size:
\r
14689 10.0pt'>continue</span></span> inside a while, for or iterator loop that is
\r
14690 inside a while, for or iterator loop. Mark with <span class=Annot><span
\r
14691 style='font-size:10.0pt'>/*@innercontinue@*/</span></span>.</p>
\r
14693 <p class=Heading10>Loop and if Bodies <span
\r
14694 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14695 font-weight:normal'>(Section 8.3.4)</span></span></p>
\r
14699 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14702 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14703 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14704 <p class=TextFontCX align=center
\r
14705 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
14712 <p class=TextFontCX><span class=Flag><span
\r
14713 style='font-size:10.0pt'>all-empty</span></span></p>
\r
14715 <p class=IndentText>An if, while or for statement has no body (sets <span
\r
14716 class=Flag><span style='font-size:10.0pt'>if-empty</span></span>, <span
\r
14717 class=Flag><span style='font-size:10.0pt'>while-empty</span></span> and <span
\r
14718 class=Flag><span style='font-size:10.0pt'>for-empty</span></span>.)</p>
\r
14722 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14725 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14726 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14727 <p class=TextFontCX align=center
\r
14728 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
14735 <p class=TextFontCX><span class=Flag><span
\r
14736 style='font-size:10.0pt'>all-block</span></span></p>
\r
14738 <p class=IndentText>The body of an <span class=CodeText><span style='font-size:
\r
14739 10.0pt'>if</span></span>, <span class=CodeText><span style='font-size:10.0pt'>while</span></span>
\r
14740 or <span class=CodeText><span style='font-size:10.0pt'>for</span></span>
\r
14741 statement is not a block (sets <span class=Flag><span style='font-size:10.0pt'>if-block</span></span>, <span
\r
14742 class=Flag><span style='font-size:10.0pt'>while-block</span></span> and <span
\r
14743 class=Flag><span style='font-size:10.0pt'>for-block</span></span>.)</p>
\r
14747 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14750 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14751 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14752 <p class=TextFontCX align=center
\r
14753 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14754 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
14761 <p class=TextFontCX><span class=Flag><span
\r
14762 style='font-size:10.0pt'>while-empty</span></span></p>
\r
14764 <p class=IndentText>A while statement has no body.</p>
\r
14768 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14771 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14772 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14773 <p class=TextFontCX align=center
\r
14774 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14775 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14782 <p class=TextFontCX><span class=Flag><span
\r
14783 style='font-size:10.0pt'>while-block</span></span></p>
\r
14785 <p class=IndentText> The body of a <span class=CodeText><span style='font-size:
\r
14786 10.0pt'>while</span></span> statement is not a block</p>
\r
14790 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14793 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14794 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14795 <p class=TextFontCX align=center
\r
14796 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14797 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14804 <p class=TextFontCX><span class=Flag><span
\r
14805 style='font-size:10.0pt'>for-empty</span></span></p>
\r
14807 <p class=IndentText>A <span class=CodeText><span style='font-size:10.0pt'>for</span></span>
\r
14808 statement has no body.</p>
\r
14812 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14815 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14816 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14817 <p class=TextFontCX align=center
\r
14818 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14819 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14826 <p class=TextFontCX><span class=Flag><span
\r
14827 style='font-size:10.0pt'>for-block</span></span></p>
\r
14829 <p class=IndentText>The body of a <span class=CodeText><span style='font-size:
\r
14830 10.0pt'>for</span></span> statement is not a block.</p>
\r
14834 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14837 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14838 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14839 <p class=TextFontCX align=center
\r
14840 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14841 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
14848 <p class=TextFontCX><span class=Flag><span
\r
14849 style='font-size:10.0pt'>if-empty</span></span></p>
\r
14851 <p class=IndentText>An <span class=CodeText><span style='font-size:10.0pt'>if</span></span>
\r
14852 statement has no body.</p>
\r
14856 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14859 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14860 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14861 <p class=TextFontCX align=center
\r
14862 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14863 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14870 <p class=TextFontCX><span class=Flag><span
\r
14871 style='font-size:10.0pt'>ifblock</span></span></p>
\r
14873 <p class=IndentText>The body of an <span class=CodeText><span style='font-size:
\r
14874 10.0pt'>if</span></span> statement is not a block.</p>
\r
14876 <p class=Heading10>Suspicious Statements <span
\r
14877 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14878 font-weight:normal'>(Section 8.4)</span></span></p>
\r
14882 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14885 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14886 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14887 <p class=TextFontCX align=center
\r
14888 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14889 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
14896 <p class=TextFontCX><span class=Flag><span
\r
14897 style='font-size:10.0pt'>unreachable</span></span></p>
\r
14899 <p class=IndentText>Code is not reached on any possible execution.<span
\r
14900 class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
14904 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14907 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14908 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14909 <p class=TextFontCX align=center
\r
14910 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14911 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
14918 <p class=TextFontCX><span class=Flag><span
\r
14919 style='font-size:10.0pt'>noeffect</span></span></p>
\r
14921 <p class=IndentText>Statement has no effect.<span class=Flag><span
\r
14922 style='font-size:10.0pt'> </span></span></p>
\r
14926 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14929 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14930 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14931 <p class=TextFontCX align=center
\r
14932 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14933 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
14940 <p class=TextFontCX><span class=Flag><span
\r
14941 style='font-size:10.0pt'>noeffect-uncon</span></span></p>
\r
14943 <p class=IndentText>Statement involving call to unconstrained function may have
\r
14948 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14951 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14952 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14953 <p class=TextFontCX align=center
\r
14954 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14955 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
14962 <p class=TextFontCX><span class=Flag><span
\r
14963 style='font-size:10.0pt'>noret</span></span></p>
\r
14965 <p class=IndentText>There is a path with no <span class=Keyword><span
\r
14966 style='font-size:10.0pt'>return</span></span> in a function declared to return
\r
14967 a non-<span class=Keyword><span style='font-size:10.0pt'>void</span></span>
\r
14970 <p class=Heading10>Ignored Return Values <span
\r
14971 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14972 font-weight:normal'>(Section </span></span><span
\r
14973 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14974 font-weight:normal'>8.4.2</span></span><span
\r
14975 class=TextFontCXChar><span style='font-size:11.0pt;
\r
14976 font-weight:normal'>)</span></span></p>
\r
14978 <p class=beforelist>These flags control when errors are reported for function
\r
14979 calls that do not use the return value. Casting the function call to <span
\r
14980 class=CodeText><span style='font-size:10.0pt'>void</span></span> or declaring
\r
14981 the called function to return <span class=Annot><span style='font-size:10.0pt'>/*@alt
\r
14982 void@*/</span></span>.</p>
\r
14986 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
14989 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
14990 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
14991 <p class=TextFontCX align=center
\r
14992 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
14993 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
15000 <p class=TextFontCX><span class=Flag><span
\r
15001 style='font-size:10.0pt'>ret-val-bool</span></span></p>
\r
15003 <p class=IndentText>Return value of type <span class=CodeText><span
\r
15004 style='font-size:10.0pt'>bool</span></span> ignored. </p>
\r
15008 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15011 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15012 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15013 <p class=TextFontCX align=center
\r
15014 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15015 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
15022 <p class=TextFontCX><span class=Flag><span
\r
15023 style='font-size:10.0pt'>ret-val-int</span></span></p>
\r
15025 <p class=IndentText>Return value of type <span class=CodeText><span
\r
15026 style='font-size:10.0pt'>int</span></span> ignored. </p>
\r
15030 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15033 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15034 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15035 <p class=TextFontCX align=center
\r
15036 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15037 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
15044 <p class=TextFontCX><span class=Flag><span
\r
15045 style='font-size:10.0pt'>ret-val-other</span></span></p>
\r
15047 <p class=IndentText>Return value of type other than <span class=CodeText><span
\r
15048 style='font-size:10.0pt'>bool</span></span> or <span
\r
15049 class=CodeText><span style='font-size:10.0pt'>int</span></span> ignored.</p>
\r
15053 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15056 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15057 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15058 <p class=TextFontCX align=center
\r
15059 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
15066 <p class=TextFontCX><span class=Flag><span
\r
15067 style='font-size:10.0pt'>ret-val</span></span></p>
\r
15069 <p class=IndentText>Return value ignored (Sets <span class=Flag><span
\r
15070 style='font-size:10.0pt'>retvalbool</span></span>, <span
\r
15071 class=Flag><span style='font-size:10.0pt'>retvalint</span></span>, <span
\r
15072 class=Flag><span style='font-size:10.0pt'>retvalother</span></span>.)</p>
\r
15074 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'>Completeness <span
\r
15075 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
15076 normal'>(Section </span></span><span
\r
15077 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
15078 normal'>13</span></span><span
\r
15079 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
15080 normal'>)</span></span></p>
\r
15082 <p class=Heading10>Unused Declarations <span class=HeadingNote><span
\r
15083 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
15084 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
15085 normal'>13.1</span></span><span
\r
15086 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
15087 normal'>)</span></span></p>
\r
15089 <p class=beforelist>These flags control when errors are reported for
\r
15090 declarations that are never used. The <span class=Annot><span
\r
15091 style='font-size:10.0pt'>unused</span></span> annotation can be used to prevent
\r
15092 unused errors from being report for a particular declaration.</p>
\r
15096 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15099 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15100 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15101 <p class=TextFontCX align=center
\r
15102 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15103 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15110 <p class=TextFontCX><span class=Flag><span
\r
15111 style='font-size:10.0pt'>top-use</span></span></p>
\r
15113 <p class=IndentText>An external declaration is not used in any file.</p>
\r
15117 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15120 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15121 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15122 <p class=TextFontCX align=center
\r
15123 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15124 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
15131 <p class=TextFontCX><span class=Flag><span
\r
15132 style='font-size:10.0pt'>const-use</span></span></p>
\r
15134 <p class=IndentText>Constant never used. </p>
\r
15138 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15141 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15142 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15143 <p class=TextFontCX align=center
\r
15144 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15145 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
15152 <p class=TextFontCX><span class=Flag><span
\r
15153 style='font-size:10.0pt'>enum-mem-use</span></span></p>
\r
15155 <p class=IndentText>Member of enumerator never used. </p>
\r
15159 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15162 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15163 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15164 <p class=TextFontCX align=center
\r
15165 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15166 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
15173 <p class=TextFontCX><span class=Flag><span
\r
15174 style='font-size:10.0pt'>var-use</span></span></p>
\r
15176 <p class=IndentText>Variable never used.</p>
\r
15180 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15183 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15184 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15185 <p class=TextFontCX align=center
\r
15186 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15187 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
15194 <p class=TextFontCX><span class=Flag><span
\r
15195 style='font-size:10.0pt'>param-use</span></span></p>
\r
15197 <p class=IndentText>Function parameter never used.</p>
\r
15201 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15204 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15205 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15206 <p class=TextFontCX align=center
\r
15207 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15208 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
15215 <p class=TextFontCX><span class=Flag><span
\r
15216 style='font-size:10.0pt'>fcn-use</span></span></p>
\r
15218 <p class=IndentText>Function is never used.</p>
\r
15222 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15225 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15226 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15227 <p class=TextFontCX align=center
\r
15228 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15229 class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>
\r
15236 <p class=TextFontCX><span class=Flag><span
\r
15237 style='font-size:10.0pt'>type-use</span></span></p>
\r
15239 <p class=IndentText>Defined type never used. </p>
\r
15243 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15246 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15247 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15248 <p class=TextFontCX align=center
\r
15249 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15250 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
15257 <p class=TextFontCX><span class=Flag><span
\r
15258 style='font-size:10.0pt'>field-use</span></span></p>
\r
15260 <p class=IndentText>Field of structure or union type is never used.</p>
\r
15264 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15267 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15268 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15269 <p class=TextFontCX align=center
\r
15270 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15271 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15278 <p class=TextFontCX><span class=Flag><span
\r
15279 style='font-size:10.0pt'>unused-special</span></span></p>
\r
15281 <p class=IndentText>Declaration in a special file (corresponding to <span
\r
15282 class=ProgramNameChar>.l</span> or <span class=ProgramNameChar>.y</span> file)
\r
15285 <p class=Heading10>Complete Programs <span
\r
15286 class=TextFontCXChar><span style='font-size:11.0pt;
\r
15287 font-weight:normal'>(Section 13.2)</span></span><span class=Flag><span
\r
15288 style='font-size:10.0pt'> </span></span></p>
\r
15292 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15295 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15296 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15297 <p class=TextFontCX align=center
\r
15298 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15299 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
15306 <p class=TextFontCX><span class=Flag><span
\r
15307 style='font-size:10.0pt'>decl-undef</span></span></p>
\r
15309 <p class=IndentText>Function, variable, iterator or constant declared but never
\r
15314 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15317 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15318 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15319 <p class=TextFontCX align=center
\r
15320 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
15327 <p class=TextFontCX><span class=Flag><span
\r
15328 style='font-size:10.0pt'>partial</span></span></p>
\r
15330 <p class=IndentText>Check as partial system (sets <span class=Flag><span
\r
15331 style='font-size:10.0pt'>-decl-undef</span></span>, <span
\r
15332 class=Flag><span style='font-size:10.0pt'>-export-local</span></span> and prevents checking of macros in headers without corresponding <span
\r
15333 class=ProgramNameChar>.c</span> files.)</p>
\r
15335 <p class=Heading10>Exports</p>
\r
15339 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15342 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15343 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15344 <p class=TextFontCX align=center
\r
15345 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15346 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15353 <p class=TextFontCX><span
\r
15354 class=Flag><span style='font-size:10.0pt'>export-local</span></span></p>
\r
15356 <p class=IndentText>A declaration is exported but not used outside this
\r
15357 module. (Declaration can use the <span class=CodeText><span style='font-size:
\r
15358 10.0pt'>static</span></span> qualifier.)</p>
\r
15362 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15365 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15366 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15367 <p class=TextFontCX align=center
\r
15368 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15369 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
15376 <p class=TextFontCX><span class=Flag><span
\r
15377 style='font-size:10.0pt'>export-header</span></span></p>
\r
15379 <p class=IndentText>A declaration (other than a variable) is exported but does
\r
15380 not appear in a header file.</p>
\r
15384 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15387 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15388 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15389 <p class=TextFontCX align=center
\r
15390 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15391 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
15398 <p class=TextFontCX><span class=Flag><span
\r
15399 style='font-size:10.0pt'>export-header-var</span></span></p>
\r
15401 <p class=IndentText>A variable declaration is exported but does not appear in a
\r
15404 <p class=Heading10>Unrecognized Identifiers</p>
\r
15408 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15411 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15412 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15413 <p class=TextFontCX align=center
\r
15414 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15415 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
15422 <p class=TextFontCX><span
\r
15423 class=Flag><span style='font-size:10.0pt'>unrecog</span></span></p>
\r
15425 <p class=IndentText>An unrecognized identifier is used.</p>
\r
15429 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15432 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15433 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15434 <p class=TextFontCX align=center
\r
15435 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15436 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
15443 <p class=TextFontCX><span class=Flag><span
\r
15444 style='font-size:10.0pt'>sys-unrecog</span></span></p>
\r
15446 <p class=IndentText>Report unrecognized identifiers that start with the system
\r
15447 prefix, <span class=Keyword><span style='font-size:10.0pt'>__</span></span>
\r
15448 (two underscores).</p>
\r
15452 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15455 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15456 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15457 <p class=TextFontCX align=center
\r
15458 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15459 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
15466 <p class=TextFontCX><span class=Flag><span
\r
15467 style='font-size:10.0pt'>repeat-unrecog</span></span></p>
\r
15469 <p class=IndentText>Report multiple messages for unrecognized identifiers. If <span
\r
15470 class=Flag><span style='font-size:10.0pt'>repeatunrecog</span></span> is not
\r
15471 set, an error is reported only the first time a particular unrecognized
\r
15472 identifier appears in the file.</p>
\r
15474 <p class=Heading10>Multiple Definition and Declarations</p>
\r
15478 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15481 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15482 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15483 <p class=TextFontCX align=center
\r
15484 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15485 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
15492 <p class=TextFontCX><span
\r
15493 class=Flag><span style='font-size:10.0pt'>redef</span></span></p>
\r
15495 <p class=IndentText>A function or variable is defined more than once.</p>
\r
15499 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15502 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15503 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15504 <p class=TextFontCX align=center
\r
15505 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15506 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
15513 <p class=TextFontCX><span class=Flag><span
\r
15514 style='font-size:10.0pt'>redecl</span></span></p>
\r
15516 <p class=IndentText>An identifier is declared more than once.<span class=Flag><span
\r
15517 style='font-size:10.0pt'> </span></span></p>
\r
15521 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15524 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15525 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15526 <p class=TextFontCX align=center
\r
15527 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15528 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
15535 <p class=TextFontCX><span class=Flag><span
\r
15536 style='font-size:10.0pt'>nested-extern</span></span></p>
\r
15538 <p class=IndentText>An <span class=Keyword><span style='font-size:10.0pt'>extern</span></span>
\r
15539 declaration is used inside a function body.</p>
\r
15541 <p class=Heading10>ISO Conformance</p>
\r
15545 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15548 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15549 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15550 <p class=TextFontCX align=center
\r
15551 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15552 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
15559 <p class=TextFontCX><span class=Flag><span
\r
15560 style='font-size:10.0pt'>noparams</span></span></p>
\r
15562 <p class=IndentText>A function is declared without a parameter list prototype. </p>
\r
15566 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15569 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15570 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15571 <p class=TextFontCX align=center
\r
15572 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15573 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15580 <p class=TextFontCX><span class=Flag><span
\r
15581 style='font-size:10.0pt'>old-style</span></span></p>
\r
15583 <p class=IndentText>Function definition is in old style syntax. Standard
\r
15584 prototype syntax is preferred.</p>
\r
15588 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15591 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15592 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15593 <p class=TextFontCX align=center
\r
15594 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15595 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
15602 <p class=TextFontCX><span class=Flag><span
\r
15603 style='font-size:10.0pt'>exit-arg</span></span></p>
\r
15605 <p class=IndentText>Argument to <span class=CodeText><span style='font-size:
\r
15606 10.0pt'>exit</span></span> has implementation defined behavior. The only valid arguments to <span
\r
15607 class=CodeText><span style='font-size:10.0pt'>exit</span></span> are <span
\r
15608 class=CodeText><span style='font-size:10.0pt'>EXIT_SUCCESS</span></span>, <span
\r
15609 class=CodeText><span style='font-size:10.0pt'>EXIT_FAILURE</span></span> and <span
\r
15610 class=CodeText><span style='font-size:10.0pt'>0</span></span>. An error is
\r
15611 reported if Splint can determine statically that the argument to <span
\r
15612 class=CodeText><span style='font-size:10.0pt'>exit</span></span> is not one of these.</p>
\r
15616 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15619 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15620 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15621 <p class=TextFontCX align=center
\r
15622 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15623 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
15630 <p class=TextFontCX><span class=Flag><span
\r
15631 style='font-size:10.0pt'>use-var-args</span></span></p>
\r
15633 <p class=IndentText>Report if <span class=CodeText><span style='font-size:10.0pt'><varargs.h></span></span>
\r
15634 is used (should use <span class=ProgramNameChar><span style='font-size:10.0pt'>stdarg.h</span></span>).<span
\r
15635 class=Flag><span style='font-size:10.5pt;font-family:"Times New Roman"'> </span></span></p>
\r
15637 <p class=Heading10>Limits</p>
\r
15639 <p class=beforelist>The ANSI Standard includes limits on minimum numbers that a
\r
15640 conforming compiler must support. Whether of not a particular compiler exceeds
\r
15641 these limits, it is worth checking that a program does not exceed them so that
\r
15642 other compilers may safely compile it. In addition, exceeding a limit may
\r
15643 indicate a problem in the code (e.g., it is too complex if the control nest
\r
15644 depth limit is exceeded) that should be fixed regardless of the compiler.
\r
15645 Splint checks the following limits. For each limit, the maximum value may be
\r
15646 set from the command line (or locally using a stylized comment). The minimum
\r
15647 limits were increased for the ISO C99 specification. If the <span class=Flag><span
\r
15648 style='font-size:10.0pt'>iso99-limits</span></span> flag is used, all limits are checked with the minimum values of an ISO C99 conforming
\r
15649 compiler. If the <span class=Flag><span style='font-size:10.0pt'>ansi89-limits</span></span>
\r
15650 flag is used, all limits are checked with the minimum values of an ANSI C89
\r
15651 conforming compiler.</p>
\r
15655 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15658 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15659 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15660 <p class=TextFontCX align=center
\r
15661 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
15668 <p class=TextFontCX><span class=Flag><span
\r
15669 style='font-size:10.0pt'>ansi89-imits</span></span></p>
\r
15671 <p class=IndentText>Check for violations of minimum limits prescribed by ANSI
\r
15672 C89 standard (sets <span class=Flag><span style='font-size:10.0pt'>control-nest-depth</span></span>, <span
\r
15673 class=Flag><span style='font-size:10.0pt'>string-literal-len</span></span>, <span
\r
15674 class=Flag><span style='font-size:10.0pt'>include-nest</span></span>, <span
\r
15675 class=Flag><span style='font-size:10.0pt'>num-struct-fields</span></span>, and <span
\r
15676 class=Flag><span style='font-size:10.0pt'>num-enum-members</span></span>).</p>
\r
15680 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15683 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15684 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15685 <p class=TextFontCX align=center
\r
15686 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15687 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15694 <p class=TextFontCX><span class=Flag><span
\r
15695 style='font-size:10.0pt'>control-nest-depth</span></span><span
\r
15696 class=Flag><span style='font-size:10.0pt'> <i><number></i></span></span></p>
\r
15698 <p class=IndentText>Set maximum nesting depth of compound statements, iteration
\r
15699 control structures, and selection control structures (ISO C99 minimum is 63; ANSI
\r
15700 C89 minimum is 15).<span class=Flag><span style='font-size:10.5pt;font-family:
\r
15701 "Times New Roman"'> </span></span></p>
\r
15705 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15708 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15709 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15710 <p class=TextFontCX align=center
\r
15711 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15712 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15719 <p class=TextFontCX><span class=Flag><span
\r
15720 style='font-size:10.0pt'>string-literal-len</span></span><span
\r
15721 class=Flag><span style='font-size:10.0pt'> <i><number></i></span></span></p>
\r
15723 <p class=IndentText>Set maximum length of string literals (ISO C99 minimum is
\r
15724 4095; ANSI C89 minimum is 509).<span class=Flag><span style='font-size:10.5pt;
\r
15725 font-family:"Times New Roman"'> </span></span></p>
\r
15729 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15732 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15733 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15734 <p class=TextFontCX align=center
\r
15735 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15736 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15743 <p class=TextFontCX><span class=Flag><span
\r
15744 style='font-size:10.0pt'>num-struct-fields</span></span><span
\r
15745 class=Flag><span style='font-size:10.0pt'> <i><number></i></span></span></p>
\r
15747 <p class=IndentText>Set maximum number of fields in a <span class=CodeText><span
\r
15748 style='font-size:10.0pt'>struct</span></span> or <span class=CodeText><span
\r
15749 style='font-size:10.0pt'>union</span></span> (ISO C99 minimum is 1023; ANSI
\r
15750 minimum is 127).<span class=Flag><span style='font-size:10.5pt;font-family:
\r
15751 "Times New Roman"'> </span></span></p>
\r
15755 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15758 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15759 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15760 <p class=TextFontCX align=center
\r
15761 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15762 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15769 <p class=TextFontCX><span class=Flag><span
\r
15770 style='font-size:10.0pt'>num-enum-members</span></span><span
\r
15771 class=Flag><span style='font-size:10.0pt'> <i><number></i></span></span></p>
\r
15773 <p class=IndentText>Set maximum number of members of an <span class=CodeText><span
\r
15774 style='font-size:10.0pt'>enum</span></span> type (ISO C99 minimum is 1023; ANSI
\r
15775 minimum is 127).<span class=Flag><span style='font-size:10.5pt;font-family:
\r
15776 "Times New Roman"'> </span></span></p>
\r
15780 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15783 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15784 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15785 <p class=TextFontCX align=center
\r
15786 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15787 class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>
\r
15794 <p class=TextFontCX><span class=Flag><span
\r
15795 style='font-size:10.0pt'>include-nest</span></span><span
\r
15796 class=Flag><span style='font-size:10.0pt'> <i><number></i></span></span></p>
\r
15798 <p class=IndentText>Set maximum number of nested <span class=CodeText><span
\r
15799 style='font-size:10.0pt'>#include</span></span> files (ISO C99 minimum is 63; ANSI
\r
15800 minimum is 8).<span class=Flag><span style='font-size:10.5pt;font-family:"Times New Roman"'>
\r
15801 </span></span></p>
\r
15803 <p class=Heading10>Header Inclusion <a name="_Ref344793948"><span
\r
15804 class=TextFontCXChar><span style='font-size:11.0pt;
\r
15805 font-weight:normal'>(Section </span></span></a><span
\r
15806 class=TextFontCXChar><span style='font-size:11.0pt;
\r
15807 font-weight:normal'>14.3</span></span><span
\r
15808 class=TextFontCXChar><span style='font-size:11.0pt;
\r
15809 font-weight:normal'>)</span></span></p>
\r
15813 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15816 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15817 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15818 <p class=TextFontCX align=center
\r
15819 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15820 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
15827 <p class=TextFontCX><span class=Flag><span
\r
15828 style='font-size:10.0pt'>skip-iso-headers</span></span></p>
\r
15830 <p class=IndentText>Prevent inclusion of header files in a system directory with names that match standard ISO C99 headers. The symbolic information in the standard library is used instead. In effect only if a library that includes the standard library is used. The ISO C99 headers are: <span class=CodeText><span
\r
15831 style='font-size:10.0pt'>assert</span></span>, <span class=CodeText><span
\r
15832 style='font-size:10.0pt'>complex</span></span>, <span class=CodeText><span
\r
15833 style='font-size:10.0pt'>ctype</span></span>, <span class=CodeText><span
\r
15834 style='font-size:10.0pt'>errno</span></span>, <span class=CodeText><span
\r
15835 style='font-size:10.0pt'>fenv</span></span>, <span class=CodeText><span
\r
15836 style='font-size:10.0pt'>float</span></span>, <span class=CodeText><span
\r
15837 style='font-size:10.0pt'>inttypes</span></span>, <span class=CodeText><span
\r
15838 style='font-size:10.0pt'>iso646</span></span>, <span class=CodeText><span
\r
15839 style='font-size:10.0pt'>limits</span></span>, <span class=CodeText><span
\r
15840 style='font-size:10.0pt'>locale</span></span>, <span class=CodeText><span
\r
15841 style='font-size:10.0pt'>math</span></span>, <span class=CodeText><span
\r
15842 style='font-size:10.0pt'>setjmp</span></span>, <span class=CodeText><span
\r
15843 style='font-size:10.0pt'>signal</span></span>, <span class=CodeText><span
\r
15844 style='font-size:10.0pt'>stdarg</span></span>, <span class=CodeText><span
\r
15845 style='font-size:10.0pt'>stdbool</span></span>, <span class=CodeText><span
\r
15846 style='font-size:10.0pt'>stddef</span></span>, <span class=CodeText><span
\r
15847 style='font-size:10.0pt'>stdio</span></span>, <span class=CodeText><span
\r
15848 style='font-size:10.0pt'>stdlib</span></span>, <span class=CodeText><span
\r
15849 style='font-size:10.0pt'>string</span></span>, <span class=CodeText><span
\r
15850 style='font-size:10.0pt'>tgmath</span></span>, <span class=CodeText><span
\r
15851 style='font-size:10.0pt'>time</span></span>, <span class=CodeText><span
\r
15852 style='font-size:10.0pt'>wchar</span></span>, and <span class=CodeText><span
\r
15853 style='font-size:10.0pt'>wctype</span></span>.</p>
\r
15857 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15860 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15861 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15862 <p class=TextFontCX align=center
\r
15863 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15864 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
15871 <p class=TextFontCX><span class=Flag><span
\r
15872 style='font-size:10.0pt'>skip-posix-headers</span></span></p>
\r
15874 <p class=IndentText>Prevent inclusion of header files in a system directory
\r
15875 with names that match standard POSIX headers. The symbolic information in the
\r
15876 standard library is used instead. In effect only if a library that includes
\r
15877 the POSIX library is used. The skipped POSIX headers are: <span
\r
15878 class=CodeText><span style='font-size:10.0pt'>dirent</span></span>, <span
\r
15879 class=CodeText><span style='font-size:10.0pt'>fcntl</span></span>, <span
\r
15880 class=CodeText><span style='font-size:10.0pt'>grp</span></span>, <span
\r
15881 class=CodeText><span style='font-size:10.0pt'>pwd</span></span>, <span
\r
15882 class=CodeText><span style='font-size:10.0pt'>termios</span></span>, <span
\r
15883 class=CodeText><span style='font-size:10.0pt'>sys/stat</span></span>, <span
\r
15884 class=CodeText><span style='font-size:10.0pt'>sys/times</span></span>, <span
\r
15885 class=CodeText><span style='font-size:10.0pt'>sys/types</span></span>, <span
\r
15886 class=CodeText><span style='font-size:10.0pt'>sys/utsname</span></span>, <span
\r
15887 class=CodeText><span style='font-size:10.0pt'>sys/wait</span></span>, <span
\r
15888 class=CodeText><span style='font-size:10.0pt'>unistd</span></span>, and <span
\r
15889 class=CodeText><span style='font-size:10.0pt'>utime</span></span>. </p>
\r
15893 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15896 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15897 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15898 <p class=TextFontCX align=center
\r
15899 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15900 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
15907 <p class=TextFontCX><span class=Flag><span
\r
15908 style='font-size:10.0pt'>warn-posix-headers</span></span></p>
\r
15910 <p class=IndentText>Report use of a POSIX header when checking a program with a
\r
15911 non-POSIX library.</p>
\r
15913 <p class=IndentText> </p>
\r
15917 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15920 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15921 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15922 <p class=TextFontCX align=center
\r
15923 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15924 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
15931 <p class=TextFontCX><span class=Flag><span
\r
15932 style='font-size:10.0pt'>skip-sys-headers</span></span></p>
\r
15934 <p class=IndentText>Prevent inclusion of all header files in system
\r
15935 directories. </p>
\r
15939 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15942 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15943 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15944 <p class=TextFontCX align=center
\r
15945 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
15946 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
15953 <p class=TextFontCX><span class=Flag><span
\r
15954 style='font-size:10.0pt'>sys-dir-expand-macros</span></span></p>
\r
15956 <p class=IndentText>Expand macros in system directories regardless of other
\r
15957 settings, except for macros corresponding to names defined in a load library. </p>
\r
15961 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15964 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15965 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15966 <p class=TextFontCX align=center
\r
15967 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
15968 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
15975 <p class=TextFontCX><span class=Flag><span
\r
15976 style='font-size:10.0pt'>sys-dir-errors</span></span></p>
\r
15978 <p class=IndentText>Report errors in files in system directories (set by <span
\r
15979 class=Flag><span style='font-size:10.0pt'>-sys-dirs</span></span>). </p>
\r
15981 <p class=IndentText><span class=HeadingNote><span style='font-size:10.5pt;
\r
15982 font-style:normal'> </span></span></p>
\r
15986 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
15989 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
15990 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
15991 <p class=TextFontCX align=center
\r
15992 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>global:
\r
15993 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
16000 <p class=TextFontCX><span class=Flag><span
\r
16001 style='font-size:10.0pt'>single-include</span></span></p>
\r
16003 <p class=IndentText>Optimize header inclusion to only include each header file
\r
16008 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16011 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16012 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16013 <p class=TextFontCX align=center
\r
16014 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>global:
\r
16015 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
16022 <p class=TextFontCX><span class=Flag><span
\r
16023 style='font-size:10.0pt'>never-include</span></span></p>
\r
16025 <p class=IndentText>Use library information instead of including header files. </p>
\r
16027 <p class=Heading10>Comments</p>
\r
16029 <p class=beforelist>These flags control how syntactic comments are interpreted.</p>
\r
16033 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16036 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16037 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16038 <p class=TextFontCX align=center
\r
16039 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16040 </span><span class=Flag><span style='font-size:10.0pt'>@</span></span></p>
\r
16047 <p class=TextFontCX><span class=Flag><span
\r
16048 style='font-size:10.0pt'>comment-char </span></span><span
\r
16049 class=Flag><i><span style='font-size:10.0pt'><char></span></i></span></p>
\r
16051 <p class=IndentText>Set the marker character for syntactic comments. Comments
\r
16052 beginning with <span class=CodeText><span style='font-size:10.0pt'>/*</span></span><span
\r
16053 class=Flag><i><span style='font-size:10.0pt'><char></span></i></span> are
\r
16054 interpreted by Splint.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
16058 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16061 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16062 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16063 <p class=TextFontCX align=center
\r
16064 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16065 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
16072 <p class=TextFontCX><span class=Flag><span
\r
16073 style='font-size:10.0pt'>noaccess</span></span></p>
\r
16075 <p class=IndentText>Ignore access comments.</p>
\r
16079 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16082 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16083 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16084 <p class=TextFontCX align=center
\r
16085 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16086 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
16093 <p class=TextFontCX><span class=Flag><span
\r
16094 style='font-size:10.0pt'>nocomments</span></span></p>
\r
16096 <p class=IndentText>Ignore all stylized comments. </p>
\r
16100 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16103 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16104 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16105 <p class=TextFontCX align=center
\r
16106 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16107 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
16114 <p class=TextFontCX><span class=Flag><span
\r
16115 style='font-size:10.0pt'>sup-counts</span></span></p>
\r
16117 <p class=IndentText>Actual number of errors does not match number in <span
\r
16118 class=Annot><span style='font-size:10.0pt'>/*@i</span></span><span
\r
16119 class=Annot><span style='font-size:10.0pt'><n>@*/</span></span></p>
\r
16123 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16126 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16127 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16128 <p class=TextFontCX align=center
\r
16129 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16130 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
16137 <p class=TextFontCX><span class=Flag><span
\r
16138 style='font-size:10.0pt'>lint-comments</span></span></p>
\r
16140 <p class=IndentText>Interpret traditional lint comments (<span class=CodeText><span
\r
16141 style='font-size:10.0pt'>/*FALLTHROUGH*/</span></span>, <span class=CodeText><span
\r
16142 style='font-size:10.0pt'>/*NOTREACHED*/</span></span>, <span class=CodeText><span
\r
16143 style='font-size:10.0pt'>/*PRINTFLIKE*/</span></span>).</p>
\r
16147 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16150 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16151 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16152 <p class=TextFontCX align=center
\r
16153 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
16154 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
16161 <p class=TextFontCX><span class=Flag><span
\r
16162 style='font-size:10.0pt'>warn-lint-comments</span></span></p>
\r
16164 <p class=IndentText>Print a warning and suggest an alternative when a
\r
16165 traditional lint comment is used. </p>
\r
16169 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16172 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16173 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16174 <p class=TextFontCX align=center
\r
16175 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16183 <p class=TextFontCX><span class=Flag><span
\r
16184 style='font-size:10.0pt'>unrecog-comments</span></span></p>
\r
16186 <p class=IndentText>Stylized comment is unrecognized.</p>
\r
16188 <p class=Heading10>Parsing</p>
\r
16192 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16195 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16196 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16197 <p class=TextFontCX align=center
\r
16198 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16199 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
16206 <p class=TextFontCX><span class=Flag><span
\r
16207 style='font-size:10.0pt'>continue-comment</span></span></p>
\r
16209 <p class=IndentText>A line continuation marker (<span class=CodeText><span
\r
16210 style='font-size:10.0pt'>\</span></span>) appears inside a comment on the same
\r
16211 line as the comment close. Preprocessors should handle this correctly, but it
\r
16212 causes problems for some preprocessors.</p>
\r
16216 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16219 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16220 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16221 <p class=TextFontCX align=center
\r
16222 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16223 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
16230 <p class=TextFontCX><span class=Flag><span
\r
16231 style='font-size:10.0pt'>nest-comment</span></span></p>
\r
16233 <p class=IndentText>A comment open sequence (<span class=CodeText><span
\r
16234 style='font-size:10.0pt'>/*</span></span>) appears inside a comment. This
\r
16235 usually indicates that an earlier comment was not closed.</p>
\r
16239 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16242 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16243 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16244 <p class=TextFontCX align=center
\r
16245 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16253 <p class=TextFontCX><span class=Flag><span
\r
16254 style='font-size:10.0pt'>duplicate-quals</span></span></p>
\r
16256 <p class=IndentText>Report duplicate type qualifiers (e.g., <span
\r
16257 class=CodeText><span style='font-size:10.0pt'>unsigned unsigned</span></span>).</p>
\r
16261 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16264 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16265 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16266 <p class=TextFontCX align=center
\r
16267 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16268 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
16275 <p class=TextFontCX><span class=Flag><span
\r
16276 style='font-size:10.0pt'>gnu-extensions</span></span></p>
\r
16278 <p class=IndentText>Support some GNU and Microsoft language extensions.<span
\r
16279 class=Flag><span style='font-size:10.0pt'> </span></span></p>
\r
16281 <p class=Heading10>Parsing</p>
\r
16285 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16288 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16289 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16290 <p class=TextFontCX align=center
\r
16291 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16292 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
16299 <p class=TextFontCX><span class=Flag><span
\r
16300 style='font-size:10.0pt'>syntax</span></span></p>
\r
16302 <p class=IndentText>Parse error.<span class=Flag><span style='font-size:10.0pt'>
\r
16303 </span></span></p>
\r
16307 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
16310 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
16311 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
16312 <p class=TextFontCX align=center
\r
16313 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
16314 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
16321 <p class=TextFontCX><span class=Flag><span
\r
16322 style='font-size:10.0pt'>try-to-recover</span></span></p>
\r
16324 <p class=IndentText>Try to recover from a parse error. If <span class=Flag><span
\r
16325 style='font-size:10.0pt'>trytorecover</span></span> is not set, Splint will
\r
16326 abort checking after a parse error is detected. If it is set, Splint will
\r
16327 attempt to recover, but Splint does performs only minimal error recovery. It
\r
16328 is likely that trying to recover after a parse error will lead to an internal
\r
16329 assertion failing.</p>
\r
16331 <p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a
\r
16332 name="_Toc534975061">Flag Name Abbreviations</a></p>
\r
16334 <p class=beforelist>Within a flag name, abbreviations may be used. Figure 25 shows the flag name abbreviations. The expanded and short forms are interchangeable in flag names.</p>
\r
16339 <table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0
\r
16340 style='margin-left:99.9pt;border-collapse:collapse;margin-left:-2.25pt;
\r
16341 margin-right:-2.25pt'>
\r
16343 <td valign=top style='width:171.0pt;border:none;border-bottom:solid black 1.5pt;
\r
16344 padding:0in 5.4pt 0in 5.4pt'>
\r
16345 <p class=TextFontCX align=center
\r
16346 style='text-align:center'>Expanded Form</p>
\r
16348 <td valign=top style='width:67.5pt;border:none;border-bottom:solid black 1.5pt;
\r
16349 padding:0in 5.4pt 0in 5.4pt'>
\r
16350 <p class=TextFontCX align=center
\r
16351 style='text-align:center'>Short Form</p>
\r
16355 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16356 <p class=TextFontCX><span class=Flag><span
\r
16357 style='font-size:10.0pt'>constant</span></span></p>
\r
16359 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16360 <p class=TextFontCX><span class=Flag><span
\r
16361 style='font-size:10.0pt'>const</span></span></p>
\r
16365 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16366 <p class=TextFontCX><span class=Flag><span
\r
16367 style='font-size:10.0pt'>declaration</span></span></p>
\r
16369 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16370 <p class=TextFontCX><span class=Flag><span
\r
16371 style='font-size:10.0pt'>decl</span></span></p>
\r
16375 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16376 <p class=TextFontCX><span class=Flag><span
\r
16377 style='font-size:10.0pt'>function</span></span></p>
\r
16379 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16380 <p class=TextFontCX><span class=Flag><span
\r
16381 style='font-size:10.0pt'>fcn</span></span></p>
\r
16385 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16386 <p class=TextFontCX><span class=Flag><span
\r
16387 style='font-size:10.0pt'>global</span></span></p>
\r
16389 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16390 <p class=TextFontCX><span class=Flag><span
\r
16391 style='font-size:10.0pt'>glob</span></span></p>
\r
16395 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16396 <p class=TextFontCX><span class=Flag><span
\r
16397 style='font-size:10.0pt'>implicit</span></span><span class=Flag><span
\r
16398 style='font-size:10.0pt;font-family:"Times New Roman"'>, </span></span><span
\r
16399 class=Flag><span style='font-size:10.0pt'>implied</span></span></p>
\r
16401 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16402 <p class=TextFontCX><span class=Flag><span
\r
16403 style='font-size:10.0pt'>imp</span></span></p>
\r
16407 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16408 <p class=TextFontCX><span class=Flag><span
\r
16409 style='font-size:10.0pt'>iterator</span></span></p>
\r
16411 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16412 <p class=TextFontCX><span class=Flag><span
\r
16413 style='font-size:10.0pt'>iter</span></span></p>
\r
16417 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16418 <p class=TextFontCX><span class=Flag><span
\r
16419 style='font-size:10.0pt'>length</span></span></p>
\r
16421 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16422 <p class=TextFontCX><span class=Flag><span
\r
16423 style='font-size:10.0pt'>len</span></span></p>
\r
16427 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16428 <p class=TextFontCX><span class=Flag><span
\r
16429 style='font-size:10.0pt'>modifies</span></span></p>
\r
16431 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16432 <p class=TextFontCX><span class=Flag><span
\r
16433 style='font-size:10.0pt'>mods</span></span></p>
\r
16437 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16438 <p class=TextFontCX><span class=Flag><span
\r
16439 style='font-size:10.0pt'>modify</span></span></p>
\r
16441 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16442 <p class=TextFontCX><span class=Flag><span
\r
16443 style='font-size:10.0pt'>mod</span></span></p>
\r
16447 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16448 <p class=TextFontCX><span class=Flag><span
\r
16449 style='font-size:10.0pt'>memory</span></span></p>
\r
16451 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16452 <p class=TextFontCX><span class=Flag><span
\r
16453 style='font-size:10.0pt'>mem</span></span></p>
\r
16457 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16458 <p class=TextFontCX><span class=Flag><span
\r
16459 style='font-size:10.0pt'>parameter</span></span></p>
\r
16461 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16462 <p class=TextFontCX><span class=Flag><span
\r
16463 style='font-size:10.0pt'>param</span></span></p>
\r
16467 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16468 <p class=TextFontCX><span class=Flag><span
\r
16469 style='font-size:10.0pt'>pointer</span></span></p>
\r
16471 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16472 <p class=TextFontCX style='page-break-after:
\r
16473 avoid'><span class=Flag><span style='font-size:10.0pt'>ptr</span></span></p>
\r
16477 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16478 <p class=TextFontCX><span class=Flag><span
\r
16479 style='font-size:10.0pt'>return</span></span></p>
\r
16481 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16482 <p class=TextFontCX><span class=Flag><span
\r
16483 style='font-size:10.0pt'>ret</span></span></p>
\r
16487 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16488 <p class=TextFontCX><span class=Flag><span
\r
16489 style='font-size:10.0pt'>variable</span></span></p>
\r
16491 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16492 <p class=TextFontCX><span class=Flag><span
\r
16493 style='font-size:10.0pt'>var</span></span></p>
\r
16497 <td valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16498 <p class=TextFontCX><span class=Flag><span
\r
16499 style='font-size:10.0pt'>unconstrained, unconst</span></span></p>
\r
16501 <td valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
\r
16502 <p class=TextFontCX style='page-break-after:
\r
16503 avoid'><span class=Flag><span style='font-size:10.0pt'>uncon</span></span></p>
\r
16508 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0>
\r
16510 <td valign=top style='padding-top:.1in;padding-right:
\r
16511 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
\r
16512 <p class=MsoCaption><a name="_Toc534824627"></a><a name="_Ref534824456">Figure
\r
16513 25</a>. Flag Name Abbreviations</p>
\r
16519 <p class=beforelist>For example, <span class=Flag><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>
\r
16520 and <span class=Flag><span style='font-size:10.0pt'>globalsimpliesmodifiesnothing</span></span>
\r
16521 denote the same flag. Abbreviations in flag names allow pronounceable,
\r
16522 descriptive names to be used without making flag names excessively long
\r
16523 (although one must admit even <span class=Flag><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>
\r
16524 is a bit of a mouthful.)</p>
\r
16526 <p class=TextFontCX>To make flag names more
\r
16527 readable, the space, dash (<span class=Flag><span style='font-size:10.0pt'>-</span></span>),
\r
16528 and underscore (<span class=Flag><span style='font-size:10.0pt'>_</span></span>)
\r
16529 characters may be used inside a flag name. Hence, <span class=Flag><span
\r
16530 style='font-size:10.0pt'>globals-implies-modifies-nothing</span></span>, <span
\r
16531 class=Flag><span style='font-size:10.0pt'>glob_imps_modsnothing</span></span>
\r
16532 and <span class=Flag><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>
\r
16533 are equivalent.</p>
\r
16535 <p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a
\r
16536 name="_Toc534975062"></a><a name="_Ref348845752">Appendix C<span
\r
16537 style='font:7.0pt "Times New Roman"'>
\r
16538 </span>Annotations</a></p>
\r
16540 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
16541 name="_Toc534975063"></a><a name="_Ref348010146">Suppressin</a>g Warnings</p>
\r
16543 <p class=beforelist>Several annotations are provided for suppressing messages.
\r
16544 In general, it is usually better to use specific flags to suppress a particular
\r
16545 error permanently, but the general error suppression flags may be more
\r
16546 convenient for quickly suppressing messages for code that will be corrected or
\r
16547 documented later.<b><span style='font-size:10.5pt'> </span></b></p>
\r
16549 <p class=TextFontCX><span class=Flag><span
\r
16550 style='font-size:10.0pt'>ignore</span></span></p>
\r
16552 <p class=TextFontCX><span class=Flag><span
\r
16553 style='font-size:10.0pt'>end</span></span></p>
\r
16555 <p class=IndentText>No errors will be reported in code regions between <span
\r
16556 class=Annot><span style='font-size:10.0pt'>/*@ignore@*/</span></span> and <span
\r
16557 class=Annot><span style='font-size:10.0pt'>/*@end@*/</span></span>. These
\r
16558 comments can be used to easily suppress an unlimited number of messages, but
\r
16559 are dangerous since if real errors are introduced in the <span class=Flag><span
\r
16560 style='font-size:10.0pt'>ignore</span></span>
\85<span class=Flag><span
\r
16561 style='font-size:10.0pt'>end</span></span> region they will not be reported.
\r
16562 The <span class=Annot><span style='font-size:10.0pt'>ignore</span></span> and <span
\r
16563 class=Annot><span style='font-size:10.0pt'>end</span></span> comments must be
\r
16564 matched
\97 a warning is printed if the file ends in an ignore region or if <span
\r
16565 class=Flag><span style='font-size:10.0pt'>ignore</span></span> is used inside
\r
16566 ignore region.</p>
\r
16568 <p class=TextFontCX><span class=Flag><span
\r
16569 style='font-size:10.0pt'>i</span></span></p>
\r
16571 <p class=IndentText>No errors will be reported from an <span class=Annot><span
\r
16572 style='font-size:10.0pt'>/*@i@*/</span></span> comment to the end of the line.</p>
\r
16574 <p class=TextFontCX><span class=Flag><span
\r
16575 style='font-size:10.0pt'>i</span></span><span
\r
16576 class=Flag><span style='font-size:10.0pt'><i><n></i></span></span></p>
\r
16578 <p class=IndentText>No errors will be reported from an <span class=Annot><span
\r
16579 style='font-size:10.0pt'>/*@i<i><n></i>@*/</span></span> (e.g., <span
\r
16580 class=Annot><span style='font-size:10.0pt'>/*@i3@*/</span></span>) comment to
\r
16581 the end of the line. If there are not exactly <i>n </i>errors suppressed from
\r
16582 the comment point to the end of the line, Splint will report an error. This is
\r
16583 more robust than <span class=Annot><span style='font-size:10.0pt'>i</span></span>
\r
16584 or <span class=Annot><span style='font-size:10.0pt'>ignore</span></span> since
\r
16585 a message is generated if the expected number errors is not present. Since
\r
16586 errors are not necessarily detected until after this file is processed (for
\r
16587 example, and unused variable error), suppress count errors are reported after
\r
16588 all files have been processed. The <span class=Flag><span style='font-size:
\r
16589 10.0pt'>‑supcounts</span></span> flag may be used to suppress these
\r
16590 errors. This is useful when a system if being rechecked with different flag
\r
16593 <p class=TextFontCX><span class=Annot><span
\r
16594 style='font-size:10.0pt'>t</span></span></p>
\r
16596 <p class=TextFontCX><span class=Flag><span
\r
16597 style='font-size:10.0pt'>t<i><n></i></span></span></p>
\r
16599 <p class=IndentText>Like <span class=Annot><span style='font-size:10.0pt'>i</span></span>
\r
16600 and <span class=Annot><span style='font-size:10.0pt'>i<i><n></i></span></span>,
\r
16601 except controlled by <span class=Flag><span style='font-size:10.0pt'>+tmpcomments</span></span>
\r
16602 flag. These can be used to temporarily suppress certain errors. Then, <span
\r
16603 class=Flag><span style='font-size:10.0pt'>-tmpcomments</span></span> can be set
\r
16604 to find them again.</p>
\r
16606 <p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a
\r
16607 name="_Toc534975064">Syntactic Annotations</a></p>
\r
16609 <p class=TextFontCX>The grammar below is the C
\r
16610 syntax from [K&R,A13] modified to show the syntax of syntactic comments.
\r
16611 Only productions effected by Splint annotations are shown. In the annotations,
\r
16612 the <span class=Annot><span style='font-size:10.0pt'>@</span></span> represents
\r
16613 the comment marker char, set by <span class=Flag><span style='font-size:10.0pt'>-commentchar</span></span> (default is <span
\r
16614 class=Annot><span style='font-size:10.0pt'>@</span></span>).</p>
\r
16616 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
16617 name="_Toc534975065">Functions</a></p>
\r
16619 <p class=TextFontCX><i>direct-declarator </i><span
\r
16620 style='font-family:Symbol'>Þ</span><i> </i></p>
\r
16622 <p class=TextFontCX style='text-indent:.5in'><i>
\r
16623 direct-declarator </i><span class=Annot><span style='font-size:10.0pt'>(</span></span><i>
\r
16624 parameter-type-list<sub>opt</sub> </i><span class=Annot><span style='font-size:
\r
16625 10.0pt'>)</span></span><i> stateClause*<sub>opt</sub> globals<sub>opt</sub>
\r
16626 modifies<sub>opt</sub></i></p>
\r
16628 <p class=TextFontCX style='text-indent:.5in'><i>|
\r
16629 direct-declarator </i><span class=Annot><span style='font-size:10.0pt'>(</span></span><i>
\r
16630 identifier-list<sub>opt</sub> </i><span class=Annot><span style='font-size:
\r
16631 10.0pt'>)</span></span><i> stateClause*<sub>opt</sub> globals<sub>opt</sub>
\r
16632 modifies<sub>opt</sub></i></p>
\r
16634 <p class=TextFontCX><i> </i></p>
\r
16636 <p class=TextFontCX><i>stateClause </i><span
\r
16637 style='font-family:Symbol'>Þ</span><i> </i><span class=Annot><span
\r
16638 style='font-size:10.0pt'>/*@ </span></span>( <span class=Annot><span
\r
16639 style='font-size:10.0pt'>uses</span></span><i> | </i><span class=Annot><span
\r
16640 style='font-size:10.0pt'>sets</span></span><i> | </i><span class=Annot><span
\r
16641 style='font-size:10.0pt'>defines</span></span><i> | </i><span class=Annot><span
\r
16642 style='font-size:10.0pt'>allocates</span></span><i> | </i><span class=Annot><span
\r
16643 style='font-size:10.0pt'>releases</span></span>) <i>reference,<sup>+</sup> </i><span
\r
16644 class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub> </i><span
\r
16645 class=Annot><span style='font-size:10.0pt'>@*/</span></span></p>
\r
16647 <p class=TextFontCX align=right style='text-align:
\r
16648 right'><i> | </i><span class=Annot><span style='font-size:10.0pt'>/*@
\r
16649 </span></span>( <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>
\r
16650 | <span class=Annot><span style='font-size:10.0pt'>requires</span></span> ) <i>stateTag</i>
\r
16651 <i>reference,<sup>+</sup> </i><span class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub>
\r
16652 </i><span class=Annot><span style='font-size:10.0pt'>@*/ </span></span>(Section
\r
16655 <p class=TextFontCX><i> </i></p>
\r
16657 <p class=TextFontCX><i>stateTag </i><span
\r
16658 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
16659 10.0pt'>only</span></span><i> | </i><span class=Annot><span style='font-size:
\r
16660 10.0pt'>shared</span></span><i> | </i><span class=Annot><span style='font-size:
\r
16661 10.0pt'>owned </span></span><i>| </i><span class=Annot><span style='font-size:
\r
16662 10.0pt'>dependent</span></span><i> | </i><span class=Annot><span
\r
16663 style='font-size:10.0pt'>observer</span></span><i> | </i><span class=Annot><span
\r
16664 style='font-size:10.0pt'>exposed</span></span><i> | </i><span class=Annot><span
\r
16665 style='font-size:10.0pt'>isnull</span></span><i> | </i><span class=Annot><span
\r
16666 style='font-size:10.0pt'>notnull</span></span></p>
\r
16668 <p class=TextFontCX align=right style='text-align:
\r
16669 right;text-indent:.5in'><i> | identifier </i>(Annotation
\r
16670 defined by metastate definition, Section 10)</p>
\r
16672 <p class=TextFontCX style='text-indent:.5in'><i> </i></p>
\r
16674 <p class=TextFontCX><i>globals </i><span
\r
16675 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
16676 10.0pt'>/*@globals</span></span><i> globitem,<sup>+</sup> </i><span
\r
16677 class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub> </i><span
\r
16678 class=Annot><span style='font-size:10.0pt'>@*/ </span></span><i>| </i><span
\r
16679 class=Annot><span style='font-size:10.0pt'>/*@globals</span></span><i>
\r
16680 declaration-list<sub>opt </sub></i><span class=Annot><span style='font-size:
\r
16681 10.0pt'>;</span></span><i><sub> opt</sub></i><span class=Keyword><i><sub><span
\r
16682 style='font-size:10.5pt;font-family:"Times New Roman"'> </span></sub></i></span><span
\r
16683 class=Annot><span style='font-size:10.0pt'>@*/</span></span><span
\r
16684 class=Keyword><span style='font-size:10.0pt'> </span></span></p>
\r
16686 <p class=TextFontCX><i>globitem </i><span
\r
16687 style='font-family:Symbol'>Þ</span> [ ( <span class=Annot><span
\r
16688 style='font-size:10.0pt'>undef</span></span> | <span class=Annot><span
\r
16689 style='font-size:10.0pt'>killed </span></span>)* ] <span class=Keyword><i><sub><span
\r
16690 style='font-size:10.5pt;font-family:"Times New Roman"'> </span></sub></i></span><i> identifier
\r
16691 | </i><span class=Annot><span style='font-size:10.0pt'>internalState</span></span><span
\r
16692 class=Keyword><span style='font-size:10.0pt'> </span></span><i>| </i><span
\r
16693 class=Annot><span style='font-size:10.0pt'>fileSystem</span></span></p>
\r
16695 <p class=TextFontCX><i> </i></p>
\r
16697 <p class=TextFontCX><i>modifies </i><span
\r
16698 style='font-family:Symbol'>Þ</span><i> </i><span class=Annot><span
\r
16699 style='font-size:10.0pt'>/*@modifies</span></span><i> </i>(<span class=Annot><span
\r
16700 style='font-size:10.0pt'>nothing</span></span><i> | </i>(<i>expression </i>| <span
\r
16701 class=Annot><span style='font-size:10.0pt'>internalState</span></span> | <span
\r
16702 class=Annot><span style='font-size:10.0pt'>fileSystem</span></span>)<i><sup>+</sup></i><span
\r
16703 class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub> opt</sub></i>)
\r
16704 <span class=Annot><span style='font-size:10.0pt'>@*/</span></span><span
\r
16705 class=Keyword><span style='font-size:10.0pt'> </span></span></p>
\r
16707 <p class=TextFontCX align=right style='text-align:
\r
16708 right'><span class=Keyword><span style='font-size:10.0pt'> </span></span><i>|
\r
16709 </i><span class=Annot><span style='font-size:10.0pt'>/*@*/</span></span><span
\r
16710 class=Keyword><span style='font-size:10.0pt'> </span></span>(Abbreviation
\r
16711 for no globals and modifies nothing.)</p>
\r
16713 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
16714 name="_Toc534975066">Iterators </a><span
\r
16715 class=TextFontCXChar><span style='font-size:11.0pt;
\r
16716 font-weight:normal'>(Section 11.4)</span></span></p>
\r
16718 <p class=beforelist>The globals and modifies clauses for an iterator are the
\r
16719 same as those for a function, except they are not enclosed by a comment, since
\r
16720 the iterator is already a comment.</p>
\r
16722 <p class=TextFontCX><i>direct-declarator </i></p>
\r
16724 <p class=TextFontCX style='text-indent:.5in'><span
\r
16725 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
16726 10.0pt'>/*@iter</span></span><i> identifier </i><span class=Annot><span
\r
16727 style='font-size:10.0pt'>(</span></span><span class=Keyword><span
\r
16728 style='font-size:10.0pt'> </span></span><i>parameter-type-list<sub>opt</sub> </i><span
\r
16729 class=Annot><span style='font-size:10.0pt'>)</span></span><i> iterGlobals<sub>opt</sub>
\r
16730 iterModifies<sub>opt</sub> </i><span class=Annot><span style='font-size:10.0pt'>@*/</span></span></p>
\r
16732 <p class=TextFontCX><i> </i></p>
\r
16734 <p class=TextFontCX><i>iter-globals </i><span
\r
16735 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
16736 10.0pt'>globals</span></span><i> declaration-list<sub>opt </sub></i><span
\r
16737 class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>
\r
16739 <p class=TextFontCX><i>iter-modifies </i><span
\r
16740 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
16741 10.0pt'>modifies</span></span><i> moditem,+</i><span class=Keyword><span
\r
16742 style='font-size:10.0pt'> </span></span><span class=Annot><span
\r
16743 style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><span
\r
16744 class=Keyword><i><sub><span style='font-size:10.5pt;font-family:"Times New Roman"'>
\r
16745 </span></sub></i></span><i>| </i><span class=Annot><span style='font-size:10.0pt'> modifies
\r
16746 nothing</span></span><span class=Keyword><span style='font-size:10.0pt'> </span></span><span
\r
16747 class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>
\r
16749 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
16750 name="_Toc534975067">Constants </a><span
\r
16751 class=TextFontCXChar><span style='font-size:11.0pt;
\r
16752 font-weight:normal'>(Section 11.1)</span></span></p>
\r
16754 <p class=TextFontCX><i>external-declaration </i><span
\r
16755 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
16756 10.0pt'>/*@constant</span></span><i> declaration <sub> </sub></i><span
\r
16757 class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><span
\r
16758 class=Keyword><span style='font-size:10.0pt'> </span></span><span class=Annot><span
\r
16759 style='font-size:10.0pt'>@*/</span></span></p>
\r
16761 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
16762 name="_Toc534975068"></a><a name="_Ref344807420">Alternate Types</a> <span
\r
16763 class=TextFontCXChar><span style='font-size:11.0pt;
\r
16764 font-weight:normal'>(Section 4.4)</span></span></p>
\r
16766 <p class=beforelist>Alternate types may be used in the type specification of
\r
16767 parameters and return values.</p>
\r
16769 <p class=TextFontCX align=left style='text-align:
\r
16770 left'><i>extended-type</i><span style='font-family:Symbol'>Þ</span> <i>type-specifier
\r
16771 alt-type<sub> opt</sub></i><span class=Keyword><i><sub><span style='font-size:
\r
16772 10.5pt;font-family:"Times New Roman"'> </span></sub></i></span></p>
\r
16774 <p class=TextFontCX><i>alt-type </i><span
\r
16775 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
16776 10.0pt'>/*@alt</span></span><i> basic-type,<sup>+ </sup></i><span class=Annot><span
\r
16777 style='font-size:10.0pt'>@*/</span></span></p>
\r
16779 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
16780 name="_Toc534975069">Declarator Annotations</a></p>
\r
16782 <p class=TextFontCX>General annotations appear
\r
16783 after <i>storage-class-specifier</i>s and before <i>type-specifier</i>s.
\r
16784 Multiple annotations may be used in any order. Here, annotations are without
\r
16785 the surrounding comment. In a declaration, the annotation would be surrounded
\r
16786 by <span class=Annot><span style='font-size:10.0pt'>/*@</span></span> and <span
\r
16787 class=Annot><span style='font-size:10.0pt'>@*/</span></span>. In a globals or modifies clause or iterator or constant declaration, no surrounding comments
\r
16788 would be used since they are within a comment.</p>
\r
16790 <p class=Heading10 align=left style='text-align:left'>Type Definitions <span
\r
16791 class=TextFontCXChar><span style='font-size:11.0pt;
\r
16792 font-weight:normal'>(Section 4.3)</span></span></p>
\r
16794 <p class=beforelist>A type definition may use any either <span class=Annot><span
\r
16795 style='font-size:10.0pt'>abstract</span></span> or <span class=Annot><span style='font-size:10.0pt'>concrete</span></span>, either <span class=Annot><span style='font-size:10.0pt'>mutable</span></span> or <span class=Annot><span style='font-size:10.0pt'>immutable</span></span>, and <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>. Only a pointer to a <span class=Annot><span style='font-size:10.0pt'>struct</span></span>
\r
16796 may be declared with <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>.
\r
16797 Mutability annotations may not be used with concrete types since concrete types
\r
16798 inherit their mutability from the actual type.</p>
\r
16800 <p class=TextFontCX><span class=Annot><span
\r
16801 style='font-size:10.0pt'>abstract</span></span></p>
\r
16803 <p class=MsoNormal style='margin-left:13.5pt'>Type is abstraction
\r
16804 (representation is hidden from clients.)</p>
\r
16806 <p class=TextFontCX><span class=Annot><span
\r
16807 style='font-size:10.0pt'>concrete</span></span></p>
\r
16809 <p class=MsoNormal style='margin-left:13.5pt'>Type is concrete (representation
\r
16810 is visible to clients.)</p>
\r
16812 <p class=TextFontCX><span class=Annot><span
\r
16813 style='font-size:10.0pt'>immutable</span></span></p>
\r
16815 <p class=MsoNormal style='margin-left:13.5pt'>Instances of the type cannot
\r
16816 change value.<span class=Annot><span style='font-family:"Times New Roman"'> </span></span></p>
\r
16818 <p class=TextFontCX><span class=Annot><span
\r
16819 style='font-size:10.0pt'>mutable</span></span></p>
\r
16821 <p class=MsoNormal style='margin-left:13.5pt'>Instances of the type can change
\r
16822 value.<span class=Annot><span style='font-family:"Times New Roman"'> </span></span></p>
\r
16824 <p class=TextFontCX><span class=Annot><span
\r
16825 style='font-size:10.0pt'>refcounted</span></span></p>
\r
16827 <p class=IndentText>Reference counted (Section 5.4).</p>
\r
16829 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
16830 name="_Toc534975070">Type Access</a></p>
\r
16832 <p class=TextFontCX>Control comments may also be
\r
16833 used to override type access settings.<b><span style='font-size:10.5pt'> </span></b></p>
\r
16835 <p class=TextFontCX><span class=Annot><span
\r
16836 style='font-size:10.0pt'> </span></span></p>
\r
16838 <p class=TextFontCX><span class=Annot><span
\r
16839 style='font-size:10.0pt'>/*@access <i><type></i>,<sup>+</sup>@*/</span></span><span
\r
16840 class=Annot><span style='font-size:10.0pt'> </span></span></p>
\r
16842 <p class=IndentText>Allows the following code to access the representation of <span
\r
16843 class=Annot><i><span style='font-size:10.0pt'><type></span></i></span>.
\r
16844 Type access applies from the point of the comment to the end of the file or the
\r
16845 next access control comment for this type.</p>
\r
16847 <p class=TextFontCX><span class=Annot><span
\r
16848 style='font-size:10.0pt'>/*@noaccess </span></span><span
\r
16849 class=Annot><span style='font-size:10.0pt'><i><type></i>,<sup>+</sup>@*/ </span></span></p>
\r
16851 <p class=IndentText>Restricts access to the representation of <span
\r
16852 class=Annot><i><span style='font-size:10.0pt'><type></span></i></span>.
\r
16853 The type in a <span class=Annot><span style='font-size:10.0pt'>noaccess</span></span>
\r
16854 comment must have been declared as an abstract type. </p>
\r
16856 <p class=Heading10>Global Variables <span class=HeadingNote><span
\r
16857 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
16858 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
16859 normal'>7.2</span></span><span
\r
16860 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
16861 normal'>)</span></span></p>
\r
16863 <p class=beforelist>One check annotation may be used on a global or file-static variable declaration.</p>
\r
16865 <p class=TextFontCX><span class=Annot><span
\r
16866 style='font-size:10.0pt'>unchecked</span></span></p>
\r
16868 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16869 "Times New Roman"'>Weakest checking for global use.</span></span></p>
\r
16871 <p class=TextFontCX><span class=Annot><span
\r
16872 style='font-size:10.0pt'>checkmod</span></span></p>
\r
16874 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16875 "Times New Roman"'>Check modification by not use of global. </span></span></p>
\r
16877 <p class=TextFontCX><span class=Annot><span
\r
16878 style='font-size:10.0pt'>checked</span></span></p>
\r
16880 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16881 "Times New Roman"'>Check use and modification of global. </span></span></p>
\r
16883 <p class=TextFontCX><span class=Annot><span
\r
16884 style='font-size:10.0pt'>checkedstrict</span></span></p>
\r
16886 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16887 "Times New Roman"'>Check use of global, even in functions with no global list. </span></span></p>
\r
16889 <p class=Heading10>Memory Management <span class=HeadingNote><span
\r
16890 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
16891 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
16892 normal'>3</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
16893 font-weight:normal;font-style:normal'>)</span></span></p>
\r
16895 <p class=TextFontCX><span class=Annot><span
\r
16896 style='font-size:10.0pt'>dependent</span></span></p>
\r
16898 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16899 "Times New Roman"'>A reference to externally-owned storage. (Section </span></span><span
\r
16900 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span
\r
16901 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
16903 <p class=TextFontCX><span class=Annot><span
\r
16904 style='font-size:10.0pt'>keep</span></span></p>
\r
16906 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16907 "Times New Roman"'>A parameter that is kept by the called function. The caller
\r
16908 may use the storage after the call, but the called function is responsible for
\r
16909 making sure it is deallocated. (Section </span></span><span
\r
16910 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2.4</span></span><span
\r
16911 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
16913 <p class=TextFontCX><span class=Annot><span
\r
16914 style='font-size:10.0pt'>killref</span></span></p>
\r
16916 <p class=IndentText>A <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>
\r
16917 parameter. This reference is killed by the call. (Section 5.4)</p>
\r
16919 <p class=TextFontCX><span class=Annot><span
\r
16920 style='font-size:10.0pt'>only</span></span></p>
\r
16922 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16923 "Times New Roman"'>An unshared reference. Associated memory must be released
\r
16924 before reference is lost. (Section </span></span><span
\r
16925 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2</span></span><span
\r
16926 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span><span
\r
16927 class=Annot><span style='font-size:10.0pt'> </span></span></p>
\r
16929 <p class=TextFontCX><span class=Annot><span
\r
16930 style='font-size:10.0pt'>owned</span></span></p>
\r
16932 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16933 "Times New Roman"'>Storage may be shared by dependent references, but
\r
16934 associated memory must be released before this reference is lost. (Section </span></span><span
\r
16935 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span
\r
16936 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
16938 <p class=TextFontCX><span class=Annot><span
\r
16939 style='font-size:10.0pt'>shared</span></span></p>
\r
16941 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16942 "Times New Roman"'>Shared reference that is never deallocated. (Section </span></span><span
\r
16943 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2.5</span></span><span
\r
16944 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
16946 <p class=TextFontCX><span class=Annot><span
\r
16947 style='font-size:10.0pt'>temp</span></span></p>
\r
16949 <p class=IndentText>A temporary parameter. May not be released, and new
\r
16950 aliases to it may not be created. (Section 5.2.2)</p>
\r
16952 <p class=Heading10>Aliasing <span class=HeadingNote><span style='font-size:
\r
16953 10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
16954 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
16955 normal'>6</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
16956 font-weight:normal;font-style:normal'>)</span></span><span class=Annot><span
\r
16957 style='font-size:10.0pt'> </span></span></p>
\r
16959 <p class=beforelist>Both alias annotations may be used on a parameter
\r
16962 <p class=TextFontCX><span class=Annot><span
\r
16963 style='font-size:10.0pt'>unique</span></span></p>
\r
16965 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16966 "Times New Roman"'>Parameter that may not be aliased by any other reference
\r
16967 visible to the function. (Section </span></span><span
\r
16968 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>6.1.1</span></span><span
\r
16969 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
16971 <p class=TextFontCX><span class=Annot><span
\r
16972 style='font-size:10.0pt'>returned</span></span></p>
\r
16974 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16975 "Times New Roman"'>Parameter that may be aliased by the return value. (Section
\r
16976 </span></span><span
\r
16977 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>6.1.2</span></span><span
\r
16978 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
16980 <p class=Heading10>Exposure <span class=HeadingNote><span style='font-size:
\r
16981 10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
16982 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
16983 normal'>6.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
16984 font-weight:normal;font-style:normal'>)</span></span><span class=Annot><span
\r
16985 style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;
\r
16986 font-weight:normal'> </span></span></p>
\r
16988 <p class=TextFontCX><span class=Annot><span
\r
16989 style='font-size:10.0pt'>observer</span></span></p>
\r
16991 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
16992 "Times New Roman"'>Reference that cannot be modified. (Section </span></span><span
\r
16993 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>6.2.1</span></span><span
\r
16994 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
16996 <p class=TextFontCX><span class=Annot><span
\r
16997 style='font-size:10.0pt'>exposed</span></span></p>
\r
16999 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17000 "Times New Roman"'>Exposed reference to storage in another object. (Section </span></span><span
\r
17001 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>6.2</span></span><span
\r
17002 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
17004 <p class=Heading10>Definition State <span class=HeadingNote><span
\r
17005 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
17006 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
17007 normal'>3</span></span><span
\r
17008 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
17009 normal'>)</span></span><span class=Annot><span style='font-size:10.5pt;
\r
17010 font-family:"Times New Roman";letter-spacing:0pt;font-weight:normal'> </span></span></p>
\r
17012 <p class=TextFontCX><span class=Annot><span
\r
17013 style='font-size:10.0pt'>out</span></span></p>
\r
17015 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17016 "Times New Roman"'>Storage reachable from reference need not be defined.</span></span></p>
\r
17018 <p class=TextFontCX><span class=Annot><span
\r
17019 style='font-size:10.0pt'>in</span></span></p>
\r
17021 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17022 "Times New Roman"'>All storage reachable from reference must be defined.</span></span></p>
\r
17024 <p class=TextFontCX><span class=Annot><span
\r
17025 style='font-size:10.0pt'>partial</span></span></p>
\r
17027 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17028 "Times New Roman"'>Partially defined. A structure may have undefined fields.
\r
17029 No errors reported when fields are used.</span></span></p>
\r
17031 <p class=TextFontCX><span class=Annot><span
\r
17032 style='font-size:10.0pt'>reldef</span></span></p>
\r
17034 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17035 "Times New Roman"'>Relax definition checking. No errors when reference is not
\r
17036 defined, or when it is used.</span></span></p>
\r
17038 <p class=Heading10>Global State <span
\r
17039 class=TextFontCXChar><span style='font-size:11.0pt;
\r
17040 font-weight:normal'>(Section 7.2.2)</span></span></p>
\r
17042 <p class=TextFontCX>These annotations may only be
\r
17043 used in globals lists. Both annotations may be used for the same variable, to
\r
17044 mean the variable is undefined before and after the call.</p>
\r
17046 <p class=TextFontCX> </p>
\r
17048 <p class=TextFontCX><span class=Annot><span
\r
17049 style='font-size:10.0pt'>undef</span></span></p>
\r
17051 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17052 "Times New Roman"'>Variable is undefined before the call.</span></span></p>
\r
17054 <p class=TextFontCX><span class=Annot><span
\r
17055 style='font-size:10.0pt'>killed</span></span></p>
\r
17057 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17058 "Times New Roman"'>Variable is undefined after the call.</span></span></p>
\r
17060 <p class=Heading10>Null State <span class=HeadingNote><span style='font-size:
\r
17061 10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
17062 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
17063 normal'>2</span></span><span
\r
17064 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
17065 normal'>)</span></span><span class=Annot><span style='font-size:10.5pt;
\r
17066 font-family:"Times New Roman";letter-spacing:0pt;font-weight:normal'> </span></span></p>
\r
17068 <p class=TextFontCX><span class=Annot><span
\r
17069 style='font-size:10.0pt'>null</span></span></p>
\r
17071 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17072 "Times New Roman"'>Possibly null pointer.</span></span></p>
\r
17074 <p class=TextFontCX><span class=Annot><span
\r
17075 style='font-size:10.0pt'>notnull</span></span><span
\r
17076 class=Annot><span style='font-size:10.0pt'> </span></span></p>
\r
17078 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17079 "Times New Roman"'>Non-null pointer.</span></span></p>
\r
17081 <p class=TextFontCX><span class=Annot><span
\r
17082 style='font-size:10.0pt'>relnull</span></span></p>
\r
17084 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17085 "Times New Roman"'>Relax null checking. No errors when </span></span><span
\r
17086 class=CodeText><span style='font-size:10.0pt'>NULL</span></span><span
\r
17087 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'> is
\r
17088 assigned to it, or when it is used as a non-null pointer.</span></span></p>
\r
17090 <p class=Heading10>Null Predicates <span class=HeadingNote><span
\r
17091 style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
17092 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
17093 normal'>2.1.1</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
17094 font-weight:normal;font-style:normal'>)</span></span><span class=Annot><span
\r
17095 style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;
\r
17096 font-weight:normal'> </span></span></p>
\r
17098 <p class=beforelist>A null predicate annotation may be used of the return value
\r
17099 of a function returning a Boolean type, taking a possibly-null pointer for its
\r
17100 first argument.<span class=Annot><b><span style='font-size:10.5pt;font-family:
\r
17101 "Times New Roman"'> </span></b></span></p>
\r
17103 <p class=TextFontCX><span class=Annot><span
\r
17104 style='font-size:10.0pt'>nullwhentrue</span></span></p>
\r
17106 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17107 "Times New Roman"'>If result is true, first parameter is </span></span><span
\r
17108 class=CodeText><span style='font-size:10.0pt'>NULL</span></span><span
\r
17109 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
\r
17111 <p class=TextFontCX><span class=Annot><span
\r
17112 style='font-size:10.0pt'>falsewhennull</span></span></p>
\r
17114 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17115 "Times New Roman"'>If result is </span></span><span class=CodeText><span
\r
17116 style='font-size:10.0pt'>TRUE</span></span><span class=Annot><span
\r
17117 style='font-size:10.0pt;font-family:"Times New Roman"'>, first parameter is not
\r
17118 </span></span><span class=CodeText><span style='font-size:10.0pt'>NULL</span></span><span
\r
17119 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
\r
17121 <p class=Heading10>Execution <span class=HeadingNote><span style='font-size:
\r
17122 10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span
\r
17123 class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:
\r
17124 normal'>8.1</span></span><span class=HeadingNote><span style='font-size:10.5pt;
\r
17125 font-weight:normal;font-style:normal'>)</span></span><span class=Annot><span
\r
17126 style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;
\r
17127 font-weight:normal'> </span></span></p>
\r
17129 <p class=beforelist>The <span class=Annot><span style='font-size:10.0pt'>noreturn</span></span>,
\r
17130 <span class=Annot><span style='font-size:10.0pt'>maynotreturn</span></span> and
\r
17131 <span class=Annot><span style='font-size:10.0pt'>alwaysreturn</span></span>
\r
17132 annotations may be used on any function. The <span class=Annot><span
\r
17133 style='font-size:10.0pt'>noreturnwhentrue</span></span> and <span class=Annot><span
\r
17134 style='font-size:10.0pt'>noreturnwhenfalse</span></span> annotations may only
\r
17135 be used on functions whose first argument is a Boolean. </p>
\r
17137 <p class=TextFontCX><span class=Annot><span
\r
17138 style='font-size:10.0pt'>noreturn</span></span><span
\r
17139 class=Annot><span style='font-size:10.0pt'> </span></span></p>
\r
17141 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17142 "Times New Roman"'>Function never returns.</span></span></p>
\r
17144 <p class=TextFontCX><span class=Annot><span
\r
17145 style='font-size:10.0pt'>maynotreturn</span></span></p>
\r
17147 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17148 "Times New Roman"'>Function may or may not return.</span></span></p>
\r
17150 <p class=TextFontCX><span class=Annot><span
\r
17151 style='font-size:10.0pt'>noreturnwhentrue </span></span></p>
\r
17153 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17154 "Times New Roman"'>Function does not return if first parameter is </span></span><span
\r
17155 class=Keyword><span style='font-size:10.0pt'>TRUE</span></span><span
\r
17156 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
\r
17158 <p class=TextFontCX><span class=Annot><span
\r
17159 style='font-size:10.0pt'>noreturnwhenfalse </span></span></p>
\r
17161 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17162 "Times New Roman"'>Function does not return if first parameter if </span></span><span
\r
17163 class=Keyword><span style='font-size:10.0pt'>FALSE</span></span><span
\r
17164 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
\r
17166 <p class=TextFontCX><span class=Annot><span
\r
17167 style='font-size:10.0pt'>alwaysreturn</span></span></p>
\r
17169 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17170 "Times New Roman"'>Function always returns.</span></span></p>
\r
17172 <p class=Heading10>Side effects <span style='font-size:10.5pt;font-weight:
\r
17173 normal'>(Section 11.2.1)</span><span class=Annot><span style='font-size:10.5pt;
\r
17174 font-family:"Times New Roman";letter-spacing:0pt;font-weight:normal'> </span></span></p>
\r
17176 <p class=TextFontCX><span class=Annot><span
\r
17177 style='font-size:10.0pt'>sef</span></span></p>
\r
17179 <p class=IndentText><span
\r
17180 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>Corresponding
\r
17181 actual parameter has no side effects.</span></span></p>
\r
17183 <p class=Heading10>Declarations</p>
\r
17185 <p class=beforelist>These annotations can be used on a declaration to control unused or undefined error reporting.</p>
\r
17187 <p class=TextFontCX><span class=Annot><span
\r
17188 style='font-size:10.0pt'>unused</span></span></p>
\r
17190 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17191 "Times New Roman"'>Identifier need not be used (no unused errors reported.)
\r
17192 (Section </span></span><span
\r
17193 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>13.1</span></span><span
\r
17194 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
\r
17196 <p class=TextFontCX><span class=Annot><span
\r
17197 style='font-size:10.0pt'>external</span></span></p>
\r
17199 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17200 "Times New Roman"'>Identifier is defined externally (no undefined error
\r
17201 reported.) (Section </span></span><span
\r
17202 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>13.2</span></span><span
\r
17203 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>) </span></span></p>
\r
17205 <p class=Heading10>Switch Statements</p>
\r
17207 <p class=TextFontCX><span class=Annot><span
\r
17208 style='font-size:10.0pt'>fallthrough</span></span></p>
\r
17210 <p class=IndentText><span
\r
17211 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>Fall
\r
17212 through case. No message is reported if the previous case may fall through
\r
17213 into the one immediately after the </span></span><span class=Annot><span
\r
17214 style='font-size:10.0pt'>fallthrough</span></span><span class=Annot><span
\r
17215 style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
\r
17217 <p class=Heading10>Break and Continue Statements <span
\r
17218 class=TextFontCXChar><span style='font-size:11.0pt;
\r
17219 font-weight:normal'>(Section 8.3.3)</span></span><span
\r
17220 class=Annot><span style='font-size:10.5pt;font-family:"Times New Roman";
\r
17221 letter-spacing:0pt;font-weight:normal'> </span></span></p>
\r
17223 <p class=beforelist>These annotations are used before a <span class=CodeText><span
\r
17224 style='font-size:10.0pt'>break</span></span> or <span class=CodeText><span
\r
17225 style='font-size:10.0pt'>continue</span></span> statement.<span class=Annot><b><span
\r
17226 style='font-size:10.5pt;font-family:"Times New Roman"'> </span></b></span></p>
\r
17228 <p class=TextFontCX><span class=Annot><span
\r
17229 style='font-size:10.0pt'>innerbreak</span></span></p>
\r
17231 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17232 "Times New Roman"'>Break is breaking an inner loop or switch.</span></span></p>
\r
17234 <p class=TextFontCX><span class=Annot><span
\r
17235 style='font-size:10.0pt'>loopbreak</span></span></p>
\r
17237 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17238 "Times New Roman"'>Break is breaking a loop.</span></span></p>
\r
17240 <p class=TextFontCX><span class=Annot><span
\r
17241 style='font-size:10.0pt'>switchbreak</span></span></p>
\r
17243 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17244 "Times New Roman"'>Break is breaking a switch.</span></span></p>
\r
17246 <p class=TextFontCX><span class=Annot><span
\r
17247 style='font-size:10.0pt'>innercontinue</span></span><span
\r
17248 class=Annot><span style='font-size:10.0pt'><i> </i></span></span></p>
\r
17250 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17251 "Times New Roman"'>Continue is continuing an inner loop.</span></span></p>
\r
17253 <p class=Heading10>Unreachable Code</p>
\r
17255 <p class=beforelist>This annotation is used before a statement to prevent
\r
17256 unreachable code errors.</p>
\r
17258 <p class=TextFontCX><span class=Annot><span
\r
17259 style='font-size:10.0pt'>notreached</span></span></p>
\r
17261 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17262 "Times New Roman"'>Statement may be unreachable.</span></span></p>
\r
17264 <p class=Heading10>Format String Arguments </p>
\r
17266 <p class=beforelist>These annotations are used immediately before a function
\r
17269 <p class=TextFontCX><span class=Annot><span
\r
17270 style='font-size:10.0pt'>printflike</span></span></p>
\r
17272 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17273 "Times New Roman"'>Check variable arguments like </span></span><span
\r
17274 class=CodeText><span style='font-size:10.0pt'>printf</span></span><span
\r
17275 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>
\r
17276 library function. </span></span></p>
\r
17278 <p class=TextFontCX><span class=Annot><span
\r
17279 style='font-size:10.0pt'>scanflike</span></span></p>
\r
17281 <p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:
\r
17282 "Times New Roman"'>Check variable arguments like </span></span><span
\r
17283 class=CodeText><span style='font-size:10.0pt'>scanf</span></span><a
\r
17284 name="_Toc344355453"></a><a name="_Ref343091002"></a><a name="_Ref343065628"><span
\r
17285 class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>
\r
17286 library function.</span></span></a></p>
\r
17288 <p class=Heading10><a name="_Ref348789839">Use Warnings</a></p>
\r
17290 <p class=beforelist>These annotations are used immediately before a function,
\r
17291 variable or type declaration.<span class=Annot><b><span style='font-size:10.5pt;
\r
17292 font-family:"Times New Roman"'> </span></b></span></p>
\r
17294 <p class=TextFontCX><span class=Annot><span
\r
17295 style='font-size:10.0pt'>warn <i><flag-specifier></i> <i><message></i>
\r
17296 </span></span></p>
\r
17298 <p class=IndentText>Issue a warning (controlled by <span class=Flag><span
\r
17299 style='font-size:10.0pt'>flag-specifier</span></span>) where this declarator is
\r
17300 used.<span class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>
\r
17301 </span></span></p>
\r
17303 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
17304 name="_Toc534975071">Macro Expansion</a></p>
\r
17306 <p class=TextFontCX><a
\r
17307 href="mailto:/*@notfunction@*/"><span class=Annot><span style='font-size:10.0pt'>/*@notfunction@*/</span></span></a></p>
\r
17309 <p class=IndentText>The next macro definition is not intended to be a function,
\r
17310 and should be expanded in line instead of checked as a macro function
\r
17313 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
17314 name="_Toc534975072">Arbitrary Integral Types</a></p>
\r
17316 <p class=TextFontCX>These annotations are used to represent arbitrary integral types. Syntactically, they replace the implicit <span
\r
17317 class=Flag><span style='font-size:10.0pt'>int</span></span> type.</p>
\r
17319 <p class=TextFontCX> </p>
\r
17321 <p class=TextFontCX><span class=Annot><span
\r
17322 style='font-size:10.0pt'>/*@integraltype@*/</span></span></p>
\r
17324 <p class=IndentText>An arbitrary integral type. The actual type may be any one
\r
17325 of <span class=CodeText><span style='font-size:10.0pt'>short</span></span>, <span
\r
17326 class=CodeText><span style='font-size:10.0pt'>int</span></span>, <span
\r
17327 class=CodeText><span style='font-size:10.0pt'>long</span></span>, <span
\r
17328 class=CodeText><span style='font-size:10.0pt'>unsigned short</span></span>, <span
\r
17329 class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>, or <span
\r
17330 class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>. </p>
\r
17332 <p class=TextFontCX><span class=Annot><span
\r
17333 style='font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>
\r
17335 <p class=IndentText>An arbitrary unsigned integral type. The actual type may
\r
17336 be any one of <span class=CodeText><span style='font-size:10.0pt'>unsigned
\r
17337 short</span></span>, <span class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>,
\r
17338 or <span class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>.</p>
\r
17340 <p class=TextFontCX><span class=Annot><span
\r
17341 style='font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>
\r
17343 <p class=IndentText>An arbitrary signed integral type. The actual type may be
\r
17344 any one of <span class=CodeText><span style='font-size:10.0pt'>short</span></span>,
\r
17345 <span class=CodeText><span style='font-size:10.0pt'>int</span></span>, or <span
\r
17346 class=CodeText><span style='font-size:10.0pt'>long</span></span>. </p>
\r
17348 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
17349 name="_Toc534975073"></a><a name="_Ref347471625">Traditional Lint Comments</a></p>
\r
17351 <p class=TextFontCX>Some of the control comments supported by most standard UNIX lints are supported by Splint so legacy systems can be
\r
17352 checked more easily. These comments are not lexically consistent with Splint
\r
17353 comments, and their meanings are less precise (and may vary between different
\r
17354 lint programs), so we recommend that Splint comments are used instead except
\r
17355 for checking legacy systems already containing standard lint comments.</p>
\r
17357 <p class=TextFontCX> </p>
\r
17359 <p class=beforelist>These standard lint comments supported by Splint:</p>
\r
17361 <p class=TextFontCX><span class=Annot><span
\r
17362 style='font-size:10.0pt'>/*FALLTHROUGH*/ </span></span>(alternate misspelling, <span
\r
17363 class=Annot><span style='font-size:10.0pt'>/*FALLTHRU*/</span></span>)</p>
\r
17365 <p class=IndentText>Prevents errors for fall through cases. Same meaning as <span class=Annot><span style='font-size:10.0pt'>/*@fallthrough@*/</span></span>.</p>
\r
17367 <p class=MsoListBullet><span class=Annot><span style='font-size:10.0pt'>/*NOTREACHED*/</span></span></p>
\r
17369 <p class=IndentText>Prevents errors about unreachable code (until the end of the function). Same meaning as <span class=Annot><span style='font-size:10.0pt'>/*@notreached@*/</span></span>.
\r
17372 <p class=MsoListBullet><span class=Annot><span style='font-size:10.0pt'>/*PRINTFLIKE*/</span></span></p>
\r
17374 <p class=indentbefore>Arguments similar to the <span class=CodeText><span
\r
17375 style='font-size:10.0pt'>printf</span></span> library function (there didn
\92t
\r
17376 seem to be much of a consensus among standard lints as to exactly what this
\r
17377 means). Splint supports:</p>
\r
17379 <p class=IndentText><span class=Annot><span style='font-size:10.0pt'>/*@printflike@*/</span></span></p>
\r
17381 <p class=IndentText style='margin-left:.5in'>Function takes zero or more
\r
17382 arguments of any type, an unmodified <span class=CodeText><span
\r
17383 style='font-size:10.0pt'>char *</span></span> format string argument and zero
\r
17384 of more arguments of type and number dictated by the format string. Format
\r
17385 codes are interpreted identically to the <span class=CodeText><span
\r
17386 style='font-size:10.0pt'>printf</span></span> standard library function. May
\r
17387 return a result of any type. (Splint interprets <span class=Annot><span
\r
17388 style='font-size:10.0pt'>/*PRINTFLIKE*/</span></span> as <span class=Annot><span
\r
17389 style='font-size:10.0pt'>/*@printflike@*/</span></span>.)</p>
\r
17391 <p class=IndentText><span class=Annot><span style='font-size:10.0pt'>/*@scanflike@*/</span></span></p>
\r
17393 <p class=IndentText style='margin-left:.5in'>Like <span class=Annot><span
\r
17394 style='font-size:10.0pt'>printflike</span></span>, except format codes are interpreted
\r
17395 as in the <span class=CodeText><span style='font-size:10.0pt'>scanf</span></span>
\r
17396 library function.</p>
\r
17398 <p class=IndentText> </p>
\r
17400 <p class=MsoListBullet style='margin-left:0in;text-indent:0in'><span
\r
17401 class=Annot><span style='font-size:10.0pt'>/*ARGSUSED*/</span></span></p>
\r
17403 <p class=IndentText>Turns off unused parameter messages for this function. The
\r
17404 control comment, <span class=Annot><span style='font-size:10.0pt'>/*@‑paramuse</span></span><span class=Annot><span style='font-size:10.0pt'>@*/</span></span> can be used to the
\r
17405 same effect, or <span class=Annot><span style='font-size:10.0pt'>/*@unused@*/</span></span> can be used in individual parameter declarations.</p>
\r
17407 <p class=IndentText> </p>
\r
17409 <p class=TextFontCX>Splint will ignore standard
\r
17410 lint comments if <span class=Flag><span style='font-size:10.0pt'>-lint-comments</span></span>
\r
17411 is used. If <span class=Flag><span style='font-size:10.0pt'>+warn-lint-comments</span></span>
\r
17412 is used, Splint generates a message for standard lint comments and suggest
\r
17413 replacements<a name="_Ref348801565">.</a></p>
\r
17415 <p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a
\r
17416 name="_Toc534975074">Metastate Definitions</a></p>
\r
17418 <p class=TextFontCX>The grammar for <span
\r
17419 class=ProgramNameChar>.mts</span> files is shown below.</p>
\r
17421 <p class=MsoNormal> </p>
\r
17423 <p class=TextFontCX align=left style='margin-left:
\r
17424 .25in;text-align:left'><i><span lang=FR>metastate</span></i><span lang=FR> </span><span
\r
17425 style='font-family:Symbol'>Þ</span> <span lang=FR>[ </span><span class=Annot><span
\r
17426 style='font-size:10.0pt'>global </span></span><span lang=FR>] </span><span
\r
17427 class=Annot><span style='font-size:10.0pt'>attribute</span></span> <i><span
\r
17428 lang=FR>identifier clause* </span></i><span class=Annot><span style='font-size:
\r
17429 10.0pt'>end</span></span></p>
\r
17431 <p class=TextFontCX align=left style='margin-left:
\r
17432 .25in;text-align:left'><i><span lang=FR>clause</span></i><span lang=FR> </span><span
\r
17433 style='font-family:Symbol'>Þ</span> <i><span lang=FR>contextClause </span></i><span
\r
17434 lang=FR>| <i>valuesClause</i> | <i>defaultClause | defaultsClause</i></span></p>
\r
17436 <p class=TextFontCX align=left style='margin-left:
\r
17437 .75in;text-align:left;text-indent:.25in'><i><span lang=FR> </span></i><span
\r
17438 lang=FR>| <i>annotationsClause </i>| <i>mergeClause | transfersClause |
\r
17439 loserefClause</i></span></p>
\r
17441 <p class=TextFontCX align=left style='margin-left:
\r
17442 1.25in;text-align:left'><i><span lang=FR>| preconditionsClause |
\r
17443 postconditionsClause </span></i></p>
\r
17445 <p class=TextFontCX align=left style='margin-left:
\r
17446 .25in;text-align:left'><i><span lang=FR>contextClause</span></i><span
\r
17447 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
17448 10.0pt'>context</span></span> <i><span lang=FR>contextSelector</span></i></p>
\r
17450 <p class=TextFontCX align=left style='margin-left:
\r
17451 .25in;text-align:left'><i><span lang=FR>contextSelector </span></i><span
\r
17452 style='font-family:Symbol'>Þ</span> <span lang=FR>( </span><span class=Annot><span
\r
17453 style='font-size:10.0pt'>parameter</span></span><span lang=FR> | </span><span
\r
17454 class=Annot><span style='font-size:10.0pt'>reference</span></span><span
\r
17455 lang=FR> | </span><span class=Annot><span style='font-size:10.0pt'>result</span></span><span
\r
17456 lang=FR> | </span><span class=Annot><span style='font-size:10.0pt'>clause</span></span><span
\r
17457 lang=FR> | </span><span class=Annot><span style='font-size:10.0pt'>literal</span></span><span
\r
17458 lang=FR> | </span><span class=Annot><span style='font-size:10.0pt'>null</span></span><span
\r
17459 lang=FR> ) [ <i>type</i> ]</span></p>
\r
17461 <p class=TextFontCX align=left style='margin-left:
\r
17462 .25in;text-align:left'><i><span lang=FR>valuesClause</span></i><span
\r
17463 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
17464 10.0pt'>oneof</span></span> <i>valueChoice</i>,*</p>
\r
17466 <p class=TextFontCX align=left style='margin-left:
\r
17467 .25in;text-align:left'> </p>
\r
17469 <p class=TextFontCX align=left style='margin-left:
\r
17470 .25in;text-align:left'><i><span lang=FR>defaultClause </span></i><span
\r
17471 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
17472 10.0pt'>default</span></span> <i>valueChoide</i> </p>
\r
17474 <p class=TextFontCX align=left style='margin-left:
\r
17475 .25in;text-align:left'><i><span lang=FR>defaultsClause</span></i><span
\r
17476 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
17477 10.0pt'>defaults </span></span><span lang=FR>( <i>contextSelector</i> </span><span
\r
17478 class=Annot><span style='font-size:10.0pt'>==> </span></span><i>valueChoice</i><span
\r
17479 lang=FR> )*</span></p>
\r
17481 <p class=TextFontCX align=left style='margin-left:
\r
17482 .25in;text-align:left'><i><span lang=FR> </span></i></p>
\r
17484 <p class=TextFontCX align=left style='margin-left:
\r
17485 .25in;text-align:left'><i><span lang=FR>annotationsClause</span></i><span
\r
17486 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
17487 10.0pt'>annotations </span></span> ( <i>identifier </i>[ <i><span lang=FR>contextSelector
\r
17488 </span></i><span lang=FR>] </span><span class=Annot><span style='font-size:
\r
17489 10.0pt'>==> </span></span><i>valueChoice </i>)<i><span lang=FR>* </span></i></p>
\r
17491 <p class=TextFontCX align=left style='margin-left:
\r
17492 .25in;text-align:left'><i><span lang=FR> </span></i></p>
\r
17494 <p class=TextFontCX align=left style='margin-left:
\r
17495 .25in;text-align:left'><i><span lang=FR>mergeClause</span></i><span
\r
17496 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
17497 10.0pt'>merge </span></span>( <i>mergeItem </i><span class=Annot><span
\r
17498 style='font-size:10.0pt'>+ </span></span><i>mergeItem </i><span class=Annot><span
\r
17499 style='font-size:10.0pt'>==> </span></span><i>transferAction </i>)<i><span
\r
17500 lang=FR>*</span></i></p>
\r
17502 <p class=TextFontCX align=left style='margin-left:
\r
17503 .25in;text-align:left'><i><span lang=FR>mergeItem</span></i><span
\r
17504 style='font-family:Symbol'>Þ</span> <i>valueChoice | </i><span class=Annot><span
\r
17505 style='font-size:10.0pt'>*</span></span></p>
\r
17507 <p class=TextFontCX align=left style='margin-left:
\r
17508 .25in;text-align:left'><i><span lang=FR> </span></i></p>
\r
17510 <p class=TextFontCX align=left style='margin-left:
\r
17511 .25in;text-align:left'><i><span lang=FR>transfersClause</span></i><span
\r
17512 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
17513 10.0pt'>transfers </span></span>( <i>valueChoice </i><span class=Annot><span
\r
17514 style='font-size:10.0pt'>as </span></span><i>valueChoice</i><span class=Annot><span
\r
17515 style='font-size:10.0pt'> ==> </span></span><i>transferAction </i>)<i><span
\r
17516 lang=FR>*</span></i></p>
\r
17518 <p class=TextFontCX align=left style='margin-left:
\r
17519 .25in;text-align:left'><i><span lang=FR>loserefClause</span></i><span
\r
17520 style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:
\r
17521 10.0pt'>losereference </span></span>( <i>valueChoice </i><span class=Annot><span
\r
17522 style='font-size:10.0pt'>==> </span></span><i>errorAction </i>)<i><span
\r
17523 lang=FR>*</span></i></p>
\r
17525 <p class=TextFontCX align=left style='margin-left:
\r
17526 .25in;text-align:left'><i><span lang=FR> </span></i></p>
\r
17528 <p class=TextFontCX align=left style='margin-left:
\r
17529 .25in;text-align:left'><i><span lang=FR>transferAction</span></i><span
\r
17530 style='font-family:Symbol'>Þ</span> <i>valueChoice | errorAction </i></p>
\r
17532 <p class=TextFontCX align=left style='margin-left:
\r
17533 .25in;text-align:left'><i>errorAction</i><span style='font-family:Symbol'>Þ</span>
\r
17534 <span class=Annot><span style='font-size:10.0pt'>error</span></span> [ <i>stringLiteral</i>
\r
17537 <p class=TextFontCX align=left style='margin-left:
\r
17538 .25in;text-align:left'><i><span lang=FR> </span></i></p>
\r
17540 <p class=TextFontCX align=left style='margin-left:
\r
17541 .25in;text-align:left'><i><span lang=FR>valueChoice</span></i><span
\r
17542 style='font-family:Symbol'>Þ</span> <i>identifier</i> </p>
\r
17544 <p class=TextFontCX> </p>
\r
17546 <p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a
\r
17547 name="_Toc534975075"></a><a name="_Ref397875216"></a><a name="_Ref350066976"></a><a
\r
17548 name="_Ref348788300">Appendix D<span style='font:7.0pt "Times New Roman"'>
\r
17549 </span>Specifications</a></p>
\r
17551 <p class=TextFontCX>Another way of providing more
\r
17552 information about programs is to use formal specifications. Although this
\r
17553 document has largely ignored specifications, Splint was originally designed to
\r
17554 use the information in LCL specifications instead of source-code annotations.
\r
17555 This document focuses on annotations since it takes less effort to add
\r
17556 annotations to source code than to maintain an additional specification file.
\r
17557 Annotations can express everything that can be expressed in LCL specifications
\r
17558 that is relevant to Splint checking. However, LCL specifications can provide
\r
17559 more precise documentation on program interfaces than is possible with Splint
\r
17560 annotations. This appendix (extracted from [Evans94]) is a very brief introduction
\r
17561 to LCL Specifications. For more information, consult [GH93]. </p>
\r
17563 <p class=TextFontCX> </p>
\r
17565 <p class=TextFontCX>The Larch family of languages
\r
17566 is a two-tiered approach to formal specification. A specification is built
\r
17567 using two languages
\97 the <i>Larch Shared Language</i> (LSL), which is
\r
17568 independent of the implementation language, and a <i>Larch Interface Language</i>
\r
17569 designed for the specific implementation language. An LSL specification
\r
17570 defines <i>sorts</i>, analogous to abstract types in a programming language,
\r
17571 and <i>operators</i>, analogous to procedures. It expresses the underlying
\r
17572 semantics of an abstraction.</p>
\r
17574 <p class=TextFontCX> </p>
\r
17576 <p class=TextFontCX>The interface language
\r
17577 specifies an interface to an abstraction in a particular programming language.
\r
17578 It captures the details of the interface needed by a client using the
\r
17579 abstraction and places constraints on both correct implementations and uses of
\r
17580 the module. The semantics of the interface are described using primitives and
\r
17581 sorts and operators defined in LSL specifications. Interface languages have
\r
17582 been designed for several programming languages.</p>
\r
17584 <p class=TextFontCX> </p>
\r
17586 <p class=TextFontCX>LCL [GH93, Tan95] is a Larch
\r
17587 interface language for Standard C. LCL uses a C-like syntax. Traditionally, a
\r
17588 C module <span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;
\r
17589 color:windowtext'>M</span></i></span> consists of a source file, <span
\r
17590 class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span
\r
17591 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>,
\r
17592 and a header file, <span class=Keyword><i><span style='font-size:10.0pt;
\r
17593 font-family:Arial;color:windowtext'>M</span></i></span><span class=Keyword><span
\r
17594 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.
\r
17595 The header file contains prototype declarations for functions, variables and
\r
17596 constants exported by <span class=Keyword><i><span style='font-size:10.0pt;
\r
17597 font-family:Arial;color:windowtext'>M</span></i></span>, as well as those macro
\r
17598 definitions that implement exported functions or constants, and definitions of
\r
17599 exported types. When using LCL, a module includes two additional files
\97 <span
\r
17600 class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span
\r
17601 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>,
\r
17602 a formal specification of <span class=Keyword><i><span style='font-size:10.0pt;
\r
17603 font-family:Arial;color:windowtext'>M</span></i></span>, and <span
\r
17604 class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span
\r
17605 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>, which is derived by Splint (if the <span
\r
17606 class=Flag><span style='font-size:10.0pt'>lh</span></span> flag is on) from <span
\r
17607 class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span
\r
17608 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>.
\r
17609 Clients use <span class=Keyword><i><span style='font-size:10.0pt;font-family:
\r
17610 Arial;color:windowtext'>M</span></i></span><span class=Keyword><span
\r
17611 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
\r
17612 for documentation, and should not need to look at any implementation file. The
\r
17613 derived file, <span class=Keyword><i><span style='font-size:10.0pt;font-family:
\r
17614 Arial;color:windowtext'>M</span></i></span><span class=Keyword><span
\r
17615 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>,
\r
17616 contains include directives (if <span class=Keyword><i><span style='font-size:
\r
17617 10.0pt;font-family:Arial;color:windowtext'>M</span></i></span> depends on other
\r
17618 specified modules), prototypes of functions and declarations of variables as
\r
17619 specified in <span class=Keyword><i><span style='font-size:10.0pt;font-family:
\r
17620 Arial;color:windowtext'>M</span></i></span><span class=Keyword><span
\r
17621 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>.
\r
17622 The file <span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;
\r
17623 color:windowtext'>M</span></i></span><span class=Keyword><span
\r
17624 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
\r
17625 should include <span class=Keyword><i><span style='font-size:10.0pt;font-family:
\r
17626 Arial;color:windowtext'>M</span></i></span><span class=Keyword><span
\r
17627 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>
\r
17628 and retain the implementation aspects of the old <span class=Keyword><i><span
\r
17629 style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span
\r
17630 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>,
\r
17631 but is no longer used for c<a name="_Ref348845779">lient documentation.</a></p>
\r
17633 <p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a
\r
17634 name="_Toc534975076">Specification Flags</a></p>
\r
17636 <p class=TextFontCX>These flags are relevant only
\r
17637 when Splint is used with LCL specifications. </p>
\r
17639 <p class=Heading10>Global Flags</p>
\r
17641 <p class=TextFontCX><span class=Flag><span
\r
17642 style='font-size:10.0pt'>lcs</span></span></p>
\r
17644 <p class=IndentText>Generate <span class=Keyword><span style='font-size:10.0pt;
\r
17645 font-family:Arial;color:windowtext'>.lcs</span></span> files containing symbolic state of <span
\r
17646 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
\r
17647 files (used for imports). By default <span class=Keyword><span
\r
17648 style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcs</span></span>
\r
17649 files are generated for each <span class=Keyword><span style='font-size:10.0pt;
\r
17650 font-family:Arial;color:windowtext'>.lcl</span></span> file processed. Use <span
\r
17651 class=Flag><span style='font-size:10.0pt'>-lcs</span></span> to prevent
\r
17652 generation of <span class=Keyword><span style='font-size:10.0pt;font-family:
\r
17653 Arial;color:windowtext'>.lcs</span></span> files.</p>
\r
17655 <p class=TextFontCX><span class=Flag><span
\r
17656 style='font-size:10.0pt'>lh</span></span></p>
\r
17658 <p class=IndentText>Generate <span class=Keyword><span style='font-size:10.0pt;
\r
17659 font-family:Arial;color:windowtext'>.lh</span></span> files. By default, <span
\r
17660 class=Flag><span style='font-size:10.0pt'>-lh</span></span> is set and no <span
\r
17661 class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>
\r
17662 files are generated. Use <span class=Flag><span style='font-size:10.0pt'>+lh</span></span>
\r
17663 to enable <span class=Flag><span style='font-size:10.0pt'>.lh</span></span>
\r
17664 file generation. </p>
\r
17666 <p class=TextFontCX><span class=Flag><span
\r
17667 style='font-size:10.0pt'>i </span></span><span
\r
17668 class=Flag><span style='font-size:10.0pt'><file></span></span></p>
\r
17670 <p class=IndentText>Set LCL initialization file to <span class=Flag><i><span
\r
17671 style='font-size:10.0pt'><file></span></i></span>. The LCL
\r
17672 initialization file is read if any <span class=Keyword><span style='font-size:
\r
17673 10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span> files are listed
\r
17674 on the command line. The default file is <span class=Keyword><span
\r
17675 style='font-size:10.0pt;font-family:Arial;color:windowtext'>lclinit.lci</span></span>, found on the <span class=Keyword><span style='font-size:10.0pt;font-family:
\r
17676 Arial;color:windowtext'>LARCH_PATH</span></span>. </p>
\r
17678 <p class=TextFontCX><span class=Flag><span
\r
17679 style='font-size:10.0pt'>lclexpect </span></span><span
\r
17680 class=Flag><span style='font-size:10.0pt'><i><number></i></span></span></p>
\r
17682 <p class=IndentText>Exactly <span class=Flag><i><span style='font-size:10.0pt'><number></span></i></span>
\r
17683 specification errors are expected. Specification errors are errors detected
\r
17684 when checking the specifications. They do not depend on the source code.</p>
\r
17686 <p class=Heading10>Implicit Globals Checking Qualifiers</p>
\r
17690 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17693 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17694 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17695 <p class=TextFontCX align=center
\r
17696 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
17697 class=Keyword><span style='font-size:10.0pt'>-++-</span></span></p>
\r
17704 <p class=TextFontCX><span class=Flag><span
\r
17705 style='font-size:10.0pt'>imp-checked-spec-globs</span></span></p>
\r
17707 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span>
\r
17708 qualifier on global variables specified in an LCL file with no checking
\r
17713 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17716 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17717 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17718 <p class=TextFontCX align=center
\r
17719 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
17720 class=Keyword><span style='font-size:10.0pt'>----</span></span></p>
\r
17727 <p class=TextFontCX><span class=Flag><span
\r
17728 style='font-size:10.0pt'>imp-checkmod-spec-globs</span></span></p>
\r
17732 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17735 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17736 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17737 <p class=TextFontCX align=center
\r
17738 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
17739 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
17746 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checkmod</span></span>
\r
17747 qualifier on global variables specified in an LCL file with no checking
\r
17750 <p class=TextFontCX><span class=Flag><span
\r
17751 style='font-size:10.0pt'>imp-checkedstrict-spec-globs</span></span></p>
\r
17753 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span>
\r
17754 qualifier on global variables specified in an LCL file with no checking
\r
17759 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17762 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17763 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17764 <p class=TextFontCX align=center
\r
17765 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
17766 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
17773 <p class=Heading10>Implicit Annotations</p>
\r
17775 <p class=TextFontCX><span class=Flag><span
\r
17776 style='font-size:10.0pt'>spec-glob-imp-only</span></span></p>
\r
17778 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
17779 annotation on global variable declaration in an LCL file with no allocation
\r
17784 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17787 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17788 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17789 <p class=TextFontCX align=center
\r
17790 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
17791 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
17798 <p class=TextFontCX><span class=Flag><span
\r
17799 style='font-size:10.0pt'>spec-ret-imp-only</span></span></p>
\r
17801 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
17802 annotation on return value declaration in an LCL file with no allocation
\r
17807 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17810 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17811 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17812 <p class=TextFontCX align=center
\r
17813 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
17814 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
17821 <p class=TextFontCX><span class=Flag><span
\r
17822 style='font-size:10.0pt'>spec-struct-imp-only</span></span></p>
\r
17824 <p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>only</span></span>
\r
17825 annotation on structure field declarations in an LCL file with no allocation
\r
17830 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17833 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17834 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17835 <p class=TextFontCX align=center
\r
17836 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
17843 <p class=TextFontCX><span class=Flag><span
\r
17844 style='font-size:10.0pt'>spec-imp-only</span></span></p>
\r
17846 <p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>spec-glob-imp-only</span></span>,
\r
17847 <span class=Flag><span style='font-size:10.0pt'>spec-ret-imp-only</span></span>
\r
17848 and <span class=Flag><span style='font-size:10.0pt'>spec-struct-imp-only</span></span>.</p>
\r
17850 <p class=Heading10>Macro Expansion</p>
\r
17854 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17857 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17858 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17859 <p class=TextFontCX align=center
\r
17860 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
17861 </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>
\r
17868 <p class=TextFontCX><span class=Flag><span
\r
17869 style='font-size:10.0pt'>spec-macros</span></span></p>
\r
17871 <p class=IndentText>Macros defining specified identifiers are not expanded and
\r
17872 are checked according to the specification.<span class=Flag><span
\r
17873 style='font-size:10.0pt'> </span></span></p>
\r
17877 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17880 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17881 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17882 <p class=TextFontCX align=center
\r
17883 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
17884 class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>
\r
17891 <p class=Heading10>Complete Programs and Specifications</p>
\r
17893 <p class=TextFontCX><span class=Flag><span
\r
17894 style='font-size:10.0pt'>spec-undef</span></span></p>
\r
17896 <p class=IndentText>Function, variable, iterator or constant specified but
\r
17897 never defined.</p>
\r
17901 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17904 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17905 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17906 <p class=TextFontCX align=center
\r
17907 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
17908 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
17915 <p class=TextFontCX><span class=Flag><span
\r
17916 style='font-size:10.0pt'>spec-undecl</span></span></p>
\r
17918 <p class=IndentText>Function, variable, iterator or constant specified but
\r
17919 never declared.</p>
\r
17923 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17926 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17927 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17928 <p class=TextFontCX align=center
\r
17929 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:
\r
17930 </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>
\r
17937 <p class=TextFontCX><span class=Flag><span
\r
17938 style='font-size:10.0pt'>need-spec</span></span></p>
\r
17942 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17945 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17946 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17947 <p class=TextFontCX align=center
\r
17948 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>
\r
17955 <p class=IndentText>There is information in the specification that is not
\r
17956 duplicated in syntactic comments. Normally, this is not an error, but it may
\r
17957 be useful to detect it to make sure checking incomplete systems without the
\r
17958 specifications will still use this information.</p>
\r
17960 <p class=TextFontCX><span class=Flag><span
\r
17961 style='font-size:10.0pt'>export-any</span></span></p>
\r
17965 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17968 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17969 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17970 <p class=TextFontCX align=center
\r
17971 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
17972 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
17979 <p class=IndentText>An error is reported for any identifier that is exported
\r
17980 but not specified. (Sets all export flags below.)</p>
\r
17982 <p class=TextFontCX><span class=Flag><span
\r
17983 style='font-size:10.0pt'>export-const</span></span></p>
\r
17985 <p class=IndentText>Constant exported but not specified.</p>
\r
17989 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
17992 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
17993 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
17994 <p class=TextFontCX align=center
\r
17995 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
17996 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
18003 <p class=TextFontCX><span class=Flag><span
\r
18004 style='font-size:10.0pt'>export-var</span></span></p>
\r
18006 <p class=IndentText>Variable exported but not specified.</p>
\r
18010 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
18013 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
18014 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
18015 <p class=TextFontCX align=center
\r
18016 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
18017 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
18024 <p class=TextFontCX><span class=Flag><span
\r
18025 style='font-size:10.0pt'>export-fcn</span></span></p>
\r
18027 <p class=IndentText>Function exported but not specified.</p>
\r
18031 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
18034 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
18035 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
18036 <p class=TextFontCX align=center
\r
18037 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
18038 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
18045 <p class=TextFontCX><span class=Flag><span
\r
18046 style='font-size:10.0pt'>export-iter</span></span></p>
\r
18048 <p class=IndentText>Iterator exported but not specified.</p>
\r
18052 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
18055 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
18056 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
18057 <p class=TextFontCX align=center
\r
18058 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
18059 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
18066 <p class=TextFontCX><span class=Flag><span
\r
18067 style='font-size:10.0pt'>export-macro</span></span></p>
\r
18069 <p class=IndentText>An expanded macro exported but not specified</p>
\r
18073 <table cellspacing=0 cellpadding=0 hspace=0 vspace=0 height=14
\r
18076 <td valign=top align=left height=14 style='padding-top:0in;padding-right:
\r
18077 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
\r
18078 <p class=TextFontCX align=center
\r
18079 style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span
\r
18080 class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>
\r
18087 <p class=TextFontCX><span class=Flag><span
\r
18088 style='font-size:10.0pt'>export-type</span></span></p>
\r
18090 <p class=IndentText>Type definition exported but not specified </p>
\r
18092 <p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a
\r
18093 name="_Toc534975077"></a><a name="_Ref534642451"></a><a name="_Toc344355450">Appendix
\r
18094 E<span style='font:7.0pt "Times New Roman"'>
\r
18095 </span>Annotated Bibliography</a></p>
\r
18097 <h4 style='margin-left:0in;text-indent:0in'>Splint</h4>
\r
18099 <p class=TextFontCX>All of these papers are
\r
18100 available at <span style='font-size:10.0pt;font-family:Arial'><a
\r
18101 href="http://www.splint.org/publications/">http://www.splint.org/publications/</a></span>.
\r
18104 <p class=TextFontCX> </p>
\r
18106 <p class=TextFontCX align=left style='text-align:
\r
18107 left'>[Barker01] Chris Barker. <i>Static Error Checking of C Applications
\r
18108 Ported from UNIX to WIN32 Systems Using LCLint</i>. Senior Thesis, University
\r
18109 of Virginia Deptartment of Computer Science. May 2001.</p>
\r
18111 <p class=TextFontCX align=left style='text-align:
\r
18114 <p class=IndentText>Describes annotations and checks useful for porting
\r
18115 applications.</p>
\r
18117 <p class=TextFontCX align=left style='text-align:
\r
18120 <p class=TextFontCX align=left style='text-align:
\r
18121 left'>[Evans94] David Evans. <i>Using specifications to check source code</i>.
\r
18122 MIT/LCS/TR 628, Laboratory for Computer Science, MIT, June 1994.</p>
\r
18124 <p class=TextFontCX align=left style='text-align:
\r
18127 <p class=IndentText>MIT SM Thesis. Describes research behind Splint, focusing
\r
18128 on how specifications can be exploited to do lightweight checking. Includes
\r
18129 case studies using LCLint.</p>
\r
18131 <p class=TextFontCX align=left style='text-align:
\r
18134 <p class=TextFontCX align=left style='text-align:
\r
18135 left'>[EGHT94] David Evans, John Guttag, Jim Horning and Yang Meng Tan. <i>LCL</i><i>int:
\r
18136 A tool for using specifications to check code</i>. SIGSOFT Symposium on the
\r
18137 Foundations of Software Engineering, December 1994.</p>
\r
18139 <p class=TextFontCX align=left style='text-align:
\r
18142 <p class=IndentText>Somewhat obsolete introduction to LCLint. Shows how LCLint
\r
18143 is used to find errors in a sample program.</p>
\r
18145 <p class=TextFontCX align=left style='text-align:
\r
18148 <p class=TextFontCX align=left style='text-align:
\r
18149 left'>[Evans96] David Evans. <i>Static Detection of Dynamic Memory Errors</i>.
\r
18150 SIGPLAN Conference on Programming Language Design and Implementation (PLDI
\r
18151 \9296), Philadelphia, PA., May 1996.</p>
\r
18153 <p class=TextFontCX align=left style='text-align:
\r
18156 <p class=IndentText>Describes approach for exploiting annotations added to code
\r
18157 to detect a wide class of errors. Focuses on memory management checks
\r
18158 described in Section 5 of this manual. </p>
\r
18160 <p class=TextFontCX align=left style='text-align:
\r
18163 <p class=TextFontCX align=left style='text-align:
\r
18164 left'>[Evans00] David Evans. <i>Annotation-Assisted Lightweight Static
\r
18165 Checking. </i>First International Workshop on Automated Program Analysis,
\r
18166 Testing and Verification. February, 2000. </p>
\r
18168 <p class=IndentText> </p>
\r
18170 <p class=IndentText>Short position paper describing research agenda behind
\r
18173 <p class=IndentText style='margin-left:0in'> </p>
\r
18175 <p class=IndentText style='margin-left:0in'>[Evans02] David Evans and David
\r
18176 Larochelle. <i>Improving Security Using Extensible Lightweight Static Analysis</i>.
\r
18177 IEEE Software, Jan/Feb 2002.</p>
\r
18179 <p class=IndentText style='margin-left:0in'> </p>
\r
18181 <p class=IndentText>Most security attacks exploit instances of well-known
\r
18182 classes of implementations flaws. This article describes how Splint can be
\r
18183 used to detect common security vulnerabilities (including buffer overflows and
\r
18184 format string vulnerabilities).</p>
\r
18186 <p class=IndentText> </p>
\r
18188 <p class=IndentText style='margin-left:0in'>[Larochelle01] David Larochelle and
\r
18189 David Evans. Statically Detecting Likely Buffer Overflow Vulnerabilities.
\r
18190 2001 USENIX Security Symposium, Washington, D. C., August 13-17, 2001. </p>
\r
18192 <p class=IndentText> </p>
\r
18194 <p class=IndentText>Buffer overflow attacks may be today's single most
\r
18195 important security threat. This paper describes how Splint can be used to
\r
18196 detect likely vulnerabilities through an analysis of the program source code
\r
18197 and presents experience using our approach to detect buffer overflow
\r
18198 vulnerabilities in two security-sensitive programs.</p>
\r
18200 <p class=IndentText> </p>
\r
18202 <h4 style='margin-left:0in;text-indent:0in'>C</h4>
\r
18204 <p class=TextFontCX align=left style='text-align:
\r
18205 left'>[ISO99] International Standard ISO/IEC 9899. <i>Programming languages
\96\r
18206 C.</i> Second edition. December 1999.</p>
\r
18208 <p class=IndentText> </p>
\r
18210 <p class=IndentText>International standard specification for C programming
\r
18211 language. Approved by ANSI May 2000.</p>
\r
18213 <p class=TextFontCX align=left style='text-align:
\r
18216 <p class=TextFontCX align=left style='text-align:
\r
18217 left'>[KR88] Brian W. Kernighan and Dennis M. Ritchie. <i>The C Programming
\r
18218 Language</i>, second edition. Prentice Hall, New Jersey, 1988.</p>
\r
18220 <p class=TextFontCX align=left style='text-align:
\r
18223 <p class=IndentText>Standard reference for ANSI C. If you haven
\92t heard of
\r
18224 this one, you probably didn
\92t get this far (unless you started at the back).</p>
\r
18226 <p class=TextFontCX align=left style='text-align:
\r
18229 <p class=TextFontCX align=left style='text-align:
\r
18230 left'>[vdL94] Peter van der Linden. <i>Expert C Programming: Deep C Secrets</i>.
\r
18231 SunSoft Press, Prentice Hall, New Jersey, 1994.</p>
\r
18233 <p class=TextFontCX align=left style='text-align:
\r
18236 <p class=IndentText>Filled with useful information on the darker corners of C,
\r
18237 as well as lots of industry anecdotes and humor. Splint
\92s reserved name
\r
18238 checking is loosely based on the list of reserved names in this book.</p>
\r
18240 <h4 style='margin-left:0in;text-indent:0in'>Methodology</h4>
\r
18242 <p class=TextFontCX align=left style='text-align:
\r
18243 left'>[GH93] John Guttag and James Horning with Stephen J. Garland, Kevin D.
\r
18244 Jones, Andrés Modet, and Jeannette M. Wing. <i>Larch: Languages and Tools for
\r
18245 Formal Specification</i>. Springer-Verlag, Texts and Monographs in Computer
\r
18246 Science, 1993.</p>
\r
18248 <p class=IndentText> </p>
\r
18250 <p class=IndentText>Overview of the Larch family of specification languages and
\r
18251 related tools. Includes a chapter on LCL, the Larch C interface language, on
\r
18252 which Splint is based.</p>
\r
18254 <p class=IndentText style='margin-left:0in'> </p>
\r
18256 <p class=TextFontCX align=left style='text-align:
\r
18257 left'>[LG86] Barbara Liskov and John Guttag. <i>Abstraction and Specification
\r
18258 in Program Development</i>, MIT Press, Cambridge, MA, 1986.</p>
\r
18260 <p class=IndentText> </p>
\r
18262 <p class=IndentText>Describes a programming methodology using abstract types and specified interfaces. Much of the methodology upon which Splint is based comes
\r
18263 from this book. Uses the CLU programming language. </p>
\r
18265 <p class=IndentText> </p>
\r
18267 <p class=TextFontCX align=left style='text-align:
\r
18268 left'>[Liskov01] Barbara Liskov with John Guttag. <i>Program Development in
\r
18269 Java</i>, Addison Wesley, 2001.</p>
\r
18271 <p class=IndentText> </p>
\r
18273 <p class=IndentText>An updated version of [LG86] for the Java programming
\r
18276 <p class=IndentText> </p>
\r
18278 <p class=TextFontCX align=left style='text-align:
\r
18279 left'>[Tan95] Yang Meng Tan. <i>Formal Specification Techniques for
\r
18280 Engineering Modular C</i>. Kluwer International Series in Software
\r
18281 Engineering, Volume 1, Kluwer Academic Publishers, Boston, 1995.</p>
\r
18283 <p class=MsoNormal align=left style='text-align:left'> </p>
\r
18285 <p class=IndentText>Modified and updated version of MIT Ph D thesis, previously
\r
18286 published as MIT/LCS/TR-619, 1994. Includes presentation of the semantics of
\r
18287 LCL and a case study using LCL.</p>
\r
18289 <p class=IndentText style='margin-left:0in'> </p>
\r
18291 <h4 style='margin-left:0in;text-indent:0in'>Secure Programming</h4>
\r
18293 <p class=TextFontCX align=left style='text-align:
\r
18294 left'>[Hat95] Les Hatton. <i>Safer C: Developing Software for High-integrity
\r
18295 and Safety-critical Systems</i>. McGraw-Hill International Series in Software
\r
18296 Engineering, 1995.</p>
\r
18298 <p class=TextFontCX align=left style='text-align:
\r
18301 <p class=IndentText>A broad work on all aspects of developing safety-critical
\r
18302 software, focusing on the C language. Provides good justification for the use
\r
18303 of C in safety-critical systems, and the necessity of tool-supported programming
\r
18304 standards. Splint users will be interested to see how many of the errors
\r
18305 listed as only being dynamically detectable can be detected statically by
\r
18308 <p class=IndentText style='margin-left:0in'> </p>
\r
18310 <p class=IndentText style='margin-left:0in'>[VM02] John Viega and Gary McGraw.
\r
18311 <i>Building Secure Software: How to Avoid Security Problems the </i><i>Right
\r
18312 Way</i><i>.</i> Addison-Wesley, 2002.</p>
\r
18314 <p class=IndentText>A comprehensive survey of techniques and principles for
\r
18315 building secure programs.</p>
\r
18317 <p class=IndentText style='margin-left:0in'> </p>
\r
18319 <p class=IndentText style='margin-left:0in'>See also [Evans02] and
\r
18320 [Larochelle01].</p>
\r
18324 <span style='font-size:11.0pt;font-family:"Times New Roman"'><br clear=all
\r
18325 style='page-break-before:right'>
\r
18328 <div class=Section6>
\r
18330 <p class=Appendix><a name="_Toc534975078">Index</a></p>
\r
18332 <p class=IndentText></p>
\r
18336 <span style='font-size:11.0pt;font-family:"Times New Roman"'><br clear=all
\r
18337 style='page-break-before:auto'>
\r
18340 <div class=Section7>
\r
18342 <p class=MsoIndex1>.splintrc, 73</p>
\r
18344 <p class=MsoIndex1>/*@*/, 36</p>
\r
18346 <p class=MsoIndex1>@, 12, 95, 97</p>
\r
18348 <p class=MsoIndex1>abstract types, 15, <b>21</b>, 22, 24, 31, 32, 33, 39, 58,
\r
18349 60, 61, 66, 78, 80, 87, 88, 99, 104, 108</p>
\r
18351 <p class=MsoIndex1>access control, 22</p>
\r
18353 <p class=MsoIndex1>aliasing, 9, 27, 31, 82, 85, 99</p>
\r
18355 <p class=MsoIndex1>alternate types, 48, 75, 98</p>
\r
18357 <p class=MsoIndex1>annotations, 9, 10, <b>13</b>, 26, 27, 42, 97, 98</p>
\r
18359 <p class=MsoIndex2>abstract, 21, 30, 80, 98</p>
\r
18361 <p class=MsoIndex2>access, 23, 99</p>
\r
18363 <p class=MsoIndex2>allocates, 39</p>
\r
18365 <p class=MsoIndex2>alt, 57, 92</p>
\r
18367 <p class=MsoIndex2>checked, 37, 67, 85, 99</p>
\r
18369 <p class=MsoIndex2>checkedstrict, 37, 67, 84, 85, 99</p>
\r
18371 <p class=MsoIndex2>checkmod, 37, 85, 99</p>
\r
18373 <p class=MsoIndex2>concrete, 80, 98</p>
\r
18375 <p class=MsoIndex2>constant, 86</p>
\r
18377 <p class=MsoIndex2>defines, 39</p>
\r
18379 <p class=MsoIndex2>dependent, <b>27</b>, 42, 81, 99</p>
\r
18381 <p class=MsoIndex2>end, 97</p>
\r
18383 <p class=MsoIndex2>exits, 43, 100</p>
\r
18385 <p class=MsoIndex2>exposed, <b>33</b>, 81, 100</p>
\r
18387 <p class=MsoIndex2>external, 65, 101</p>
\r
18389 <p class=MsoIndex2>fallthrough, 46, 101, 102</p>
\r
18391 <p class=MsoIndex2>falseexit, 43</p>
\r
18393 <p class=MsoIndex2>falsenull, 14, 100</p>
\r
18395 <p class=MsoIndex2>falsewhennull, 14</p>
\r
18397 <p class=MsoIndex2>fileSystem, 36</p>
\r
18399 <p class=MsoIndex2>i, 97</p>
\r
18401 <p class=MsoIndex2>i<n>, 95, 97</p>
\r
18403 <p class=MsoIndex2>ignore, 97</p>
\r
18405 <p class=MsoIndex2>immutable, 23, 98</p>
\r
18407 <p class=MsoIndex2>implicit, 29</p>
\r
18409 <p class=MsoIndex2>in, <b>17</b>, 100</p>
\r
18411 <p class=MsoIndex2>innerbreak, 46, 91, 101</p>
\r
18413 <p class=MsoIndex2>innercontinue, 47, 91, 101</p>
\r
18415 <p class=MsoIndex2>integraltype, 20, 102</p>
\r
18417 <p class=MsoIndex2>internalState, 36, 57</p>
\r
18419 <p class=MsoIndex2>iter, 58, 59, 86, 89</p>
\r
18421 <p class=MsoIndex2>keep, <b>28</b>, 81, 99</p>
\r
18423 <p class=MsoIndex2>killed, 38, 100</p>
\r
18425 <p class=MsoIndex2>killref, 99</p>
\r
18427 <p class=MsoIndex2>loopbreak, 46, 47, 91, 101</p>
\r
18429 <p class=MsoIndex2>misscase, 46</p>
\r
18431 <p class=MsoIndex2>mutable, 23, 98</p>
\r
18433 <p class=MsoIndex2>neverexit, 101</p>
\r
18435 <p class=MsoIndex2>noaccess, 23, 99</p>
\r
18437 <p class=MsoIndex2>notfunction, 58, 68, 86, 102</p>
\r
18439 <p class=MsoIndex2>nothing, 36</p>
\r
18441 <p class=MsoIndex2>notnull, 15, 100</p>
\r
18443 <p class=MsoIndex2>notreached, 101, 102</p>
\r
18445 <p class=MsoIndex2>null, 14, 27, 55, 100</p>
\r
18447 <p class=MsoIndex2>nullwhentrue, 14</p>
\r
18449 <p class=MsoIndex2>observer, 33, 81, 83, 99</p>
\r
18451 <p class=MsoIndex2>only, <b>26</b>, 31, 38, 40, 42, 81, 82, 99</p>
\r
18453 <p class=MsoIndex2>out, <b>17</b>, 100</p>
\r
18455 <p class=MsoIndex2>owned, <b>27</b>, 42, 81, 99</p>
\r
18457 <p class=MsoIndex2>partial, <b>18</b>, 100</p>
\r
18459 <p class=MsoIndex2>printflike, 101, 102</p>
\r
18461 <p class=MsoIndex2>refcounted, <b>30</b>, 98</p>
\r
18463 <p class=MsoIndex2>refs, <b>30</b></p>
\r
18465 <p class=MsoIndex2>reldef, <b>18</b>, 100</p>
\r
18467 <p class=MsoIndex2>releases, 40</p>
\r
18469 <p class=MsoIndex2>relnull, 15, 100</p>
\r
18471 <p class=MsoIndex2>returned, 31, 99</p>
\r
18473 <p class=MsoIndex2>scanflike, 101, 102</p>
\r
18475 <p class=MsoIndex2>sef, 56, 87, 101</p>
\r
18477 <p class=MsoIndex2>sets, 39</p>
\r
18479 <p class=MsoIndex2>shared, <b>28</b>, 42, 81, 99</p>
\r
18481 <p class=MsoIndex2>signedintegraltype, 20, 102</p>
\r
18483 <p class=MsoIndex2>switchbreak, 46, 91, 101</p>
\r
18485 <p class=MsoIndex2>t, 97</p>
\r
18487 <p class=MsoIndex2>t<n>, 97</p>
\r
18489 <p class=MsoIndex2>temp, <b>27</b>, 81, 82, 83, 99</p>
\r
18491 <p class=MsoIndex2>trueexit, 43</p>
\r
18493 <p class=MsoIndex2>truenull, 14, 100</p>
\r
18495 <p class=MsoIndex2>unchecked, 37, 67, 84, 85, 99</p>
\r
18497 <p class=MsoIndex2>undef, 38, 100</p>
\r
18499 <p class=MsoIndex2>unique, 31, 99</p>
\r
18501 <p class=MsoIndex2>unsignedintegraltype, 20, 102</p>
\r
18503 <p class=MsoIndex2>unused, 65, 101, 102</p>
\r
18505 <p class=MsoIndex2>uses, 39</p>
\r
18507 <p class=MsoIndex2>warnuse, 101</p>
\r
18509 <p class=MsoIndex2>yield, 58</p>
\r
18511 <p class=MsoIndex1>ARGSUSED, 102</p>
\r
18513 <p class=MsoIndex1>assert, 43, 67</p>
\r
18515 <p class=MsoIndex1>bool, <b>20</b>, 43, 67, 77, 79, 92, 100</p>
\r
18517 <p class=MsoIndex1>break statements, 46, 91, 101</p>
\r
18519 <p class=MsoIndex1>char, 79</p>
\r
18521 <p class=MsoIndex1>characters, 19</p>
\r
18523 <p class=MsoIndex1>CLU, 25</p>
\r
18525 <p class=MsoIndex1>comparisons, 78</p>
\r
18527 <p class=MsoIndex1>complete logic, 47</p>
\r
18529 <p class=MsoIndex1>complete programs, <b>65</b>, 92, 105</p>
\r
18531 <p class=MsoIndex1>continue statements, 46, 101</p>
\r
18533 <p class=MsoIndex1>control comments, 13</p>
\r
18535 <p class=MsoIndex1>control flow, <b>43</b>, 100</p>
\r
18537 <p class=MsoIndex1>control nesting depth, 94</p>
\r
18539 <p class=MsoIndex1>control structures, 90</p>
\r
18541 <p class=MsoIndex1>czechmacros, 61</p>
\r
18543 <p class=MsoIndex1>declarations, 38, 85, 101</p>
\r
18545 <p class=MsoIndex1>distinct names, 63, 90</p>
\r
18547 <p class=MsoIndex1>enumerators, 19, 94</p>
\r
18549 <p class=MsoIndex1>environment variables</p>
\r
18551 <p class=MsoIndex2>LARCH_PATH, 73</p>
\r
18553 <p class=MsoIndex2>LCLIMPORTDIR, 73</p>
\r
18555 <p class=MsoIndex1>errno, 67</p>
\r
18557 <p class=MsoIndex1>evaluation order, 90</p>
\r
18559 <p class=MsoIndex1>exit, 93</p>
\r
18561 <p class=MsoIndex1>exit status, 75</p>
\r
18563 <p class=MsoIndex1>expected errors, 75</p>
\r
18565 <p class=MsoIndex1>exported declarations, 65</p>
\r
18567 <p class=MsoIndex1>exports, 93</p>
\r
18569 <p class=MsoIndex1>exposure, 83, 99</p>
\r
18571 <p class=MsoIndex1>external names, 65, 90</p>
\r
18573 <p class=MsoIndex1>fall through cases, 9, 46, 101, 102</p>
\r
18575 <p class=MsoIndex1>FALLTHROUGH, 95, 102</p>
\r
18577 <p class=MsoIndex1>fileSystem, 36, 84</p>
\r
18579 <p class=MsoIndex1>flag name abbreviations, 95</p>
\r
18581 <p class=MsoIndex1>flags, 10, 11, <b>12</b></p>
\r
18583 <p class=MsoIndex2>abstract, 79</p>
\r
18585 <p class=MsoIndex2>accessczech, 60, 61, 80, 87</p>
\r
18587 <p class=MsoIndex2>accessczechoslovak, 80, 88</p>
\r
18589 <p class=MsoIndex2>accessfile, 23, 80</p>
\r
18591 <p class=MsoIndex2>accessfunction, 23</p>
\r
18593 <p class=MsoIndex2>accessmodule, 23, 80</p>
\r
18595 <p class=MsoIndex2>accesssall, 80</p>
\r
18597 <p class=MsoIndex2>accessslovak, 61, 80, 87</p>
\r
18599 <p class=MsoIndex2>aliasunique, 82</p>
\r
18601 <p class=MsoIndex2>allblock, 91</p>
\r
18603 <p class=MsoIndex2>allempty, 91</p>
\r
18605 <p class=MsoIndex2>allglobs, 84</p>
\r
18607 <p class=MsoIndex2>allimponly, 29</p>
\r
18609 <p class=MsoIndex2>allmacros, 57, 68, 86</p>
\r
18611 <p class=MsoIndex2>ansilib, 74</p>
\r
18613 <p class=MsoIndex2>ansilimits, 94</p>
\r
18615 <p class=MsoIndex2>ansireserved, 63, 89</p>
\r
18617 <p class=MsoIndex2>ansireservedinternal, 63, 89</p>
\r
18619 <p class=MsoIndex2>ansistrict, 66</p>
\r
18621 <p class=MsoIndex2>array parameters, 78</p>
\r
18623 <p class=MsoIndex2>assignexpose, 32, 83</p>
\r
18625 <p class=MsoIndex2>bitwisesigned, 77</p>
\r
18627 <p class=MsoIndex2>bool, 77</p>
\r
18629 <p class=MsoIndex2>boolcompare, 78</p>
\r
18631 <p class=MsoIndex2>boolfalse, 21, 77</p>
\r
18633 <p class=MsoIndex2>boolint, 13, 79</p>
\r
18635 <p class=MsoIndex2>booltrue, 21, 77</p>
\r
18637 <p class=MsoIndex2>booltype, 20, 77</p>
\r
18639 <p class=MsoIndex2>branchstate, 80</p>
\r
18641 <p class=MsoIndex2>casebreak, 46, 91</p>
\r
18643 <p class=MsoIndex2>castexpose, 32, 83</p>
\r
18645 <p class=MsoIndex2>castfcnptr, 78</p>
\r
18647 <p class=MsoIndex2>charindex, 19, 79</p>
\r
18649 <p class=MsoIndex2>charint, 13, 19, 79</p>
\r
18651 <p class=MsoIndex2>charintliteral, 79</p>
\r
18653 <p class=MsoIndex2>checkedglobalias, 85</p>
\r
18655 <p class=MsoIndex2>checkmodglobalias, 85</p>
\r
18657 <p class=MsoIndex2><i>checks</i>, 36, 76</p>
\r
18659 <p class=MsoIndex2>checkstrictglobalias, 85</p>
\r
18661 <p class=MsoIndex2>checkstrictglobs, 37, 84</p>
\r
18663 <p class=MsoIndex2>codeimponly, 82</p>
\r
18665 <p class=MsoIndex2>commentchar, 12, 95, 97</p>
\r
18667 <p class=MsoIndex2>compdef, 65, 77</p>
\r
18669 <p class=MsoIndex2>compdestroy, 81</p>
\r
18671 <p class=MsoIndex2>compmempass, 82</p>
\r
18673 <p class=MsoIndex2>constmacros, 57, 58, 86</p>
\r
18675 <p class=MsoIndex2>constprefix, 62, 89</p>
\r
18677 <p class=MsoIndex2>constprefixexclude, 89</p>
\r
18679 <p class=MsoIndex2>constuse, 65, 92</p>
\r
18681 <p class=MsoIndex2>continuecomment, 95</p>
\r
18683 <p class=MsoIndex2>controlnestdepth, 94</p>
\r
18685 <p class=MsoIndex2>cppnames, 90</p>
\r
18687 <p class=MsoIndex2>czech, 60, 87</p>
\r
18689 <p class=MsoIndex2>czechconstants, 60</p>
\r
18691 <p class=MsoIndex2>czechconsts, 87</p>
\r
18693 <p class=MsoIndex2>czechfcns, 60, 87</p>
\r
18695 <p class=MsoIndex2>czechmacros, 87</p>
\r
18697 <p class=MsoIndex2>czechoslovak, 88</p>
\r
18699 <p class=MsoIndex2>czechoslovakconstants, 61</p>
\r
18701 <p class=MsoIndex2>czechoslovakconsts, 88</p>
\r
18703 <p class=MsoIndex2>czechoslovakfcns, 61, 88</p>
\r
18705 <p class=MsoIndex2>czechoslovakmacros, 61, 88</p>
\r
18707 <p class=MsoIndex2>czechoslovaktype, 61</p>
\r
18709 <p class=MsoIndex2>czechoslovaktypes, 88</p>
\r
18711 <p class=MsoIndex2>czechoslovakvars, 61, 88</p>
\r
18713 <p class=MsoIndex2>czechtypes, 61, 87</p>
\r
18715 <p class=MsoIndex2>czechvars, 60, 87</p>
\r
18717 <p class=MsoIndex2>D<initializer>, 73</p>
\r
18719 <p class=MsoIndex2>declundef, 92, 93</p>
\r
18721 <p class=MsoIndex2>deepbreak, 47, 91</p>
\r
18723 <p class=MsoIndex2>deparrays, 80</p>
\r
18725 <p class=MsoIndex2>dependenttrans, 81</p>
\r
18727 <p class=MsoIndex2>distinctexternalnames, 63, 90</p>
\r
18729 <p class=MsoIndex2>distinctinternalnames, 90</p>
\r
18731 <p class=MsoIndex2>dump, 67, 73</p>
\r
18733 <p class=MsoIndex2>duplicatequals, 95</p>
\r
18735 <p class=MsoIndex2>elseifcomplete, 47, 90</p>
\r
18737 <p class=MsoIndex2>empty, 86</p>
\r
18739 <p class=MsoIndex2>enumindex, 19, 79</p>
\r
18741 <p class=MsoIndex2>enumint, 19, 79</p>
\r
18743 <p class=MsoIndex2>enummemuse, 65, 92</p>
\r
18745 <p class=MsoIndex2>enumprefix, 62, 88</p>
\r
18747 <p class=MsoIndex2>enumprefixexclude, 88</p>
\r
18749 <p class=MsoIndex2>evalorder, 44, 90</p>
\r
18751 <p class=MsoIndex2>evalorderuncon, 44, 45, 90</p>
\r
18753 <p class=MsoIndex2>exitarg, 93</p>
\r
18755 <p class=MsoIndex2>expect, 75</p>
\r
18757 <p class=MsoIndex2>exportany, 105</p>
\r
18759 <p class=MsoIndex2>exportconst, 105</p>
\r
18761 <p class=MsoIndex2>exportfcn, 105, 106</p>
\r
18763 <p class=MsoIndex2>exportheader, 65, 93</p>
\r
18765 <p class=MsoIndex2>exportheadervar, 93</p>
\r
18767 <p class=MsoIndex2>exportiter, 106</p>
\r
18769 <p class=MsoIndex2>exportlocal, 93</p>
\r
18771 <p class=MsoIndex2>exportmacro, 105, 106</p>
\r
18773 <p class=MsoIndex2>exporttype, 106</p>
\r
18775 <p class=MsoIndex2>exportvar, 105, 106</p>
\r
18777 <p class=MsoIndex2>exposetrans, 81</p>
\r
18779 <p class=MsoIndex2>externalnamecaseinsensitive, 63, 90</p>
\r
18781 <p class=MsoIndex2>externalnamelen, 90</p>
\r
18783 <p class=MsoIndex2>externalprefix, 62, 89</p>
\r
18785 <p class=MsoIndex2>externalprefixexclude, 89</p>
\r
18787 <p class=MsoIndex2>f <file>, 12, 73</p>
\r
18789 <p class=MsoIndex2>fcnmacros, 57, 58, 86</p>
\r
18791 <p class=MsoIndex2>fcnuse, 65, 92</p>
\r
18793 <p class=MsoIndex2>fielduse, 65, 92</p>
\r
18795 <p class=MsoIndex2>filestaticprefix, 62, 88, 89</p>
\r
18797 <p class=MsoIndex2>filestaticprefixexclude, 89</p>
\r
18799 <p class=MsoIndex2>fixedformalarray, 78</p>
\r
18801 <p class=MsoIndex2>floatdouble, 79</p>
\r
18803 <p class=MsoIndex2>forblock, 91</p>
\r
18805 <p class=MsoIndex2>forcehints, 12, 75</p>
\r
18807 <p class=MsoIndex2>forempty, 91</p>
\r
18809 <p class=MsoIndex2>formalarray, 78</p>
\r
18811 <p class=MsoIndex2>formatcode, 78</p>
\r
18813 <p class=MsoIndex2>formattype, 78</p>
\r
18815 <p class=MsoIndex2>forwarddecl, 79</p>
\r
18817 <p class=MsoIndex2>freshtrans, 81</p>
\r
18819 <p class=MsoIndex2>globalias, 85</p>
\r
18821 <p class=MsoIndex2>globalprefix, 89</p>
\r
18823 <p class=MsoIndex2>globalprefixexclude, 89</p>
\r
18825 <p class=MsoIndex2>globimponly, 29, 82</p>
\r
18827 <p class=MsoIndex2>globnoglobs, 37, 84</p>
\r
18829 <p class=MsoIndex2>globs, 84</p>
\r
18831 <p class=MsoIndex2>globsimpmodsnothing, 85, 96</p>
\r
18833 <p class=MsoIndex2>globstate, 84</p>
\r
18835 <p class=MsoIndex2>globuse, 84</p>
\r
18837 <p class=MsoIndex2>globvarprefix, 62</p>
\r
18839 <p class=MsoIndex2>globvarprefixexclude, 62</p>
\r
18841 <p class=MsoIndex2>gnuextensions, 95</p>
\r
18843 <p class=MsoIndex2>hasyield, 87</p>
\r
18845 <p class=MsoIndex2>help, 72</p>
\r
18847 <p class=MsoIndex2>hints, 75</p>
\r
18849 <p class=MsoIndex2>i <file>, 104</p>
\r
18851 <p class=MsoIndex2>I<directory>, 73</p>
\r
18853 <p class=MsoIndex2>ifblock, 47, 91</p>
\r
18855 <p class=MsoIndex2>ifempty, 91</p>
\r
18857 <p class=MsoIndex2>ignorequals, 79</p>
\r
18859 <p class=MsoIndex2>ignoresigns, 19, 79</p>
\r
18861 <p class=MsoIndex2>immediatetrans, 81</p>
\r
18863 <p class=MsoIndex2>impabstract, 22, 80</p>
\r
18865 <p class=MsoIndex2>impcheckedglobs, 85</p>
\r
18867 <p class=MsoIndex2>impcheckedspecglobs, 105</p>
\r
18869 <p class=MsoIndex2>impcheckedstatics, 85</p>
\r
18871 <p class=MsoIndex2>impcheckedstrictglobs, 85</p>
\r
18873 <p class=MsoIndex2>impcheckedstrictspecglobs, 105</p>
\r
18875 <p class=MsoIndex2>impcheckedstrictstatics, 38, 85</p>
\r
18877 <p class=MsoIndex2>impcheckmodglobs, 85</p>
\r
18879 <p class=MsoIndex2>impcheckmodinternals, 85</p>
\r
18881 <p class=MsoIndex2>impcheckmodspecglobs, 105</p>
\r
18883 <p class=MsoIndex2>impcheckmodstatics, 85</p>
\r
18885 <p class=MsoIndex2>impouts, 17, 18, 76</p>
\r
18887 <p class=MsoIndex2>imptype, 79</p>
\r
18889 <p class=MsoIndex2>includenest, 94</p>
\r
18891 <p class=MsoIndex2>incompletetype, 79</p>
\r
18893 <p class=MsoIndex2>incondefs, 85</p>
\r
18895 <p class=MsoIndex2>incondefslib, 85</p>
\r
18897 <p class=MsoIndex2>infloops, 90</p>
\r
18899 <p class=MsoIndex2>infloopsuncon, 45, 90</p>
\r
18901 <p class=MsoIndex2>internalglobs, 84</p>
\r
18903 <p class=MsoIndex2>internalglobsnoglobs, 84</p>
\r
18905 <p class=MsoIndex2>internalnamecaseinsensitive, 64, 90</p>
\r
18907 <p class=MsoIndex2>internalnamelen, 90</p>
\r
18909 <p class=MsoIndex2>internalnamelength, 64</p>
\r
18911 <p class=MsoIndex2>internalnamelookalike, 64, 90</p>
\r
18913 <p class=MsoIndex2>iterprefix, 62, 89</p>
\r
18915 <p class=MsoIndex2>iterprefixexclude, 89</p>
\r
18917 <p class=MsoIndex2>keeptrans, 81</p>
\r
18919 <p class=MsoIndex2>kepttrans, 81</p>
\r
18921 <p class=MsoIndex2>larchpath, 73</p>
\r
18923 <p class=MsoIndex2>lclexpect, 105</p>
\r
18925 <p class=MsoIndex2>lclimportdir, 73</p>
\r
18927 <p class=MsoIndex2>lcs, 104</p>
\r
18929 <p class=MsoIndex2>lh, 104</p>
\r
18931 <p class=MsoIndex2>libmacros, 86</p>
\r
18933 <p class=MsoIndex2>limit, 74, 75</p>
\r
18935 <p class=MsoIndex2>linelen, 12, 75</p>
\r
18937 <p class=MsoIndex2>lintcomments, 95, 103</p>
\r
18939 <p class=MsoIndex2>load, 67, 73</p>
\r
18941 <p class=MsoIndex2>localprefix, 89</p>
\r
18943 <p class=MsoIndex2>localprefixexclude, 89</p>
\r
18945 <p class=MsoIndex2>longintegral, 20, 79</p>
\r
18947 <p class=MsoIndex2>longsignedintegral, 20, 79</p>
\r
18949 <p class=MsoIndex2>longunsignedintegral, 20, 79</p>
\r
18951 <p class=MsoIndex2>longunsignedunsignedintegral, 20, 79</p>
\r
18953 <p class=MsoIndex2>looploopbreak, 46, 91</p>
\r
18955 <p class=MsoIndex2>looploopcontinue, 47, 91</p>
\r
18957 <p class=MsoIndex2>loopswitchbreak, 46, 91</p>
\r
18959 <p class=MsoIndex2>macroassign, 56, 86</p>
\r
18961 <p class=MsoIndex2>macroconstdecl, 57, 86</p>
\r
18963 <p class=MsoIndex2>macrodecl, 86</p>
\r
18965 <p class=MsoIndex2>macrofcndecl, 57, 86</p>
\r
18967 <p class=MsoIndex2>macromatchname, 86</p>
\r
18969 <p class=MsoIndex2>macroparams, 56, 86</p>
\r
18971 <p class=MsoIndex2>macroparens, 56, 86</p>
\r
18973 <p class=MsoIndex2>macroredef, 86</p>
\r
18975 <p class=MsoIndex2>macrostmt, 56, 86</p>
\r
18977 <p class=MsoIndex2>macrounrecog, 86</p>
\r
18979 <p class=MsoIndex2>macrovarprefix, 61, 62, 88</p>
\r
18981 <p class=MsoIndex2>macrovarprefixexclude, 62, 88</p>
\r
18983 <p class=MsoIndex2>maintype, 78</p>
\r
18985 <p class=MsoIndex2>matchanyintegral, 20, 79</p>
\r
18987 <p class=MsoIndex2>matchfields, 85</p>
\r
18989 <p class=MsoIndex2>mayaliasunique, 82</p>
\r
18991 <p class=MsoIndex2>memimp, 82</p>
\r
18993 <p class=MsoIndex2>memtrans, 81</p>
\r
18995 <p class=MsoIndex2>misscase, 91</p>
\r
18997 <p class=MsoIndex2>modfilesys, 84</p>
\r
18999 <p class=MsoIndex2>modfilesystem, 36</p>
\r
19001 <p class=MsoIndex2>modglobs, 84</p>
\r
19003 <p class=MsoIndex2>modglobsnomods, 37, 83, 84</p>
\r
19005 <p class=MsoIndex2>modglobsunchecked, 84</p>
\r
19007 <p class=MsoIndex2>modifies, 13, 83</p>
\r
19009 <p class=MsoIndex2>modinternalstrict, 84</p>
\r
19011 <p class=MsoIndex2>modnomods, 36, 83</p>
\r
19013 <p class=MsoIndex2>modobserver, 83</p>
\r
19015 <p class=MsoIndex2>modobserverstrict, 83</p>
\r
19017 <p class=MsoIndex2>modsimpnoglobs, 85</p>
\r
19019 <p class=MsoIndex2>modstrictglobsnomods, 83, 84</p>
\r
19021 <p class=MsoIndex2>moduncon, 36, 83</p>
\r
19023 <p class=MsoIndex2>modunconnomods, 84</p>
\r
19025 <p class=MsoIndex2>mustdefine, 17, 77</p>
\r
19027 <p class=MsoIndex2>mustfree, 81</p>
\r
19029 <p class=MsoIndex2>mustfreefresh, 11</p>
\r
19031 <p class=MsoIndex2><i>mustmod</i>, 36, 83</p>
\r
19033 <p class=MsoIndex2>mustnotalias, 83</p>
\r
19035 <p class=MsoIndex2>mutrep, 24, 80</p>
\r
19037 <p class=MsoIndex2>namechecks, 87</p>
\r
19039 <p class=MsoIndex2>needspec, 105</p>
\r
19041 <p class=MsoIndex2>nestcomment, 95</p>
\r
19043 <p class=MsoIndex2>neverinclude, 68, 94</p>
\r
19045 <p class=MsoIndex2>newreftrans, 81</p>
\r
19047 <p class=MsoIndex2>nextlinemacros, 87</p>
\r
19049 <p class=MsoIndex2>noaccess, 95</p>
\r
19051 <p class=MsoIndex2>nocomments, 95</p>
\r
19053 <p class=MsoIndex2>noeffect, 47, 48, 92</p>
\r
19055 <p class=MsoIndex2>noeffectuncon, 47, 48, 92</p>
\r
19057 <p class=MsoIndex2>nof, 12, 73</p>
\r
19059 <p class=MsoIndex2>nolib, 67, 74</p>
\r
19061 <p class=MsoIndex2>noparams, 93</p>
\r
19063 <p class=MsoIndex2>noret, 92</p>
\r
19065 <p class=MsoIndex2>null, 76</p>
\r
19067 <p class=MsoIndex2>numenummembers, 94</p>
\r
19069 <p class=MsoIndex2>numliteral, 79</p>
\r
19071 <p class=MsoIndex2>numstructfields, 94</p>
\r
19073 <p class=MsoIndex2>observertrans, 81</p>
\r
19075 <p class=MsoIndex2>oldstyle, 93</p>
\r
19077 <p class=MsoIndex2>onlytrans, 81</p>
\r
19079 <p class=MsoIndex2>onlyunqglobaltrans, 82</p>
\r
19081 <p class=MsoIndex2>overload, 85</p>
\r
19083 <p class=MsoIndex2>ownedtrans, 81</p>
\r
19085 <p class=MsoIndex2>paramimptemp, 29, 82</p>
\r
19087 <p class=MsoIndex2>paramuse, 65, 92, 102</p>
\r
19089 <p class=MsoIndex2>parenfileformat, 12, 75</p>
\r
19091 <p class=MsoIndex2>partial, 65, 93</p>
\r
19093 <p class=MsoIndex2>passunknown, 82</p>
\r
19095 <p class=MsoIndex2>posixlib, 66, 74</p>
\r
19097 <p class=MsoIndex2>posixstrictlib, 66, 74</p>
\r
19099 <p class=MsoIndex2>predassign, 20, 77</p>
\r
19101 <p class=MsoIndex2>predbool, 77</p>
\r
19103 <p class=MsoIndex2>predboolint, 77</p>
\r
19105 <p class=MsoIndex2>predboolothers, 20, 77</p>
\r
19107 <p class=MsoIndex2>predboolptr, 20, 21, 77</p>
\r
19109 <p class=MsoIndex2>protoparammatch, 63, 89</p>
\r
19111 <p class=MsoIndex2>protoparamname, 62, 89</p>
\r
19113 <p class=MsoIndex2>protoparamprefix, 62, 89</p>
\r
19115 <p class=MsoIndex2>protoparamprefixexclude, 89</p>
\r
19117 <p class=MsoIndex2>ptrarith, 77</p>
\r
19119 <p class=MsoIndex2>ptrcompare, 78</p>
\r
19121 <p class=MsoIndex2>ptrnegate, 77</p>
\r
19123 <p class=MsoIndex2>quiet, 74</p>
\r
19125 <p class=MsoIndex2>readonlystrings, 33, 83</p>
\r
19127 <p class=MsoIndex2>readonlytrans, 83</p>
\r
19129 <p class=MsoIndex2>realcompare, 78</p>
\r
19131 <p class=MsoIndex2>redecl, 38, 93</p>
\r
19133 <p class=MsoIndex2>redef, 93</p>
\r
19135 <p class=MsoIndex2>refcounttrans, 81</p>
\r
19137 <p class=MsoIndex2>relaxquals, 19, 79</p>
\r
19139 <p class=MsoIndex2>relaxtypes, 79</p>
\r
19141 <p class=MsoIndex2>repeatunrecog, 93</p>
\r
19143 <p class=MsoIndex2>repexpose, 83</p>
\r
19145 <p class=MsoIndex2>retalias, 31, 83</p>
\r
19147 <p class=MsoIndex2>retexpose, 32, 83</p>
\r
19149 <p class=MsoIndex2>retimponly, 29, 82</p>
\r
19151 <p class=MsoIndex2>retval, 92</p>
\r
19153 <p class=MsoIndex2>retvalbool, 48, 92</p>
\r
19155 <p class=MsoIndex2>retvalint, 48, 92</p>
\r
19157 <p class=MsoIndex2>retvalother, 92</p>
\r
19159 <p class=MsoIndex2>retvalothers, 48</p>
\r
19161 <p class=MsoIndex2>S<directory>, 73</p>
\r
19163 <p class=MsoIndex2>sefparams, 87</p>
\r
19165 <p class=MsoIndex2>sefuncon, 57, 87</p>
\r
19167 <p class=MsoIndex2>shadow, 89</p>
\r
19169 <p class=MsoIndex2>sharedtrans, 81</p>
\r
19171 <p class=MsoIndex2>shiftsigned, 77</p>
\r
19173 <p class=MsoIndex2>showallconjs, 75</p>
\r
19175 <p class=MsoIndex2>showalluses, 74</p>
\r
19177 <p class=MsoIndex2>showcol, 12</p>
\r
19179 <p class=MsoIndex2>showcolumn, 75</p>
\r
19181 <p class=MsoIndex2>showfunc, 12, 13, 75</p>
\r
19183 <p class=MsoIndex2>showscan, 74</p>
\r
19185 <p class=MsoIndex2>showsummary, 74</p>
\r
19187 <p class=MsoIndex2>singleinclude, 68, 94</p>
\r
19189 <p class=MsoIndex2>sizeofformalarray, 78</p>
\r
19191 <p class=MsoIndex2>sizeoftype, 78</p>
\r
19193 <p class=MsoIndex2>skipansiheaders, 68, 94</p>
\r
19195 <p class=MsoIndex2>skipposixheaders, 68, 94</p>
\r
19197 <p class=MsoIndex2>skipsysheaders, 68, 94</p>
\r
19199 <p class=MsoIndex2>slovak, 61, 87</p>
\r
19201 <p class=MsoIndex2>slovakconstants, 61</p>
\r
19203 <p class=MsoIndex2>slovakconsts, 87, 88</p>
\r
19205 <p class=MsoIndex2>slovakfcns, 61, 87, 88</p>
\r
19207 <p class=MsoIndex2>slovakmacros, 61, 87, 88</p>
\r
19209 <p class=MsoIndex2>slovaktypes, 87, 88</p>
\r
19211 <p class=MsoIndex2>slovakvars, 61, 87, 88</p>
\r
19213 <p class=MsoIndex2>specglobimponly, 105</p>
\r
19215 <p class=MsoIndex2>specimponly, 105</p>
\r
19217 <p class=MsoIndex2>specmacros, 105</p>
\r
19219 <p class=MsoIndex2>specretimponly, 105</p>
\r
19221 <p class=MsoIndex2>specstructimponly, 105</p>
\r
19223 <p class=MsoIndex2>specundecl, 105</p>
\r
19225 <p class=MsoIndex2>specundef, 105</p>
\r
19227 <p class=MsoIndex2>stackref, 82</p>
\r
19229 <p class=MsoIndex2>standard, 76</p>
\r
19231 <p class=MsoIndex2>staticinittranc, 82</p>
\r
19233 <p class=MsoIndex2>statictrans, 81</p>
\r
19235 <p class=MsoIndex2>stats, 74</p>
\r
19237 <p class=MsoIndex2>strict, 76</p>
\r
19239 <p class=MsoIndex2>strictbranchstate, 80</p>
\r
19241 <p class=MsoIndex2>strictdestroy, 81</p>
\r
19243 <p class=MsoIndex2>strictlib, 74</p>
\r
19245 <p class=MsoIndex2>strictops, 78</p>
\r
19247 <p class=MsoIndex2>strictusereleased, 80</p>
\r
19249 <p class=MsoIndex2>stringliterallen, 94</p>
\r
19251 <p class=MsoIndex2>structimponly, 29, 82</p>
\r
19253 <p class=MsoIndex2>supcounts, 95, 97</p>
\r
19255 <p class=MsoIndex2>switchloopbreak, 46, 91</p>
\r
19257 <p class=MsoIndex2>switchswitchbreak, 46, 91</p>
\r
19259 <p class=MsoIndex2>syntax, 95</p>
\r
19261 <p class=MsoIndex2>sysdirerrors, 73, 94</p>
\r
19263 <p class=MsoIndex2>sysdirexpandmacros, 94</p>
\r
19265 <p class=MsoIndex2>sysdirs, 68, 73, 94</p>
\r
19267 <p class=MsoIndex2>systemunrecog, 93</p>
\r
19269 <p class=MsoIndex2>tagprefix, 62, 88</p>
\r
19271 <p class=MsoIndex2>tagprefixexclude, 88</p>
\r
19273 <p class=MsoIndex2>temptrans, 81</p>
\r
19275 <p class=MsoIndex2>timedist, 74</p>
\r
19277 <p class=MsoIndex2>tmpcomments, 97</p>
\r
19279 <p class=MsoIndex2>tmpdir, 73</p>
\r
19281 <p class=MsoIndex2>topuse, 65, 92</p>
\r
19283 <p class=MsoIndex2>trytorecover, 95</p>
\r
19285 <p class=MsoIndex2>type, 77</p>
\r
19287 <p class=MsoIndex2>typeprefix, 62, 89</p>
\r
19289 <p class=MsoIndex2>typeprefixexclude, 62, 89</p>
\r
19291 <p class=MsoIndex2>typeuse, 65, 92</p>
\r
19293 <p class=MsoIndex2>U<initializer>, 73</p>
\r
19295 <p class=MsoIndex2>uncheckedglobalias, 85</p>
\r
19297 <p class=MsoIndex2>uncheckedmacroprefix, 62, 89</p>
\r
19299 <p class=MsoIndex2>uncheckedmacroprefixexclude, 89</p>
\r
19301 <p class=MsoIndex2>uniondef, 77</p>
\r
19303 <p class=MsoIndex2>unixlib, 66, 74</p>
\r
19305 <p class=MsoIndex2>unixstrictlib, 66, 74</p>
\r
19307 <p class=MsoIndex2>unqualifiedinititrans, 82</p>
\r
19309 <p class=MsoIndex2>unqualifiedtrans, 82</p>
\r
19311 <p class=MsoIndex2>unreachable, 92</p>
\r
19313 <p class=MsoIndex2>unrecog, 93</p>
\r
19315 <p class=MsoIndex2>unrecogcomments, 95</p>
\r
19317 <p class=MsoIndex2>unusedspecial, 92</p>
\r
19319 <p class=MsoIndex2>usedef, 17, 76</p>
\r
19321 <p class=MsoIndex2>usereleased, 80</p>
\r
19323 <p class=MsoIndex2>usestderr, 74</p>
\r
19325 <p class=MsoIndex2>usevarargs, 93</p>
\r
19327 <p class=MsoIndex2>varuse, 65, 92</p>
\r
19329 <p class=MsoIndex2>voidabstract, 78</p>
\r
19331 <p class=MsoIndex2>warnflags, 12, 72</p>
\r
19333 <p class=MsoIndex2>warnlintcomments, 95, 103</p>
\r
19335 <p class=MsoIndex2>warnmissingglobs, 84</p>
\r
19337 <p class=MsoIndex2>warnmissingglobsnoglobs, 84</p>
\r
19339 <p class=MsoIndex2>warnposixheaders, 94</p>
\r
19341 <p class=MsoIndex2>weak, 11, 76</p>
\r
19343 <p class=MsoIndex2>whichlib, 74</p>
\r
19345 <p class=MsoIndex2>whileblock, 91</p>
\r
19347 <p class=MsoIndex2>whileempty, 91</p>
\r
19349 <p class=MsoIndex2>zeroptr, 79</p>
\r
19351 <p class=MsoIndex1>format codes, 78</p>
\r
19353 <p class=MsoIndex1>free, 26, 27, 66, 81</p>
\r
19355 <p class=MsoIndex1>function interfaces, <b>35</b>, 83</p>
\r
19357 <p class=MsoIndex1>gcc extensions, 95</p>
\r
19359 <p class=MsoIndex1>global variables, 17, 32, 37, 44, 62, 84, 85, 98, 99, 105</p>
\r
19361 <p class=MsoIndex1>globals list, <b>37</b>, 44, 45</p>
\r
19363 <p class=MsoIndex1>GNU extensions, 95</p>
\r
19365 <p class=MsoIndex1>header file inclusion, 94</p>
\r
19367 <p class=MsoIndex1>header files, 65, <b>68</b></p>
\r
19369 <p class=MsoIndex1>help, 72</p>
\r
19371 <p class=MsoIndex1>hints, 12, 75</p>
\r
19373 <p class=MsoIndex1>if bodies, 47</p>
\r
19375 <p class=MsoIndex1>ignored return values, 9, 48, 92</p>
\r
19377 <p class=MsoIndex1>immutable type, <b>23</b></p>
\r
19379 <p class=MsoIndex1>implicit annotations, 37, 82, 85, 105</p>
\r
19381 <p class=MsoIndex1>include file nesting, 94</p>
\r
19383 <p class=MsoIndex1>infinite loops, 9, 37, 45</p>
\r
19385 <p class=MsoIndex1>information hiding, 9, 19, 21, 99</p>
\r
19387 <p class=MsoIndex1>initialization files, <b>12</b>, 73</p>
\r
19389 <p class=MsoIndex2>.splintrc, 12, 73</p>
\r
19391 <p class=MsoIndex2>lclinit.lci, 105</p>
\r
19393 <p class=MsoIndex1>initializers, 82</p>
\r
19395 <p class=MsoIndex1>internalState, 36, 57, 84</p>
\r
19397 <p class=MsoIndex1>isalpha, 67</p>
\r
19399 <p class=MsoIndex1>iscntrl, 67</p>
\r
19401 <p class=MsoIndex1>isdigit, 67</p>
\r
19403 <p class=MsoIndex1>isgraph, 67</p>
\r
19405 <p class=MsoIndex1>islower, 67</p>
\r
19407 <p class=MsoIndex1>isprint, 67</p>
\r
19409 <p class=MsoIndex1>ispunct, 67</p>
\r
19411 <p class=MsoIndex1>isspace, 67</p>
\r
19413 <p class=MsoIndex1>isupper, 67</p>
\r
19415 <p class=MsoIndex1>isxdigit, 67</p>
\r
19417 <p class=MsoIndex1>iterators, <b>58</b>, 86, 87, 98</p>
\r
19419 <p class=MsoIndex1>Larch, 104</p>
\r
19421 <p class=MsoIndex1>LARCH_PATH, 73, 105</p>
\r
19423 <p class=MsoIndex1>LCL, 104</p>
\r
19425 <p class=MsoIndex1>LCLIMPORTDIR, 73</p>
\r
19427 <p class=MsoIndex1>lcs files, 104</p>
\r
19429 <p class=MsoIndex1>lh files, 104</p>
\r
19431 <p class=MsoIndex1>libraries, <b>66</b>, 73, 85</p>
\r
19433 <p class=MsoIndex1>line splitting, 12</p>
\r
19435 <p class=MsoIndex1>lint comments, 102</p>
\r
19437 <p class=MsoIndex1>loop bodies, 47</p>
\r
19439 <p class=MsoIndex1>loopexec, 91</p>
\r
19441 <p class=MsoIndex1>LSL, 104</p>
\r
19443 <p class=MsoIndex1>macros, <b>55</b>, 62, 86, 102, 105</p>
\r
19445 <p class=MsoIndex1>main, 78</p>
\r
19447 <p class=MsoIndex1>malloc, 26</p>
\r
19449 <p class=MsoIndex1>McConnell, Steve, 21</p>
\r
19451 <p class=MsoIndex1>memory leaks, 25, 81, 99</p>
\r
19453 <p class=MsoIndex1>memory management, 9, <b>25</b>, 30, 80</p>
\r
19455 <p class=MsoIndex1>message format, 75</p>
\r
19457 <p class=MsoIndex1>Microsoft VisualStudio, 12, 75</p>
\r
19459 <p class=MsoIndex1>modes, 75</p>
\r
19461 <p class=MsoIndex2><i>checks</i>, 36, 76</p>
\r
19463 <p class=MsoIndex2>standard, 76</p>
\r
19465 <p class=MsoIndex2>strict, 76</p>
\r
19467 <p class=MsoIndex2>weak, 11, 76</p>
\r
19469 <p class=MsoIndex1>modification, 31, 32, 33, <b>35</b>, 44, 56, 57, 83</p>
\r
19471 <p class=MsoIndex1>modifies clause, <b>35</b>, 39, 44, 45, 47, 57, 83, 84, 98</p>
\r
19473 <p class=MsoIndex1>multiple definitions, 93</p>
\r
19475 <p class=MsoIndex1>mutability, <b>23</b>, 32</p>
\r
19477 <p class=MsoIndex1>mutable type, 23</p>
\r
19479 <p class=MsoIndex1>namespaces, 61, 88</p>
\r
19481 <p class=MsoIndex1>naming convention, 23, <b>60</b>, 87</p>
\r
19483 <p class=MsoIndex2>Czech, 60, 63, 80, 87</p>
\r
19485 <p class=MsoIndex2>Czechoslovak, 61, 80, 88</p>
\r
19487 <p class=MsoIndex2>Slovak, 61, 63, 80, 87</p>
\r
19489 <p class=MsoIndex1>naming restrictions, 63, 89</p>
\r
19491 <p class=MsoIndex1>no effects, 47, 92</p>
\r
19493 <p class=MsoIndex1>NOTREACHED, 95, 102</p>
\r
19495 <p class=MsoIndex1>null, 66, 84</p>
\r
19497 <p class=MsoIndex1>null dereferences, <b>14</b>, 76, 100</p>
\r
19499 <p class=MsoIndex1>null predicates, 100</p>
\r
19501 <p class=MsoIndex1>numeric types, 19</p>
\r
19503 <p class=MsoIndex1>output, 74</p>
\r
19505 <p class=MsoIndex1>parse errors, 95</p>
\r
19507 <p class=MsoIndex1>parsing, 95</p>
\r
19509 <p class=MsoIndex1>partial programs, 65</p>
\r
19511 <p class=MsoIndex1>path with no return, 92</p>
\r
19513 <p class=MsoIndex1>pointers, 78</p>
\r
19515 <p class=MsoIndex1>polymorphism, 57, 98</p>
\r
19517 <p class=MsoIndex1>POSIX, 66, 94</p>
\r
19519 <p class=MsoIndex1>predicates, 77</p>
\r
19521 <p class=MsoIndex1>preprocessor, 73</p>
\r
19523 <p class=MsoIndex1>primitive operations, 77</p>
\r
19525 <p class=MsoIndex1>printf, 66, 78, 101</p>
\r
19527 <p class=MsoIndex1>PRINTFLIKE, 95, 102</p>
\r
19529 <p class=MsoIndex1>problematic control structures, <b>45</b></p>
\r
19531 <p class=MsoIndex1>read-only storage, <b>32</b></p>
\r
19533 <p class=MsoIndex1>reference counting, <b>30</b>, 81</p>
\r
19535 <p class=MsoIndex1>reserved names, <b>63</b>, 89</p>
\r
19537 <p class=MsoIndex1>return values, 48</p>
\r
19539 <p class=MsoIndex1>security vulnerabilities, 9</p>
\r
19541 <p class=MsoIndex1>sequence points, 44</p>
\r
19543 <p class=MsoIndex1>Shakespeare, William, 25, 26</p>
\r
19545 <p class=MsoIndex1>shared storage, 27</p>
\r
19547 <p class=MsoIndex1>sharing, <b>31</b>, 82</p>
\r
19549 <p class=MsoIndex1>sharing semantics, 24</p>
\r
19551 <p class=MsoIndex1>side effect free, 87</p>
\r
19553 <p class=MsoIndex1>side effect free parameters, 56</p>
\r
19555 <p class=MsoIndex1>side effects, 101</p>
\r
19557 <p class=MsoIndex1>sizeof, 22, 78</p>
\r
19559 <p class=MsoIndex1>special reward, 76</p>
\r
19561 <p class=MsoIndex1>stack pointers, 25, 28</p>
\r
19563 <p class=MsoIndex1>stack references, 28</p>
\r
19565 <p class=MsoIndex1>standard error, 74</p>
\r
19567 <p class=MsoIndex1>standard libraries, 66</p>
\r
19569 <p class=MsoIndex1>standard library, 26</p>
\r
19571 <p class=MsoIndex1>standard output, 74</p>
\r
19573 <p class=MsoIndex1>static, 65</p>
\r
19575 <p class=MsoIndex1>static variables, 37</p>
\r
19577 <p class=MsoIndex1>stderr, 67</p>
\r
19579 <p class=MsoIndex1>stdin, 67</p>
\r
19581 <p class=MsoIndex1>stdout, 67</p>
\r
19583 <p class=MsoIndex1>storage model, 25</p>
\r
19585 <p class=MsoIndex1>strchr, 67</p>
\r
19587 <p class=MsoIndex1>string literals, <b>33</b>, 83, 94</p>
\r
19589 <p class=MsoIndex1>strrchr, 67</p>
\r
19591 <p class=MsoIndex1>structure fields, 94</p>
\r
19593 <p class=MsoIndex1>suppressing warnings, 97</p>
\r
19595 <p class=MsoIndex1>switch, 101</p>
\r
19597 <p class=MsoIndex1>switch statements, 45, 46</p>
\r
19599 <p class=MsoIndex1>syntactic comment, 95</p>
\r
19601 <p class=MsoIndex1>syntax, 12</p>
\r
19603 <p class=MsoIndex1>tolower, 67</p>
\r
19605 <p class=MsoIndex1>toupper, 67</p>
\r
19607 <p class=MsoIndex1>type, 9, 13, 21, 77, 78</p>
\r
19609 <p class=MsoIndex1>type access, 99</p>
\r
19611 <p class=MsoIndex1>type checking, <b>19</b></p>
\r
19613 <p class=MsoIndex1>type equivalence, 78</p>
\r
19615 <p class=MsoIndex1>types, 102</p>
\r
19617 <p class=MsoIndex1>undefined, 44</p>
\r
19619 <p class=MsoIndex1>undefined behavior, 31, 33, 36, 37, <b>44</b>, 55, 90</p>
\r
19621 <p class=MsoIndex1>undefined values, 9, <b>17</b>, 38, 76, 84, 100</p>
\r
19623 <p class=MsoIndex1>ungetc, 67</p>
\r
19625 <p class=MsoIndex1>unreachable, 9</p>
\r
19627 <p class=MsoIndex1>unreachable code, 92, 101, 102</p>
\r
19629 <p class=MsoIndex1>unrecognized identifiers, 93</p>
\r
19631 <p class=MsoIndex1>unused declarations, 9, 65, 92</p>
\r
19633 <p class=MsoIndex1>use warnings, 101</p>
\r
19635 <p class=MsoIndex1>use-before-definition, 9, <b>17</b>, 38, 76, 91</p>
\r
19637 <p class=MsoIndex1>van der Linden, Peter, 46, 63</p>
\r
19639 <p class=MsoIndex1>varargs, 93</p>
\r
19641 <p class=MsoIndex1>void, 48</p>
\r
19645 <span style='font-size:11.0pt;font-family:"Times New Roman"'><br clear=all
\r
19646 style='page-break-before:auto'>
\r
19649 <div class=Section8>
\r
19651 <p class=IndentText> </p>
\r
19655 <div><br clear=all>
\r
19657 <hr align=left size=1 width="33%">
\r
19661 <p class=MsoFootnoteText><a href="#_ftnref1" name="_ftn1" title=""><span
\r
19662 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19663 style='font-size:10.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>
\r
19664 Lint is a common programming tool for detecting anomalies in C programs. S. C.
\r
19665 Johnson developed the original lint in the late seventies, mainly because early
\r
19666 versions of C did not support function prototypes. Splint was originally named
\r
19667 LCLint because it was originally intended to check for inconsistencies between
\r
19668 LCL specifications and C implementations. To reflect divergence from LCL and
\r
19669 increased focus on detecting security vulnerabilities, the name was changed to Splint, short for
\93Specification Lint
\94 and
\93Secure Programming Lint
\94.</p>
\r
19675 <p class=MsoFootnoteText><a href="#_ftnref2" name="_ftn2" title=""><span
\r
19676 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19677 style='font-size:10.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>
\r
19678 The meta-notation, <span class=Annot>item,<sup>+</sup></span> is used to denote
\r
19679 a comma separated list of items. For example, <span
\r
19680 class=Annot>/*@access mstring, intSet@*/</span> </p>
\r
19682 <p class=MsoFootnoteText>allows access to the representations of both <span
\r
19683 class=CodeText>mstring</span> and <span class=CodeText>intSet</span>.) </p>
\r
19689 <p class=MsoFootnoteText><a href="#_ftnref3" name="_ftn3" title=""><span
\r
19690 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19691 style='font-size:10.0pt;font-family:"Times New Roman"'>[3]</span></span></span></a>
\r
19692 This section is largely based on [Evans96]. It semi-formally defines some of
\r
19693 the terms needed to describe memory management checking; if you are satisfied
\r
19694 with an intuitive understanding of these terms, this section may be skipped.</p>
\r
19700 <p class=MsoFootnoteText><a href="#_ftnref4" name="_ftn4" title=""><span
\r
19701 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19702 style='font-size:10.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>
\r
19703 This is similar to the LISP storage model, except that objects are typed.</p>
\r
19709 <p class=TextFontCX><a href="#_ftnref5"
\r
19710 name="_ftn5" title=""><span class=MsoFootnoteReference><span
\r
19711 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>
\r
19712 <span style='font-size:10.0pt'>Except </span><span class=CodeText><span
\r
19713 style='font-size:10.0pt'>sizeof</span></span><span style='font-size:10.0pt'>,
\r
19714 which does not need the value of its argument.</span></p>
\r
19720 <p class=TextFontCX><a href="#_ftnref6"
\r
19721 name="_ftn6" title=""><span class=MsoFootnoteReference><span
\r
19722 class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>
\r
19723 If the storage is not assigned to a reference, an internal reference is created
\r
19724 to track the storage.</p>
\r
19730 <p class=MsoFootnoteText><a href="#_ftnref7" name="_ftn7" title=""><span
\r
19731 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19732 style='font-size:10.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a>
\r
19733 The declaration of <span class=CodeText>free</span> has a <span class=Annot>null</span> annotation on the parameter to indicate that the argument may be <span
\r
19734 class=CodeText>NULL</span>. According to [ISO, 7.20.3.2], <span
\r
19735 class=CodeText>NULL</span> may be passed to <span class=CodeText>free</span>
\r
19736 without no action. On some UNIX platforms, passing <span class=CodeText>NULL</span>
\r
19737 to free causes a program crash so the UNIX version of the standard library
\r
19738 specifies <span class=CodeText>free</span> without the <span class=Annot>null</span>
\r
19739 annotation on its parameter. To check that allocated objects are completely
\r
19740 destroyed (e.g., all unshared objects inside a structure are deallocated before
\r
19741 the structure is deallocated), Splint checks that any parameter passed as an <span
\r
19742 class=CodeText>out only void *</span> does not contain references to live,
\r
19743 unshared objects. This makes sense, since such a parameter could not be used sensibly
\r
19744 in any way other than deallocating its storage.</p>
\r
19750 <p class=MsoFootnoteText><a href="#_ftnref8" name="_ftn8" title=""><span
\r
19751 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19752 style='font-size:10.0pt;font-family:"Times New Roman"'>[8]</span></span></span></a>
\r
19753 In versions of Splint before 3.0, the <span class=Annot>noreturn</span>
\r
19754 annotation was named <span class=Annot>exits</span>. The <span class=Annot>noreturn</span>
\r
19755 annotation means the same thing, but is a more appropriate name. For legacy
\r
19756 code, Splint still supports the <span class=Annot>exits</span> annotations.
\r
19757 Similarly, <span class=Annot>maynotreturn</span> replaces <span class=Annot>mayexit</span>,
\r
19758 <span class=Annot>noreturnwhentrue</span> replaces <span class=Annot>truexit</span>
\r
19759 and <span class=Annot>noreturnwhenfalse</span> replaces <span class=Annot>falseexit</span>.</p>
\r
19765 <p class=MsoFootnoteText><a href="#_ftnref9" name="_ftn9" title=""><span
\r
19766 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19767 style='font-size:10.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>The
\r
19768 <span class=Annot>sef</span> annotation denotes a parameter as side effect free
\r
19769 (see Section 11.2.1). We use <span
\r
19770 class=CodeText>bool /*@alt int@*/</span></a></span> as
\r
19771 the type of the parameter, to indicate that it may be either a Boolean or an
\r
19778 <p class=MsoFootnoteText><a href="#_ftnref10" name="_ftn10" title=""><span
\r
19779 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19780 style='font-size:10.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>
\r
19781 Peter van der Linden estimates that default fall through is the wrong behavior
\r
19782 97% of the time. [vdL95, p. 37]</p>
\r
19788 <p class=MsoFootnoteText><a href="#_ftnref11" name="_ftn11" title=""><span
\r
19789 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19790 style='font-size:10.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>
\r
19791 \93Software Glitch Cripples AT&T Network
\94, Telephony, 22 January 1990.</p>
\r
19797 <p class=MsoFootnoteText><a href="#_ftnref12" name="_ftn12" title=""><span
\r
19798 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19799 style='font-size:10.0pt;font-family:"Times New Roman"'>[12]</span></span></span></a>
\r
19800 See [Larochelle01] for information on internal aspects of the checking.</p>
\r
19806 <p class=MsoFootnoteText><a href="#_ftnref13" name="_ftn13" title=""><span
\r
19807 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19808 style='font-size:10.0pt;font-family:"Times New Roman"'>[13]</span></span></span></a>
\r
19809 This section is largely based on [Evans02].</p>
\r
19815 <p class=MsoFootnoteText><a href="#_ftnref14" name="_ftn14" title=""><span
\r
19816 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19817 style='font-size:10.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>
\r
19818 C. Cowan et al., <i>FormatGuard: Automatic Protection from printf Format String
\r
19819 Vulnerabilities</i>. 10th Usenix Security Symposium, 2001.</p>
\r
19825 <p class=MsoFootnoteText><a href="#_ftnref15" name="_ftn15" title=""><span
\r
19826 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19827 style='font-size:10.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>
\r
19828 To be completely correct, all the macro parameters should be evaluated before
\r
19829 the macro has any side effects. Splint does not check this.</p>
\r
19835 <p class=MsoFootnoteText><a href="#_ftnref16" name="_ftn16" title=""><span
\r
19836 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19837 style='font-size:10.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>
\r
19838 Functions that do not produce to the same result each time they are called with
\r
19839 the same arguments should be declared to modify <span class=Annot>internalState</span> so they will lead to errors if they are passed as <span class=Annot>sef</span>
\r
19846 <p class=MsoFootnoteText><a href="#_ftnref17" name="_ftn17" title=""><span
\r
19847 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19848 style='font-size:10.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>
\r
19849 The most renowned C naming convention is the Hungarian naming convention,
\r
19850 introduced by Charles Simonyi [Simonyi, Charles, and Martin Heller.
\93The
\r
19851 Hungarian Revolution.
\94 <i>BYTE</i>, August 1991, p. 131-38]. The names for
\r
19852 Splint naming conventions follow the tradition of using Central European
\r
19853 nationalities as mnemonics for naming conventions. The Splint conventions are
\r
19854 similar to the Hungarian naming convention in that they encode type information
\r
19855 in names, except that the Splint conventions encode the names of accessible
\r
19856 abstract types instead of the type of the declaration of return value.
\r
19857 Prefixes used in the Hungarian naming convention are not supported by Splint.</p>
\r
19859 <p class=MsoFootnoteText> </p>
\r
19865 <p class=MsoFootnoteText><a href="#_ftnref18" name="_ftn18" title=""><span
\r
19866 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19867 style='font-size:10.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>
\r
19868 Of course, namespace prefixes should really be described by regular
\r
19869 expressions. If there is sufficient interest (that is, someone volunteers to
\r
19870 program it), regular expressions will be supported in a future version of
\r
19877 <p class=MsoFootnoteText><a href="#_ftnref19" name="_ftn19" title=""><span
\r
19878 class=MsoFootnoteReference><span class=MsoFootnoteReference><span
\r
19879 style='font-size:10.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>
\r
19880 POSIX library was contributed by Jens Schweikhardt.</p>
\r
19886 <!--#include virtual="footer.html"-->
\r
andersk / splint.git / blob