2 Source files are .c, .h and .lcl files. If there is no suffix,
3 Splint will look for <file>.c and <file>.lcl.
5 Use splint -help <topic or flag name> for more information
9 annotations (describes source-code annotations)
10 comments (describes control comments)
11 flags (describes flag categories)
12 flags <category> (describes flags in category)
13 flags all (short description of all flags)
14 flags alpha (list all flags alphabetically)
15 flags full (full description of all flags)
16 mail (information on mailing lists)
17 modes (show mode settings)
18 parseerrors (help on handling parser errors)
19 prefixcodes (character codes in namespace prefixes)
20 references (sources for more information)
21 vars (environment variables)
22 version (information on compilation, maintainer)
25 Finished checking --- no code processed
27 Source files are .c, .h and .lcl files. If there is no suffix,
28 Splint will look for <file>.c and <file>.lcl.
30 Use splint -help <topic or flag name> for more information
34 annotations (describes source-code annotations)
35 comments (describes control comments)
36 flags (describes flag categories)
37 flags <category> (describes flags in category)
38 flags all (short description of all flags)
39 flags alpha (list all flags alphabetically)
40 flags full (full description of all flags)
41 mail (information on mailing lists)
42 modes (show mode settings)
43 parseerrors (help on handling parser errors)
44 prefixcodes (character codes in namespace prefixes)
45 references (sources for more information)
46 vars (environment variables)
47 version (information on compilation, maintainer)
51 Command Line: Unrecognized option: asdf
52 A flag is not recognized or used in an incorrect way (Use -badflag to inhibit
55 Finished checking --- no code processed
57 Warning: setting +boolint redundant with current value
59 Finished checking --- no code processed
139 distinctexternalnames
140 distinctinternalnames
167 externalnamecaseinsensitive
170 externalprefixexclude
179 filestaticprefixexclude
218 impcheckedstrictglobs
219 impcheckedstrictspecglobs
220 impcheckedstrictstatics
226 implementationoptional
241 internalnamecaseinsensitive
243 internalnamelookalike
278 longunsignedunsignedintegral
296 macrovarprefixexclude
383 protoparamprefixexclude
416 showconstraintlocation
482 uncheckedmacroprefixexclude
505 warnmissingglobsnoglobs
517 null --- misuses of null pointer
518 nullderef --- possible dereferencce of null pointer
519 nullpass --- possibly null pointer passed as formal with no null annotation
520 nullret --- possibly null pointer returned as result with no null annotation
521 nullstate --- possibly null pointer reachable from a reference with no null
523 nullassign --- inconsistent assignment or initialization involving null pointer
524 usedef --- use before definition
525 mustdefine --- out storage not defined before return or scope exit
526 uniondef --- at least one field of a union must be defined
527 compdef --- parameter, return value or global completely defined
528 fullinitblock --- initializer sets all fields
529 initallelements --- initializer defines all array elements
530 initsize --- initializer defines extra array elements
531 impouts --- pointer parameters to unspecified functions may be implicit out
533 incondefs --- function, variable or constant redefined with inconsistent type
534 matchfields --- struct or enum type redefined with inconsistent fields or
536 fcnderef --- dereferencce of a function type
537 realcompare --- dangerous comparison between reals (dangerous because of
538 inexact floating point representations)
539 unsignedcompare --- comparison using <, <=, >= between an unsigned integral and
541 ptrarith --- arithmetic involving pointer and integer
542 nullptrarith --- arithmetic involving possibly null pointer and integer
543 ptrcompare --- comparison between pointer and number
544 strictops --- primitive operation does not type check strictly
545 bitwisesigned --- a bitwise logical operator does not have unsigned operands
546 shiftnegative --- a shift right operand may be negative
547 shiftimplementation --- a shift left operand may be negative
548 sizeoftype --- sizeof operator has a type argument
549 sizeofformalarray --- sizeof operator has an array formal parameter argument
550 fixedformalarray --- formal parameter of type array is declared with size
551 incompletetype --- formal parameter has an incomplete type
552 formalarray --- formal parameter is an array
553 booltype --- set name of boolean type (default bool)
554 boolfalse --- set name of boolean false (default FALSE)
555 booltrue --- set name of boolean true (default TRUE)
556 likelybool --- type name is probably a boolean type but does not match default
557 boolean type name, "bool", and alternate name is not set
558 boolcompare --- comparison between bools (dangerous because of multiple TRUE
560 boolops --- primitive operation (!, && or ||) does not has a boolean argument
561 ptrnegate --- allow ! to be used on pointer operand
562 predassign --- condition test (if, while or for) is an assignment
563 predbool --- type of condition test (if, while or for) not bool (sets
564 predboolint, predboolptr and predboolothers)
565 predboolint --- type of condition test (if, while or for) is an integral type
566 predboolptr --- type of condition test (if, while or for) is a pointer
567 predboolothers --- type of condition test (if, while or for) not bool, int or
569 abstract --- data abstraction barriers
570 impabstract --- assume user type definitions are abstract (unless
571 /*@concrete@*/ is used)
572 accessmodule --- allow access to abstract types in definition module
573 accessfile --- allow access to abstract types by file name convention
574 accessczech --- allow access to abstract types by czech naming convention
575 accessslovak --- allow access to abstract types by slovak naming convention
576 accessczechoslovak --- allow access to abstract types by czechoslovak naming
578 accessall --- set accessmodule, accessfile and accessczech
579 mutrep --- representation of mutable type has sharing semantics
580 mustfreefresh --- freshly allocated storage not released before return or scope
582 mustfreeonly --- only storage not released before return or scope exit
583 mustfree --- fresh or only storage not released before return or scope exit
584 (sets mustfreefresh and mustfreeonly)
585 usereleased --- storage used after release
586 strictusereleased --- element used after it may have been released
587 compdestroy --- all only references derivable from void pointer out only
588 parameter are released
589 strictdestroy --- report complete destruction errors for array elements that
590 may have been released
591 deparrays --- array elements are dependent storage
592 branchstate --- storage has inconsistent states of alternate paths through a
594 strictbranchstate --- storage through array fetch has inconsistent states of
595 alternate paths through a branch
596 memchecks --- sets all dynamic memory checking flags (memimplicit, mustfree,
597 mustdefine, mustnotalias, null, memtrans)
598 compmempass --- actual parameter matches alias kind of formal parameter
600 stackref --- external reference to stack-allocated storage is created
601 memtrans --- memory transfer errors (sets all *trans flags)
602 dependenttrans --- dependent transfer errors
603 newreftrans --- new reference transfer to reference counted reference
604 onlytrans --- only storage transferred to non-only reference (memory leak)
605 onlyunqglobaltrans --- only storage transferred to an unqualified global or
606 static reference (memory leak)
607 ownedtrans --- owned storage transferred to non-owned reference (memory leak)
608 freshtrans --- fresh storage transferred to non-only reference (memory leak)
609 sharedtrans --- shared storage transferred to non-shared reference
610 temptrans --- temp storage transferred to non-temporary reference
611 kepttrans --- kept storage transferred to non-temporary reference
612 keeptrans --- keep storage transferred inconsistently
613 immediatetrans --- an immediate address (result of &) is transferred
615 refcounttrans --- reference counted storage is transferred in an inconsistent
617 statictrans --- static storage is transferred in an inconsistent way
618 unqualifiedtrans --- unqualified storage is transferred in an inconsistent way
619 staticinittrans --- static storage is used as an initial value in an
621 unqualifiedinittrans --- unqualified storage is used as an initial value in an
623 readonlytrans --- report memory transfer errors for initializations to
624 read-only string literals
625 passunknown --- passing a value as an un-annotated parameter clears its
627 readonlystrings --- string literals are read-only (error if one is modified or
629 memimp --- memory errors for unqualified storage
630 paramimptemp --- assume unannotated parameter is temp
631 allimponly --- sets globimponly, retimponly, structimponly, specglobimponly,
632 specretimponly and specstructimponly
633 codeimponly --- sets globimponly, retimponly and structimponly
634 specimponly --- sets specglobimponly, specretimponly and specstructimponly
635 globimponly --- assume unannotated global storage is only
636 retimponly --- assume unannotated returned storage is only
637 structimponly --- assume unannotated structure field is only
638 specglobimponly --- assume unannotated global storage is only
639 specretimponly --- assume unannotated returned storage is only
640 specstructimponly --- assume unannotated structure field is only
641 aliasunique --- unique parameter is aliased
642 mayaliasunique --- unique parameter may be aliased
643 mustnotalias --- temp storage aliased at return point or scope exit
644 retalias --- function returns alias to parameter or global
645 globalias --- function returns with global aliasing external state (sets
646 checkstrictglobalias, checkedglobalias, checkmodglobalias and
648 checkstrictglobalias --- function returns with a checkstrict global aliasing
650 checkedglobalias --- function returns with a checked global aliasing external
652 checkmodglobalias --- function returns with a checkmod global aliasing external
654 uncheckedglobalias --- function returns with an unchecked global aliasing
656 exposetrans --- exposure transfer errors
657 observertrans --- observer transfer errors
658 repexpose --- abstract representation is exposed (sets assignexpose, retexpose,
660 retexpose --- abstract representation is exposed (return values only)
661 assignexpose --- abstract representation is exposed (assignments only)
662 castexpose --- abstract representation is exposed through a cast
663 redundantsharequal --- declaration uses observer qualifier that is always true
664 misplacedsharequal --- declaration of unsharable storage uses sharing
666 mods --- unspecified modification of caller-visible state
667 mustmod --- specified modification is not detected
668 modobserver --- possible modification of observer storage
669 modobserveruncon --- possible modification of observer storage through
671 modinternalstrict --- possible modification of internal storage through
673 modfilesys --- report undocumented file system modifications (applies to
674 unspecified functions if modnomods is set)
675 modunspec --- modification in unspecified functions (sets modnomods,
676 modglobunspec and modstrictglobsunspec)
677 modnomods --- modification in a function with no modifies clause
678 moduncon --- possible modification through a call to an unconstrained function
679 modunconnomods --- possible modification through a call to an unconstrained
680 function in a function with no modifies clause
681 globsimpmodsnothing --- functions declared with a globals list but no modifies
682 clause are assumed to modify nothing
683 modsimpnoglobs --- functions declared with a modifies clause but no globals
684 list are assumed to use no globals
685 globstate --- returns with global in inconsistent state (null or undefined)
686 globs --- undocumented use of a checked global variable
687 globuse --- global listed for a function not used
688 internalglobs --- use of internalState
689 internalglobsnoglobs --- use of internalState (in function with no globals
691 warnmissingglobs --- global variable used in modifies clause is not listed in
693 warnmissingglobsnoglobs --- global variable used in modifies clause in a
694 function with no globals list
695 globnoglobs --- use of checked global in a function with no globals list or
697 allglobs --- report use and modification errors for globals not annotated with
699 checkstrictglobs --- report use and modification errors for checkedstrict
701 impcheckedspecglobs --- assume checked qualifier for unqualified global
702 declarations in .lcl files
703 impcheckmodspecglobs --- assume checkmod qualifier for unqualified global
704 declarations in .lcl files
705 impcheckedstrictspecglobs --- assume checkmod qualifier for unqualified global
706 declarations in .lcl files
707 impcheckedglobs --- assume checked qualifier for unqualified global
709 impcheckmodglobs --- assume checkmod qualifier for unqualified global
711 impcheckedstrictglobs --- assume checkedstrict qualifier for unqualified global
713 impcheckedstatics --- assume checked qualifier for unqualified file static
715 impcheckmodstatics --- assume checkmod qualifier for unqualified file static
717 impcheckmodinternals --- assume checkmod qualifier for unqualified local static
718 declarations (for internal state modifications)
719 impcheckedstrictstatics --- assume checkedstrict qualifier for unqualified file
721 modglobs --- undocumented modification of a checked global variable
722 modglobsnomods --- undocumented modification of a checked global variable in a
723 function declared with no modifies clause
724 modstrictglobsnomods --- undocumented modification of a strict checked global
725 variable in a function declared with no modifies clause
726 modglobsunchecked --- undocumented modification of an unchecked checked global
728 noret --- path with no return detected in non-void function
729 emptyreturn --- empty return in function declared to return value
730 alwaysexits --- loop predicate always exits
731 loopexec --- assume all loops execute at least once (sets forloopexec,
732 whileloopexec and iterloopexec)
733 forloopexec --- assume all for loops execute at least once
734 whileloopexec --- assume all while loops execute at least once
735 iterloopexec --- assume all iterator loops execute at least once
736 obviousloopexec --- assume loop that can be determined to always execute always
738 evalorder --- code has unspecified or implementation-dependent behavior because
739 of order of evaluation
740 evalorderuncon --- code involving call to unspecified function has undefined or
741 implementation-dependent behavior
742 infloops --- likely infinite loop is detected
743 infloopsuncon --- likely infinite loop is detected (may result from
744 unconstrained function)
745 casebreak --- non-empty case in a switch without preceding break
746 misscase --- switch on enum type missing case for some value
747 firstcase --- first statement in switch is not a case
748 duplicatecases --- duplicate cases in switch
749 deepbreak --- break inside nested while or for or switch
750 looploopbreak --- break inside nested while or for
751 switchloopbreak --- break in loop inside switch
752 loopswitchbreak --- break in switch inside loop
753 switchswitchbreak --- break in switch inside switch
754 looploopcontinue --- continue inside nested loop
755 whileempty --- a while statement has no body
756 whileblock --- the body of a while statement is not a block
757 forempty --- a for statement has no body
758 forblock --- the body of a for statement is not a block
759 ifempty --- an if statement has no body
760 ifblock --- the body of an if statement is not a block
761 allempty --- an if, while or for statement has no body (sets ifempty,
762 whileempty and forempty
763 allblock --- the body of an if, while or for statement is not a block (sets
764 ifblock, whileblock and forblock)
765 elseifcomplete --- if ... else if chains must have final else
766 unreachable --- unreachable code detected
767 noeffect --- statement with no effect
768 noeffectuncon --- statement with no effect (except possibly through call to
769 unconstrained function)
770 retval --- return value ignored (sets retvalint, retvalbool and retvalother)
771 retvalother --- return value of type other than bool or int ignored
772 retvalbool --- return value of manifest type bool ignored
773 retvalint --- return value of type int ignored
774 nullterminated --- misuse of nullterminated allocation
775 bounds --- memory bounds checking (sets boundsread and boundswrite)
776 boundsread --- possible out of bounds read
777 boundswrite --- possible buffer overflow from an out of bounds write
778 fcnpost --- display function post conditions
779 redundantconstraints --- display seemingly redundant constraints
780 checkpost --- unable to verify predicate in ensures clause
781 implictconstraint --- generate implicit constraints for functions
782 orconstraint --- use limited OR expressions to resolve constraints
783 nullterminated --- misuse of nullterminated allocation
784 showconstraintparens --- display parentheses around constraint terms
785 showconstraintlocation --- display location for every constraint generated
786 mts --- load meta state declaration and corresponding xh file
787 statetransfer --- storage has been transfered with invalid state
788 statemerge --- control paths merge with storage in incompatible states
789 macroredef --- macro redefined
790 macrounrecog --- unrecognized identifier in macro
791 macroconstdecl --- non-parameterized macro without prototype or specification
792 macrostmt --- macro definition is syntactically not equivalent to function
793 macroempty --- macro definition for is empty
794 macroparams --- macro parameter not used exactly once
795 macroreturn --- return statement in macro body
796 macroassign --- assignment to a macro parameter
797 macroparens --- macro parameter used without parentheses (in potentially
799 macrodecl --- macro without prototype or specification (sets macrofcndecl and
801 macrofcndecl --- parameterized macro without prototype or specification
802 sefparams --- a parameter with side-effects is passed as a sef parameter
803 sefuncon --- a parameter with unconstrained side-effects is passed as a sef
805 constmacros --- check all macros without parameter lists as constants
806 fcnmacros --- check all macros with parameter lists as functions
807 allmacros --- sets fcnmacros and constmacros
808 libmacros --- check all macros with declarations in library as functions
809 specmacros --- check all macros corresponding to specified functions or
811 macromatchname --- macro definition does not match iter or constant declaration
812 nextlinemacros --- the line after a constant or iter declaration must be a
814 iterbalance --- iter is not balanced with end_<iter>
815 iteryield --- iter yield parameter is inappropriate
816 hasyield --- iter declaration has no yield parameters
817 namechecks --- controls name checking without changing other settings
818 czech --- czech naming convention (sets accessczech, czechfunctions, czechvars,
819 czechconstants, czechenums, and czechmacros)
820 czechfcns --- czech naming convention violated in a function or iterator
822 czechvars --- czech naming convention violated in a variable declaration
823 czechmacros --- czech naming convention violated in an expanded macro name
824 czechconsts --- czech naming convention violated in a constant declaration
825 czechtypes --- czech naming convention violated in a user-defined type
827 slovak --- slovak naming convention violated
828 slovakfcns --- slovak naming convention violated in a function or iterator
830 slovakmacros --- slovak naming convention violated in an expanded macro name
831 slovakvars --- slovak naming convention violated in a variable declaration
832 slovakconsts --- slovak naming convention violated in a constant declaration
833 slovaktypes --- slovak naming convention violated in a use-defined type
835 czechoslovak --- czech or slovak naming convention violated
836 czechoslovakfcns --- czechoslovak naming convention violated in a function or
838 czechoslovakmacros --- czechoslovak naming convention violated in an expanded
840 czechoslovakvars --- czechoslovak naming convention violated in a variable
842 czechoslovakconsts --- czechoslovak naming convention violated in a constant
844 czechoslovaktypes --- czechoslovak naming convention violated in a user-defined
846 macrovarprefix --- set namespace prefix for variables declared in a macro body
847 macrovarprefixexclude --- the macrovarprefix may not be used for non-macro
849 tagprefix --- set namespace prefix for struct, union and enum tags
850 tagprefixexclude --- the tagprefix may not be used for non-tag identifiers
851 enumprefix --- set namespace prefix for enum members
852 enumprefixexclude --- the enumprefix may not be used for non-enum member
854 filestaticprefix --- set namespace prefix for file static declarations
855 filestaticprefixexclude --- the filestaticprefix may not be used for
856 identifiers that are not file static
857 globalprefix --- set namespace prefix for global variables
858 globalprefixexclude --- the globalprefix may not be used for non-global
860 typeprefix --- set namespace prefix for user-defined types
861 typeprefixexclude --- the typeprefix may not be used for identifiers that are
863 externalprefix --- set namespace prefix for external identifiers
864 externalprefixexclude --- the externalprefix may not be used for non-external
866 localprefix --- set namespace prefix for local variables
867 localprefixexclude --- the localprefix may not be used for non-local
869 uncheckedmacroprefix --- set namespace prefix for unchecked macros
870 uncheckedmacroprefixexclude --- the uncheckmacroprefix may not be used for
871 identifiers that are not unchecked macros
872 constprefix --- set namespace prefix for constants
873 constprefixexclude --- the constprefix may not be used for non-constant
875 iterprefix --- set namespace prefix for iterators
876 iterprefixexclude --- the iterprefix may not be used for non-iter identifiers
877 protoparamprefix --- set namespace prefix for parameters in function prototype
879 isoreserved --- external name conflicts with name reserved for system or
881 cppnames --- external or internal name is a C++ keyword or reserved word
882 isoreservedinternal --- internal name conflicts with name reserved for system
884 distinctexternalnames --- external name is not distinguishable from another
885 external name using the number of significant characters
886 externalnamelen --- set the number of significant characters in an external
888 externalnamecaseinsensitive --- alphabetic comparisons for external names are
890 distinctinternalnames --- internal name is not distinguishable from another
891 internal name using the number of significant characters
892 internalnamelen --- set the number of significant characters in an internal
894 internalnamecaseinsensitive --- set whether case is significant an internal
895 names (-internalnamecaseinsensitive means case is significant)
896 internalnamelookalike --- lookalike characters match in internal names
897 protoparamname --- a parameter in a function prototype has a name
898 protoparammatch --- the name of a parameter in a function prototype and
899 corresponding declaration must match (after removing the protoparamprefix
900 protoparamprefixexclude --- the protoparamprefix may not be used for
901 non-declaraction parameter identifiers
902 topuse --- declaration at top level not used
903 exportlocal --- a declaration is exported but not used outside this module
904 exportheader --- a declaration is exported but does not appear in a header file
905 exportheadervar --- a variable declaration is exported but does not appear in a
907 fielduse --- field of structure type not used
908 enummemuse --- member of an enum type not used
909 constuse --- constant declared but not used
910 fcnuse --- function declared but not used
911 paramuse --- function parameter not used
912 typeuse --- type declared but not used
913 varuse --- variable declared but not used
914 unusedspecial --- unused declaration in special file (corresponding to .l or .y
916 declundef --- function or variable declared but never defined
917 specundef --- function or variable specified but never defined
918 specundecl --- function or variable specified but never declared in a source
920 newdecl --- report new global declarations in source files
921 needspec --- information in specifications is not also included in syntactic
923 nolib --- do not load standard library
924 isolib --- use normal standard library
925 strictlib --- interpret standard library strictly
926 unixlib --- use UNIX (sort-of) standard library
927 unixstrictlib --- use strict version of UNIX (sort-of) library
928 posixlib --- use POSIX standard library
929 posixstrictlib --- use strict POSIX standard library
930 whichlib --- show standard library filename
931 warnposixheaders --- a POSIX header is included, but the POSIX library is not
933 warnunixlib --- warn when the unix library is used
934 usevarargs --- non-standard <varargs.h> included
935 dump --- save state for merging (default suffix .lcd)
936 load --- load state from dump file (default suffix .lcd)
937 singleinclude --- optimize header inclusion to eliminate redundant includes
938 neverinclude --- optimize header inclusion to not include any header files
939 skipsysheaders --- do not include header files in system directories (set by
941 gnuextensions --- support some gnu (gcc) language extensions
942 noparams --- function declaration has no parameter list
943 oldstyle --- old style function definition
944 maintype --- type of main does not match expected type
945 exitarg --- argument to exit has implementation defined behavior
946 shadow --- declaration reuses name visible in outer scope
947 incondefslib --- function, variable or constant defined in a library is
948 redefined with inconsistent type
949 overload --- library function overloaded
950 nestedextern --- an extern declaration is inside a function scope
951 redecl --- function or variable redeclared
952 redef --- function or variable redefined
953 imptype --- variable declaration has unknown (implicitly int) type
954 tmpdir --- set directory for writing temp files
955 larchpath --- set path for searching for library files (overrides LARCH_PATH
956 environment variable)
957 lclimportdir --- set directory to search for LCL import files (overrides
959 sysdirs --- set directories for system files (default /usr/include). Separate
960 directories with path separator (colons in Unix, semi-colons in Windows). Flag
961 settings propagate to files in a system directory. If -sysdirerrors is set, no
962 errors are reported for files in system directories.
963 skipansiheaders --- prevent inclusion of header files in a system directory
964 with names that match standard ANSI headers. The symbolic information in the
965 standard library is used instead. Flag in effect only if a library including
966 the ANSI library is loaded. The ANSI headers are:
967 assert, ctype, errno, float, limits, locale, math, setjmp, signal, stdarg,
968 stddef, stdio, stdlib, strings, string, time, and wchar.
969 skipposixheaders --- prevent inclusion of header files in a system directory
970 with names that match standard POSIX headers. The symbolic information in the
971 posix library is used instead. The POSIX headers are:
972 dirent, fcntl, grp, pwd, termios, sys/stat, sys/times, sys/types, sys/utsname,
973 sys/wait, unistd, and utime.
974 sysdirerrors --- report errors in files in system directories (set by -sysdirs)
975 sysdirexpandmacros --- expand macros in system directories regardless of other
976 settings, except for macros corresponding to names defined in a load library
977 I<directory> --- add to C include path
978 S<directory> --- add to spec path
979 exportany --- variable, function or type exported but not specified
980 exportfcn --- function exported but not specified
981 exportmacro --- expanded macro exported but not specified
982 exporttype --- type definition exported but not specified
983 exportvar --- variable exported but not specified
984 exportconst --- constant exported but not specified
985 exportiter --- constant exported but not specified
986 linelen --- set length of messages (number of chars)
987 indentspaces --- set number of spaces to indent sub-messages
988 showcolumn --- show column number where error is found
989 parenfileformat --- show column number where error is found
990 showfunc --- show name of function containing error
991 showallconjs --- show all possible types
992 impconj --- make all alternate types implicit (useful for making system
994 expect --- expect <int> code errors
995 lclexpect --- expect <int> spec errors
996 partial --- check as partial system (-specundef, -declundef, -exportlocal,
997 don't check macros in headers without corresponding .c files)
998 lh --- generate .lh files
999 lcs --- generate .lcs files
1000 warnflags --- warn when command line sets flag in abnormal way
1001 warnrc --- warn when there are problems with reading the initialization files
1002 badflag --- warn about bad command line flags
1003 fileextensions --- warn when command line file does not have a recognized
1005 help --- -help <flags> will describe flags
1006 f --- read an options file (default ~/.splintrc not loaded)
1007 i --- set LCL initilization file
1008 nof --- do not read options file
1009 commentchar --- set marker character for syntactic comments (default is '@')
1010 controlnestdepth --- set maximum nesting depth of compound statements,
1011 iteration control structures, and selection control structures (ANSI89 minimum
1013 stringliterallen --- set maximum length of string literals (ANSI89 minimum is
1015 numstructfields --- set maximum number of fields in a struct or union (ANSI89
1016 minimum is 127; ISO99 is 1023)
1017 numenummembers --- set maximum number of members of an enum (ANSI89 minimum is
1019 includenest --- set maximum number of nested #include files (ANSI89 minimum is
1021 ansi89limits --- check for violations of standard limits (controlnestdepth,
1022 stringliterallen, includenest, numstructfields, numenummembers) based on ANSI89
1024 iso99limits --- check for violations of standard limits (controlnestdepth,
1025 stringliterallen, includenest, numstructfields, numenummembers) based on ISO99
1027 D<initializer> --- passed to pre-processor
1028 U<initializer> --- passed to pre-processor
1029 unrecogdirective --- unrecognized pre-processor directive
1030 supcounts --- The number of errors detected does not match number in
1032 limit --- limit <int> consecutive repeated errors
1033 syntax --- syntax error in parsing
1034 trytorecover --- try to recover from parse error
1035 preproc --- preprocessing error
1036 type --- type mismatch
1037 stringliteraltoolong --- string literal too long for character array
1038 stringliteralnoroom --- string literal leaves no room for null terminator
1039 stringliteralsmaller --- string literal is smaller than the char array it is
1041 enummembers --- enum members must be int values
1042 formattype --- type-mismatch in parameter corresponding to format code in a
1043 printf or scanf-like function
1044 formatconst --- format parameter is not a string constant (hence variable
1045 arguments cannot be typechecked)
1046 formatcode --- invalid format code in format string for printf or scanf-like
1048 forwarddecl --- forward declarations of pointers to abstract representation
1050 voidabstract --- void * matches pointers to abstract types, casting ok
1052 castfcnptr --- a pointer to a function is cast to a pointer to void (or vice
1054 charindex --- char can be used to index arrays
1055 enumindex --- enum can be used to index arrays
1056 boolint --- bool and int are equivalent
1057 charint --- char and int are equivalent
1058 enumint --- enum and int are equivalent
1059 floatdouble --- float and double are equivalent
1060 ignorequals --- ignore type qualifiers (long, short, unsigned)
1061 duplicatequals --- report duplicate type qualifiers (e.g., unsigned unsigned)
1062 ignoresigns --- ignore signs in type comparisons (unsigned matches signed)
1063 numliteral --- int literals can be reals
1064 charintliteral --- character constants (e.g., 'a') can be used as ints
1065 relaxquals --- report qualifier mismatches only if dangerous
1066 relaxtypes --- allow all numeric types to match
1067 charunsignedchar --- allow char and unsigned char types to match
1068 matchanyintegral --- allow any intergral type to match an arbitrary integral
1070 longunsignedintegral --- allow long unsigned type to match an arbitrary
1071 integral type (e.g., dev_t)
1072 longintegral --- allow long type to match an arbitrary integral type (e.g.,
1074 longunsignedunsignedintegral --- allow long unsigned type to match an arbitrary
1075 unsigned integral type (e.g., size_t)
1076 longsignedintegral --- allow long type to match an arbitrary signed integral
1077 type (e.g., ssize_t)
1078 zeroptr --- tread 0 as a pointer
1079 zerobool --- treat 0 as a boolean
1080 repeatunrecog --- do not suppress repeated unrecognized identifier messages
1081 (instead of only reporting the first error)
1082 sysunrecog --- report unrecognized identifiers with system (__) prefix
1083 unrecog --- unrecognized identifier
1084 annotationerror --- annotation is used in inconsistent location
1085 commenterror --- inconsistent syntactic comment
1086 warnuse --- warn when declaration marked with warn is used
1087 bufferoverflow --- possible buffer overflow vulnerability
1088 bufferoverflowhigh --- likely buffer overflow vulnerability
1089 implementationoptional --- declarator is implementation optional (ISO99 does
1090 not require an implementation to provide it)
1091 legacy --- legacy declaration in Unix Standard
1092 multithreaded --- function is not reentrant
1093 portability --- function may have undefined behavior
1094 superuser --- function is restricted to superusers
1095 toctou --- possible time of check, time of use vulnerability
1096 unixstandard --- function is not required in Standard UNIX Specification
1097 its4mostrisky --- most risky security vulnerabilities (from its4 database)
1098 its4veryrisky --- very risky security vulnerabilities (from its4 database)
1099 its4risky --- risky security vulnerabilities (from its4 database)
1100 its4moderate --- moderately risky security vulnerabilities (from its4 database)
1101 its4low --- risky security vulnerabilities (from its4 database)
1102 nocomments --- ignore all stylized comments
1103 noaccess --- ignore access comments
1104 unrecogcomments --- stylized comment is unrecognized
1105 unrecogflagcomments --- stylized flag comment uses an unrecognized flag
1106 tmpcomments --- interpret t comments (ignore errors in lines marked with
1108 lintcomments --- interpret traditional lint comments (/*FALLTHROUGH*/,
1110 warnlintcomments --- warn when a traditional lint comment is used
1111 continuecomment --- line continuation marker (\) in comment before */ on same
1113 slashslashcomment --- use of // comment
1114 nestcomment --- comment begins inside comment
1115 quiet --- suppress herald and error count
1116 usestderr --- send error messages to standard error (instead of standard out)
1117 showsummary --- show summary of all errors reported and suppressed
1118 showscan --- show file names are they are processed
1119 stats --- display lines processed and time
1120 timedist --- display time distribution
1121 showalluses --- show sorted list of uses of all globals
1122 hints --- provide a hint the first time a particular warning appears
1123 forcehints --- provide a hint for every warnings
1124 bugslimit --- set maximum number of bugs detected before giving up
1125 debugfcnconstraint --- debug function constraints
1126 grammar --- debug parsing
1127 keep --- do not delete temporary files
1128 nopp --- do not pre-process input files
1129 showsourceloc --- display the source code location where a warning is produced
1133 passed to pre-processor
1139 add to C include path
1140 Categories: directories, headers
1146 Categories: directories, specifications
1151 passed to pre-processor
1157 data abstraction barriers
1161 An abstraction barrier is broken. If necessary, use /*@access <type>@*/
1162 to allow access to an abstract type.
1165 set accessmodule, accessfile and accessczech
1166 Categories: abstract, names
1169 Sets accessmodule, accessfile and accessczech
1172 allow access to abstract types by czech naming convention
1173 Categories: abstract, names
1176 The representation of an abstract type named <t> is accessible in the
1177 definition of a function or constant named <t>_<name>
1180 allow access to abstract types by czechoslovak naming convention
1181 Categories: abstract, names
1184 The representation of an abstract type named <t> is accessible in the
1185 definition of a function or constant named <t>_<name> or <t><Name>
1188 allow access to abstract types by file name convention
1189 Categories: abstract, names
1192 The representation of an abstract type named <t> is accessible anywhere
1193 in a file named <t>.<x>.
1196 allow access to abstract types in definition module
1197 Categories: abstract, names
1200 The representation of an abstract type defined in <M>.<x> is accessible
1201 anywhere in a file named <M>.<y>.
1204 allow access to abstract types by slovak naming convention
1205 Categories: abstract, names
1208 The representation of an abstract type named <t> is accessible in the
1209 definition of a function or constant named <t><Name>
1212 unique parameter is aliased
1213 Categories: aliasing, memory
1216 A unique or only parameter is aliased by some other parameter or visible
1220 the body of an if, while or for statement is not a block (sets ifblock,
1221 whileblock and forblock)
1222 Category: controlflow
1225 Body is a single statement, not a compound block.
1228 an if, while or for statement has no body (sets ifempty, whileempty and
1230 Category: controlflow
1235 report use and modification errors for globals not annotated with unchecked
1236 Categories: globals, implicit
1241 sets globimponly, retimponly, structimponly, specglobimponly, specretimponly
1242 and specstructimponly
1243 Categories: memory, implicit
1248 sets fcnmacros and constmacros
1252 All macros (not preceded by /*@notfunction@*/) are checked as functions
1253 or constants depending on whether or not they have parameter lists.
1256 loop predicate always exits
1257 Category: controlflow
1262 annotation is used in inconsistent location
1263 Categories: declarations,
1266 A declaration uses an invalid annotation.
1269 check for violations of standard limits (controlnestdepth, stringliterallen,
1270 includenest, numstructfields, numenummembers) based on ANSI89 standard
1271 Categories: limits, ansi
1276 abstract representation is exposed (assignments only)
1277 Categories: exposure, abstract
1280 Storage internal to the representation of an abstract type is assigned to
1281 an external pointer. This means clients may have access to a pointer into
1282 the abstract representation. If the external pointer is a parameter, the
1283 exposed qualifier can be used to allow the assignment, however, this is
1284 considered dangerous programming practice.
1287 warn about bad command line flags
1291 A flag is not recognized or used in an incorrect way
1294 a bitwise logical operator does not have unsigned operands
1295 Categories: operations,
1298 An operand to a bitwise operator is not an unsigned values. This may
1299 have unexpected results depending on the signed representations.
1302 comparison between bools (dangerous because of multiple TRUE values)
1303 Categories: booleans, operations
1306 Two bool values are compared directly using a C primitive. This may
1307 produce unexpected results since all non-zero values are considered TRUE,
1308 so different TRUE values may not be equal. The file bool.h (included in
1309 splint/lib) provides bool_equal for safe bool comparisons.
1312 set name of boolean false (default FALSE)
1316 String argument. Default: FALSE
1319 bool and int are equivalent
1320 Categories: typeequivalence, booleans
1323 To make bool and int types equivalent, use +boolint.
1326 primitive operation (!, && or ||) does not has a boolean argument
1327 Categories: booleans, operations
1330 The operand of a boolean operator is not a boolean. Use +ptrnegate to
1331 allow ! to be used on pointers.
1334 set name of boolean true (default TRUE)
1338 String argument. Default: TRUE
1341 set name of boolean type (default bool)
1345 String argument. Default: lltX_bool
1348 memory bounds checking (sets boundsread and boundswrite)
1349 Categories: memorybounds, memory
1352 Memory read or write may be out of bounds of allocated storage.
1355 possible out of bounds read
1356 Categories: memorybounds, memory
1359 A memory read references memory beyond the allocated storage.
1362 possible buffer overflow from an out of bounds write
1363 Categories: memorybounds, memory
1366 A memory write may write to an address beyond the allocated buffer.
1369 storage has inconsistent states of alternate paths through a branch
1373 The state of a variable is different depending on which branch is taken.
1374 This means no annotation can sensibly be applied to the storage.
1377 possible buffer overflow vulnerability
1378 Categories: warnuse, security
1381 Use of function that may lead to buffer overflow.
1384 likely buffer overflow vulnerability
1385 Categories: warnuse, security
1388 Use of function that may lead to buffer overflow.
1391 set maximum number of bugs detected before giving up
1395 Numeric Argument. Default: 3
1398 non-empty case in a switch without preceding break
1399 Category: controlflow
1402 Execution falls through from the previous case.
1405 abstract representation is exposed through a cast
1406 Categories: exposure, abstract
1409 Storage internal to the representation of an abstract type is exposed
1410 through a type cast. This means clients may have access to a pointer into
1411 the abstract representation.
1414 a pointer to a function is cast to a pointer to void (or vice versa)
1415 Categories: typeequivalence, pointers
1418 A pointer to a function is cast to (or used as) a pointer to void (or
1422 char can be used to index arrays
1423 Categories: typeequivalence, arrays
1426 To allow char types to index arrays, use +charindex.
1429 char and int are equivalent
1430 Category: typeequivalence
1433 To make char and int types equivalent, use +charint.
1436 character constants (e.g., 'a') can be used as ints
1437 Categories: typeequivalence, numbers
1440 A character constant is used as an int. Use +charintliteral to allow
1441 character constants to be used as ints. (This is safe since the actual
1442 type of a char constant is int.)
1445 allow char and unsigned char types to match
1446 Category: typeequivalence
1449 To allow char and unsigned char types to match use +charunsignedchar.
1452 function returns with a checked global aliasing external state
1453 Categories: aliasing, globals
1456 A global variable aliases externally-visible state when the function
1460 function returns with a checkmod global aliasing external state
1461 Categories: aliasing, globals
1464 A global variable aliases externally-visible state when the function
1468 unable to verify predicate in ensures clause
1469 Categories: memorybounds, memory
1472 The function implementation may not satisfy a post condition given in an
1475 checkstrictglobalias
1476 function returns with a checkstrict global aliasing external state
1477 Categories: aliasing, globals
1480 A global variable aliases externally-visible state when the function
1484 report use and modification errors for checkedstrict globals
1485 Categories: globals, unconstrained
1490 sets globimponly, retimponly and structimponly
1491 Categories: memory, implicit
1496 set marker character for syntactic comments (default is '@')
1497 Categories: initializations, comments
1500 Character Argument. Default: @
1501 Set the marker character for syntactic comments. Comments beginning with
1502 /*<char> are interpreted by Splint, where <char> is the comment marker
1506 inconsistent syntactic comment
1507 Categories: declarations,
1510 A syntactic comment is used inconsistently.
1513 parameter, return value or global completely defined
1514 Categories: memory, definition
1517 Storage derivable from a parameter, return value or global is not
1518 defined. Use /*@out@*/ to denote passed or returned storage which need
1522 all only references derivable from void pointer out only parameter are
1524 Categories: memory, leaks
1527 A storage leak due to incomplete deallocation of a structure or deep
1528 pointer is suspected. Unshared storage that is reachable from a reference
1529 that is being deallocated has not yet been deallocated. Splint assumes
1530 when an object is passed as an out only void pointer that the outer
1531 object will be deallocated, but the inner objects will not.
1534 actual parameter matches alias kind of formal parameter completely
1535 Categories: memory, definition
1538 Storage derivable from a parameter does not match the alias kind expected
1539 for the formal parameter.
1542 check all macros without parameter lists as constants
1546 Every non-parameterized macro (not preceded by /*@notfunction@*/) is
1547 checked as a constant.
1550 set namespace prefix for constants
1551 Categories: names, prefixes
1554 String argument. No default.
1555 A constant does not start with the constantprefix
1558 the constprefix may not be used for non-constant identifiers
1559 Categories: names, prefixes
1562 An identifier that is not a constant starts with the constantprefix.
1565 constant declared but not used
1569 A constant is declared but not used. Use unused in the constant
1570 declaration to suppress message.
1573 line continuation marker (\) in comment before */ on same line
1574 Categories: comments,
1577 A line continuation marker (\) appears inside a comment on the same line
1578 as the comment close. Preprocessors should handle this correctly, but it
1579 causes problems for some preprocessors.
1582 set maximum nesting depth of compound statements, iteration control
1583 structures, and selection control structures (ANSI89 minimum is 15;
1585 Categories: limits, ansi
1588 Numeric Argument. Default: 63
1589 Maximum number of control levels exceeded.
1592 external or internal name is a C++ keyword or reserved word
1593 Categories: names, ansi
1596 External name is a C++ keyword or reserved word. This could lead to
1597 problems if the code is compiled with a C++ compiler.
1600 czech naming convention (sets accessczech, czechfunctions, czechvars,
1601 czechconstants, czechenums, and czechmacros)
1602 Categories: names, abstract
1605 Name is not consistent with Czech naming convention.
1608 czech naming convention violated in a constant declaration
1609 Categories: names, abstract
1612 Constant name is not consistent with Czech naming convention.
1615 czech naming convention violated in a function or iterator declaration
1616 Categories: names, abstract
1619 Function or iterator name is not consistent with Czech naming convention.
1622 czech naming convention violated in an expanded macro name
1623 Categories: names, abstract
1626 Expanded macro name is not consistent with Czech naming convention.
1629 czech or slovak naming convention violated
1630 Categories: names, abstract
1633 Name is not consistent with either Czech or Slovak naming convention.
1636 czechoslovak naming convention violated in a constant declaration
1637 Categories: names, abstract
1640 Constant name is not consistent with Czechoslovak naming convention.
1643 czechoslovak naming convention violated in a function or iterator
1645 Categories: names, abstract
1648 Function name is not consistent with Czechoslovak naming convention.
1651 czechoslovak naming convention violated in an expanded macro name
1652 Categories: names, abstract
1655 Expanded macro name is not consistent with Czechoslovak naming
1659 czechoslovak naming convention violated in a user-defined type definition
1660 Categories: names, abstract
1663 Type name is not consistent with Czechoslovak naming convention.
1664 Czechoslovak type names may not include uppercase letters or the
1665 underscore character.
1668 czechoslovak naming convention violated in a variable declaration
1669 Categories: names, abstract
1672 Variable name is not consistent with Czechoslovak naming convention.
1675 czech naming convention violated in a user-defined type definition
1676 Categories: names, abstract
1679 Type name is not consistent with Czech naming convention. Czech type
1680 names must not use the underscore character.
1683 czech naming convention violated in a variable declaration
1684 Categories: names, abstract
1687 Variable name is not consistent with Czech naming convention.
1690 debug function constraints
1691 Categories: debug, memorybounds
1694 Perform buffer overflow checking even if the errors would be surpressed.
1697 function or variable declared but never defined
1701 A function or variable is declared, but not defined in any source code
1705 break inside nested while or for or switch
1706 Category: controlflow
1709 A break statement appears inside the body of a nested while, for or
1710 switch statement. Sets looploopbreak, loopswitchbreak, switchloopbreak,
1711 switchswitchbreak, and looploopcontinue.
1714 array elements are dependent storage
1715 Categories: memory, arrays
1718 When an element is fetched from an array, Splint analysis is not able to
1719 determine if the same element is reused. If +deparrays, Splint will mark
1720 local storage assigned from array fetches as dependent.
1723 dependent transfer errors
1727 Dependent storage is transferred to a non-dependent reference.
1729 distinctexternalnames
1730 external name is not distinguishable from another external name using the
1731 number of significant characters
1732 Categories: names, ansi
1735 An external name is not distinguishable from another external name using
1736 the number of significant characters. According to ANSI Standard (3.1),
1737 an implementation may only consider the first 6 characters significant,
1738 and ignore alphabetical case distinctions (ISO C99 requires 31). The
1739 +externalnamelen <n> flag may be used to change the number of significant
1740 characters, and -externalnamecaseinsensitive to make alphabetical case
1741 significant in external names.
1743 distinctinternalnames
1744 internal name is not distinguishable from another internal name using the
1745 number of significant characters
1746 Categories: names, ansi
1749 An internal name is not distinguishable from another internal name using
1750 the number of significant characters. According to ANSI89 Standard (3.1),
1751 an implementation may only consider the first 31 characters significant
1752 (ISO C99 specified 63). The +internalnamelen <n> flag changes the number
1753 of significant characters, -internalnamecaseinsensitive to makes
1754 alphabetical case significant, and +internalnamelookalike to make
1755 similar-looking characters non-distinct.
1758 save state for merging (default suffix .lcd)
1759 Categories: libraries, files
1762 Filename argument. No default.
1765 duplicate cases in switch
1766 Category: controlflow
1769 Duplicate cases in switch.
1772 report duplicate type qualifiers (e.g., unsigned unsigned)
1773 Categories: typeequivalence,
1776 Duplicate type qualifiers not supported by ISO standard.
1779 if ... else if chains must have final else
1780 Category: controlflow
1783 There is no final else following an else if construct.
1785 emptyreturn: <invalid flag>
1788 enum can be used to index arrays
1789 Categories: typeequivalence, arrays
1792 To allow enum types to index arrays, use +enumindex.
1795 enum and int are equivalent
1796 Category: typeequivalence
1799 To make enum and int types equivalent, use +enumint.
1802 enum members must be int values
1805 Type of initial values for enum members must be int.
1808 member of an enum type not used
1812 A member of an enum type is never used.
1815 set namespace prefix for enum members
1816 Categories: names, prefixes
1819 String argument. No default.
1820 An enum member does not start with the enumprefix.
1823 the enumprefix may not be used for non-enum member identifiers
1824 Categories: names, prefixes
1827 An identifier that is not an enum member starts with the enumprefix.
1830 code has unspecified or implementation-dependent behavior because of order
1832 Categories: undefined, ansi
1835 Code has unspecified behavior. Order of evaluation of function parameters
1836 or subexpressions is not defined, so if a value is used and modified in
1837 different places not separated by a sequence point constraining
1838 evaluation order, then the result of the expression is unspecified.
1841 code involving call to unspecified function has undefined or
1842 implementation-dependent behavior
1843 Categories: undefined, ansi
1846 Code involving a call to function with no modifies or globals clause may
1847 have undefined or implementation-dependent behavior (Splint assumes the
1848 unconstrained call may modify any reachable state or use any global). Add
1849 a specification for the function.
1852 argument to exit has implementation defined behavior
1853 Categories: systemfunctions, undefined
1856 The argument to exit should be 0, EXIT_SUCCESS or EXIT_FAILURE
1859 expect <int> code errors
1860 Categories: <No Category>, errors
1863 Numeric Argument. Default: 0
1866 variable, function or type exported but not specified
1867 Categories: export, specifications
1870 A variable, function or type is exported, but not specified.
1873 constant exported but not specified
1874 Categories: export, specifications
1877 A constant is exported, but not specified.
1880 function exported but not specified
1881 Categories: export, specifications
1884 A function is exported, but not specified.
1887 a declaration is exported but does not appear in a header file
1888 Categories: alluse, export
1891 A declaration is exported, but does not appear in a header file.
1894 a variable declaration is exported but does not appear in a header file
1895 Categories: alluse, export
1898 A variable declaration is exported, but does not appear in a header file.
1899 (Used with exportheader.)
1902 constant exported but not specified
1903 Categories: export, specifications
1906 A constant is exported, but not specified.
1909 a declaration is exported but not used outside this module
1910 Categories: alluse, export
1913 A declaration is exported, but not used outside this module. Declaration
1914 can use static qualifier.
1917 expanded macro exported but not specified
1918 Categories: export, specifications
1921 A macro is exported, but not specified.
1924 type definition exported but not specified
1925 Categories: export, specifications
1928 A type is exported, but not specified.
1931 variable exported but not specified
1932 Categories: export, specifications
1935 A variable is exported, but not specified.
1938 exposure transfer errors
1942 Exposed storage is transferred to a non-exposed, non-observer reference.
1944 externalnamecaseinsensitive
1945 alphabetic comparisons for external names are case-insensitive
1946 Categories: names, ansi
1949 Make alphabetic case insignificant in external names. By ANSI89 standard,
1950 case need not be significant in an external name. If +distinctexternalname
1951 s is not set, sets +distinctexternalnames with unlimited external name
1955 set the number of significant characters in an external name
1956 Categories: names, ansi
1959 Numeric Argument. Default: 31
1960 Sets the number of significant characters in an external name (default is
1961 6 for old ANSI89 limit, C99 requires 31). Sets +distinctexternalnames.
1964 set namespace prefix for external identifiers
1965 Categories: names, prefixes
1968 String argument. No default.
1969 An external identifier does not start with the externalprefix
1971 externalprefixexclude
1972 the externalprefix may not be used for non-external identifiers
1973 Categories: names, prefixes
1976 An identifier that is not external starts with the externalprefix.
1979 read an options file (default ~/.splintrc not loaded)
1980 Categories: initializations, files
1983 Filename argument. No default.
1984 Read an options file (instead of loading default ~/.splintc)
1987 dereferencce of a function type
1990 A function type is dereferenced. The ANSI standard allows this because
1991 of implicit conversion of function designators, however the dereference
1995 check all macros with parameter lists as functions
1999 Every parameterized macro (not preceded by /*@notfunction@*/) is checked
2003 display function post conditions
2004 Categories: memorybounds, display
2007 Display function post conditions.
2010 function declared but not used
2014 A function is declared but not used. Use /*@unused@*/ in front of
2015 function header to suppress message.
2018 field of structure type not used
2022 A field is present in a structure type but never used. Use /*@unused@*/
2023 in front of field declaration to suppress message.
2026 warn when command line file does not have a recognized extension
2032 set namespace prefix for file static declarations
2033 Categories: names, prefixes
2036 String argument. No default.
2037 A file-static identifier does not start with the filestaticprefix.
2039 filestaticprefixexclude
2040 the filestaticprefix may not be used for identifiers that are not file
2042 Categories: names, prefixes
2045 An identifier that is not file static starts with the filestaticprefix.
2048 first statement in switch is not a case
2049 Category: controlflow
2052 The first statement after a switch is not a case.
2055 formal parameter of type array is declared with size
2056 Categories: declarations,
2059 A formal parameter is declared as an array with size. The size of the
2060 array is ignored in this context, since the array formal parameter is
2061 treated as a pointer.
2064 float and double are equivalent
2065 Category: typeequivalence
2068 To make float and double types equivalent, use +floatdouble.
2071 the body of a for statement is not a block
2072 Category: controlflow
2075 Loop body is a single statement, not a compound block.
2078 provide a hint for every warnings
2079 Categories: hints, format
2082 Provide a hint for every warning
2085 a for statement has no body
2086 Category: controlflow
2089 For statement has no body.
2092 assume all for loops execute at least once
2093 Categories: controlflow, memory
2098 formal parameter is an array
2099 Categories: declarations,
2102 A formal parameter is declared as an array. This can be confusing, since
2103 a formal array parameter is treated as a pointer.
2106 invalid format code in format string for printf or scanf-like function
2109 Format code in a format string is not valid.
2112 format parameter is not a string constant (hence variable arguments cannot
2116 Format parameter is not known at compile-time. This can lead to security
2117 vulnerabilities because the arguments cannot be type checked.
2120 type-mismatch in parameter corresponding to format code in a printf or
2124 Type of parameter is not consistent with corresponding code in format
2128 forward declarations of pointers to abstract representation match abstract
2130 Categories: typeequivalence, abstract
2135 fresh storage transferred to non-only reference (memory leak)
2139 Fresh storage (newly allocated in this function) is transferred in a way
2140 that the obligation to release storage is not propagated. Use the
2141 /*@only@*/ annotation to indicate the a return value is the only
2142 reference to the returned storage.
2145 initializer sets all fields
2146 Category: definition
2149 Initializer does not set every field in the structure.
2152 function returns with global aliasing external state (sets
2153 checkstrictglobalias, checkedglobalias, checkmodglobalias and
2155 Categories: aliasing, globals
2158 A global variable aliases externally-visible state when the function
2162 set namespace prefix for global variables
2163 Categories: names, prefixes
2166 String argument. No default.
2167 A global variable does not start with the globalprefix
2170 the globalprefix may not be used for non-global identifiers
2171 Categories: names, prefixes
2174 An identifier that is not a global variable starts with the globalprefix.
2177 assume unannotated global storage is only
2178 Categories: memory, implicit
2183 use of checked global in a function with no globals list or specification
2184 Categories: globals, unconstrained
2187 A specified global variable is used in the function, but not listed in
2188 its globals list. Without +globnoglobs, only globals declared with
2189 /*@checkedstrict@*/ will produce use errors in functions without globals
2190 lists. The /*@globals ... @*/ control comment can be used to give a
2191 globals list for an unspecified function.
2194 undocumented use of a checked global variable
2195 Categories: globals, specifications
2198 A checked global variable is used in the function, but not listed in its
2199 globals clause. By default, only globals specified in .lcl files are
2200 checked. To check all globals, use +allglobals. To check globals
2201 selectively use /*@checked@*/ in the global declaration.
2204 functions declared with a globals list but no modifies clause are assumed to
2206 Categories: modification, globals
2209 An implicit modifies nothing clause is assumed for a function declared
2210 with a globals list but not modifies clause.
2213 returns with global in inconsistent state (null or undefined)
2217 A global variable does not satisfy its annotations when control is
2221 global listed for a function not used
2222 Categories: globals, specifications
2225 A global variable listed in the function's globals list is not used in
2226 the body of the function.
2229 support some gnu (gcc) language extensions
2233 ANSI C does not allow some language features supported by gcc and other
2234 compilers. Use +gnuextensions to allow some of these extensions.
2243 iter declaration has no yield parameters
2247 An iterator has been declared with no parameters annotated with yield.
2248 This may be what you want, if the iterator is meant to do something a
2249 fixed number of times, but returns no information to the calling context.
2250 Probably, a parameter is missing the yield annotation to indicate that it
2251 is assigned a value in the calling context.
2254 -help <flags> will describe flags
2261 provide a hint the first time a particular warning appears
2262 Categories: hints, format
2265 Provide a hint the first time a particular warning appears
2268 set LCL initilization file
2269 Categories: initializations, files
2272 Filename argument. No default.
2275 the body of an if statement is not a block
2276 Category: controlflow
2279 If body is a single statement, not a compound block.
2282 an if statement has no body
2283 Category: controlflow
2286 If statement has no body.
2289 ignore type qualifiers (long, short, unsigned)
2290 Categories: typeequivalence, numbers
2293 To ignore type qualifiers in type comparisons use +ignorequals.
2296 ignore signs in type comparisons (unsigned matches signed)
2297 Categories: typeequivalence, numbers
2300 To ignore signs in type comparisons use +ignoresigns
2303 an immediate address (result of &) is transferred inconsistently
2307 An immediate address (result of & operator) is transferred
2311 assume user type definitions are abstract (unless /*@concrete@*/ is used)
2312 Categories: abstract, implicit
2317 assume checked qualifier for unqualified global declarations
2318 Categories: globals, unconstrained
2323 assume checked qualifier for unqualified global declarations in .lcl files
2324 Categories: globals, unconstrained
2329 assume checked qualifier for unqualified file static declarations
2330 Categories: globals, unconstrained
2334 impcheckedstrictglobs
2335 assume checkedstrict qualifier for unqualified global declarations
2336 Categories: globals, unconstrained
2340 impcheckedstrictspecglobs
2341 assume checkmod qualifier for unqualified global declarations in .lcl files
2342 Categories: globals, unconstrained
2346 impcheckedstrictstatics
2347 assume checkedstrict qualifier for unqualified file static declarations
2348 Categories: globals, unconstrained
2353 assume checkmod qualifier for unqualified global declarations
2354 Categories: globals, unconstrained
2358 impcheckmodinternals
2359 assume checkmod qualifier for unqualified local static declarations (for
2360 internal state modifications)
2361 Categories: globals, unconstrained
2365 impcheckmodspecglobs
2366 assume checkmod qualifier for unqualified global declarations in .lcl files
2367 Categories: globals, unconstrained
2372 assume checkmod qualifier for unqualified file static declarations
2373 Categories: globals, unconstrained
2378 make all alternate types implicit (useful for making system libraries
2383 implementationoptional
2384 declarator is implementation optional (ISO99 does not require an
2385 implementation to provide it)
2386 Categories: warnuse, security
2389 Use of a declarator that is implementation optional, not required by
2393 generate implicit constraints for functions
2394 Categories: memorybounds, memory
2399 pointer parameters to unspecified functions may be implicit out parameters
2400 Categories: definition, implicit
2405 variable declaration has unknown (implicitly int) type
2406 Categories: declarations,
2409 A variable declaration has no explicit type. The type is implicitly int.
2412 set maximum number of nested #include files (ANSI89 minimum is 8;
2414 Categories: limits, ansi
2417 Numeric Argument. Default: 63
2418 Maximum number of nested #include files exceeded.
2421 formal parameter has an incomplete type
2422 Categories: declarations,
2425 A formal parameter is declared with an incomplete type.
2428 function, variable or constant redefined with inconsistent type
2429 Categories: declarations,
2432 A function, variable or constant is redefined with a different type.
2435 function, variable or constant defined in a library is redefined with
2437 Categories: declarations, libraries
2440 A function, variable or constant previously defined in a library is
2441 redefined with a different type.
2444 set number of spaces to indent sub-messages
2445 Categories: format, display
2448 Numeric Argument. Default: 3
2451 likely infinite loop is detected
2452 Category: controlflow
2455 This appears to be an infinite loop. Nothing in the body of the loop or
2456 the loop test modifies the value of the loop test. Perhaps the
2457 specification of a function called in the loop body is missing a
2461 likely infinite loop is detected (may result from unconstrained function)
2462 Category: controlflow
2465 This appears to be an infinite loop. Nothing in the body of the loop or
2466 the loop test modifies the value of the loop test. There may be a
2467 modification through a call to an unconstrained function, or an
2468 unconstrained function in the loop test may use a global variable
2469 modified by the loop body.
2472 initializer defines all array elements
2473 Category: definition
2476 Initializer does not define all elements of a declared array.
2479 initializer defines extra array elements
2480 Category: definition
2483 Initializer block contains more elements than the size of a declared
2487 use of internalState
2491 A called function uses internal state, but the globals list for the
2492 function being checked does not include internalState
2494 internalglobsnoglobs
2495 use of internalState (in function with no globals list)
2499 A called function uses internal state, but the function being checked has
2502 internalnamecaseinsensitive
2503 set whether case is significant an internal names (-internalnamecaseinsensiti
2504 ve means case is significant)
2505 Categories: names, ansi
2508 Set whether case is significant an internal names (-internalnamecaseinsens
2509 itive means case is significant). By ANSI89 default, case is not
2510 significant. If +distinctinternalnames is not set, sets
2511 +distinctinternalnames with unlimited internal name length.
2514 set the number of significant characters in an internal name
2515 Categories: names, ansi
2518 Numeric Argument. Default: 63
2519 Sets the number of significant characters in an internal name (ANSI89
2520 default is 31.) Sets +distinctinternalnames.
2522 internalnamelookalike
2523 lookalike characters match in internal names
2524 Categories: names, ansi
2527 Set whether similar looking characters (e.g., "1" and "l") match in
2531 check for violations of standard limits (controlnestdepth, stringliterallen,
2532 includenest, numstructfields, numenummembers) based on ISO99 standard
2533 Categories: limits, ansi
2538 use normal standard library
2539 Categories: libraries, initializations
2542 Library based on the ISO standard library specification is used.
2545 external name conflicts with name reserved for system or standard library
2546 Categories: names, ansi
2549 External name is reserved for system use by ISO C99 standard.
2552 internal name conflicts with name reserved for system or standard library
2553 Categories: names, ansi
2556 Internal name is reserved for system in ISO C99 standard (this should not
2557 be necessary unless you are worried about C library implementations that
2558 violate the standard and use macros).
2561 iter is not balanced with end_<iter>
2567 assume all iterator loops execute at least once
2568 Categories: controlflow, memory
2573 set namespace prefix for iterators
2574 Categories: names, prefixes
2577 String argument. No default.
2578 An iter does not start with the iterator prefix
2581 the iterprefix may not be used for non-iter identifiers
2582 Categories: names, prefixes
2585 An identifier that is not a iter starts with the iterprefix.
2588 iter yield parameter is inappropriate
2594 risky security vulnerabilities (from its4 database)
2595 Categories: its4, security
2598 Security vulnerability classified as risky in its4 database.
2601 moderately risky security vulnerabilities (from its4 database)
2602 Categories: its4, security
2605 Security vulnerability classified as moderate risk in its4 database.
2608 most risky security vulnerabilities (from its4 database)
2609 Categories: its4, security
2612 Security vulnerability classified as most risky in its4 database.
2615 risky security vulnerabilities (from its4 database)
2616 Categories: its4, security
2619 Security vulnerability classified as risky in its4 database.
2622 very risky security vulnerabilities (from its4 database)
2623 Categories: its4, security
2626 Security vulnerability classified as very risky in its4 database.
2629 do not delete temporary files
2635 keep storage transferred inconsistently
2639 Keep storage is transferred inconsistently --- either in a way that may
2640 add a new alias to it, or release it.
2643 kept storage transferred to non-temporary reference
2647 storage is transferred to a non-temporary reference after being passed as
2648 keep parameter. The storage may be released or new aliases created.
2651 set path for searching for library files (overrides LARCH_PATH environment
2653 Categories: directories, files
2656 *** Note: possible difference in the test result because of the default path here:
2657 Path argument. Default: .:/usr/local/share/splint/lib:/af10/evans/LCLintDev/
2661 expect <int> spec errors
2662 Categories: <No Category>, errors
2665 Numeric Argument. Default: 0
2668 set directory to search for LCL import files (overrides LCLIMPORTDIR)
2669 Categories: directories, files
2672 *** Note: possible difference in the test result because of the default path here:
2673 Directory argument. Default: .:/usr/local/share/splint/imports:/af10/evans/L
2678 Categories: headers, specifications
2683 legacy declaration in Unix Standard
2687 Use of a declarator that is marked as a legacy entry in the Unix
2692 Categories: headers, specifications
2697 check all macros with declarations in library as functions
2701 Every macro declared in the load library is checked.
2704 type name is probably a boolean type but does not match default boolean type
2705 name, "bool", and alternate name is not set
2706 Categories: booleans, help
2709 Use the -booltype, -boolfalse and -booltrue flags to change the name of
2710 the default boolean type.
2713 limit <int> consecutive repeated errors
2714 Categories: suppress, errors
2717 Numeric Argument. Default: -1
2720 set length of messages (number of chars)
2721 Categories: format, display
2724 Numeric Argument. Default: 80
2727 interpret traditional lint comments (/*FALLTHROUGH*/, /*NOTREACHED*/)
2728 Categories: syncomments, suppress
2733 load state from dump file (default suffix .lcd)
2734 Categories: libraries, files
2737 Filename argument. No default.
2740 set namespace prefix for local variables
2741 Categories: names, prefixes
2744 String argument. No default.
2745 A local variable does not start with the localprefix
2748 the localprefix may not be used for non-local identifiers
2749 Categories: names, prefixes
2752 An identifier that is not a local variable starts with the localprefix.
2755 allow long type to match an arbitrary integral type (e.g., dev_t)
2756 Categories: typeequivalence, numbers
2759 To allow arbitrary integral types to match long unsigned, use
2763 allow long type to match an arbitrary signed integral type (e.g., ssize_t)
2764 Categories: typeequivalence, numbers
2767 To allow arbitrary signed integral types to match long unsigned, use
2768 +longsignedintegral.
2770 longunsignedintegral
2771 allow long unsigned type to match an arbitrary integral type (e.g., dev_t)
2772 Categories: typeequivalence, numbers
2775 To allow arbitrary integral types to match long unsigned, use
2776 +longunsignedintegral.
2778 longunsignedunsignedintegral
2779 allow long unsigned type to match an arbitrary unsigned integral type (e.g.,
2781 Categories: typeequivalence, numbers
2784 To allow arbitrary unsigned integral types to match long unsigned, use
2785 +longunsignedunsignedintegral.
2788 assume all loops execute at least once (sets forloopexec, whileloopexec and
2790 Categories: controlflow, memory
2795 break inside nested while or for
2796 Category: controlflow
2799 A break statement appears inside the body of a nested while or for
2800 statement. This is perfectly reasonable code, but check that the break is
2801 intended to break only the inner loop. The break statement may be
2802 preceded by /*@innerbreak@*/ to suppress the message for this break only.
2805 continue inside nested loop
2806 Category: controlflow
2809 A continue statement appears inside a loop within a loop. This is
2810 perfectly reasonable code, but check that the continue is intended to
2811 continue only the inner loop. The continue statement may be preceded by
2812 /*@innercontinue@*/ to suppress the message for this continue only.
2815 break in switch inside loop
2816 Category: controlflow
2819 A break statement appears inside a switch statement within a while or for
2820 loop. This is perfectly reasonable code, but check that the break is
2821 intended to break only the inner loop. The break statement may be
2822 preceded by /*@switchbreak@*/ to suppress the message for this break
2826 assignment to a macro parameter
2827 Categories: macros, parameters
2830 A macro parameter is used as the left side of an assignment expression.
2831 This exhibits behavior that could not be implemented by a function.
2834 non-parameterized macro without prototype or specification
2835 Categories: macros, prototypes
2838 Macro constant has no declaration. Use /*@constant ...@*/ to declare the
2842 macro without prototype or specification (sets macrofcndecl and
2844 Categories: macros, prototypes
2847 Argument checking cannot be done well for macros without prototypes or
2848 specifications, since the types of the arguments are unknown.
2851 macro definition for is empty
2855 A macro definition has no body.
2858 parameterized macro without prototype or specification
2859 Categories: macros, prototypes
2862 Function macro has no declaration.
2865 macro definition does not match iter or constant declaration
2869 A iter or constant macro is defined using a different name from the one
2870 used in the previous syntactic comment
2873 macro parameter not used exactly once
2874 Categories: macros, parameters
2877 A macro parameter is not used exactly once in all possible invocations of
2878 the macro. To behave like a function, each macro parameter must be used
2879 exactly once on all invocations of the macro so that parameters with
2880 side-effects are evaluated exactly once. Use /*@sef@*/ to denote
2881 parameters that must be side-effect free.
2884 macro parameter used without parentheses (in potentially dangerous context)
2888 A macro parameter is used without parentheses. This could be dangerous if
2889 the macro is invoked with a complex expression and precedence rules will
2890 change the evaluation inside the macro.
2897 A macro is defined in more than one place.
2899 macroreturn: <invalid flag>
2902 macro definition is syntactically not equivalent to function
2906 A macro is defined in a way that may cause syntactic problems. If the
2907 macro returns a value, use commas to separate expressions;
2908 otherwise, use do { <macro body> } while (FALSE) construct.
2911 unrecognized identifier in macro
2912 Categories: macros, unrecognized
2915 An unrecognized identifier appears in a macro. If the identifier is
2916 defined before the macro is used, then this is okay.
2919 set namespace prefix for variables declared in a macro body
2920 Categories: names, prefixes
2923 String argument. Default: m_
2924 A variable declared in a macro body does not start with the
2927 macrovarprefixexclude
2928 the macrovarprefix may not be used for non-macro variables
2929 Categories: names, prefixes
2932 A variable declared outside a macro body starts with the macrovarprefix.
2935 type of main does not match expected type
2936 Categories: systemfunctions,
2939 The function main does not match the expected type.
2942 allow any intergral type to match an arbitrary integral type (e.g., dev_t)
2943 Categories: typeequivalence, numbers
2946 To allow arbitrary integral types to match any integral type, use
2950 struct or enum type redefined with inconsistent fields or members
2951 Categories: declarations,
2954 A struct, union or enum type is redefined with inconsistent fields or
2958 unique parameter may be aliased
2959 Categories: aliasing, memory
2962 A unique or only parameter may be aliased by some other parameter or
2966 sets all dynamic memory checking flags (memimplicit, mustfree, mustdefine,
2967 mustnotalias, null, memtrans)
2973 memory errors for unqualified storage
2974 Categories: memory, implicit
2979 memory transfer errors (sets all *trans flags)
2983 Memory is transferred in a way that violates annotations.
2986 declaration of unsharable storage uses sharing annotation
2987 Categories: declarations,
2990 A declaration of an unsharable object uses a sharing annotation.
2993 switch on enum type missing case for some value
2994 Category: controlflow
2997 Not all values in an enumeration are present as cases in the switch.
3000 report undocumented file system modifications (applies to unspecified
3001 functions if modnomods is set)
3002 Categories: modification, unconstrained
3007 undocumented modification of a checked global variable
3008 Categories: globals, modification
3011 A checked global variable is modified by the function, but not listed in
3012 its modifies clause.
3015 undocumented modification of a checked global variable in a function
3016 declared with no modifies clause
3017 Categories: globals, modification
3020 A checked global variable is modified by the function, but not listed in
3021 its modifies clause.
3024 undocumented modification of an unchecked checked global variable
3025 Categories: globals, modification
3028 An unchecked global variable is modified by the function, but not listed
3029 in its modifies clause.
3032 possible modification of internal storage through function call
3033 Categories: modification, memory
3036 A function that modifies internalState is called from a function that
3037 does not list internalState in its modifies clause
3040 modification in a function with no modifies clause
3041 Categories: modification, unconstrained
3044 An externally-visible object is modified by a function with no
3045 /*@modifies@*/ comment. The /*@modifies ... @*/ control comment can be
3046 used to give a modifies list for an unspecified function.
3049 possible modification of observer storage
3050 Categories: modification, memory
3053 Storage declared with observer is possibly modified. Observer storage may
3057 possible modification of observer storage through unconstrained call
3058 Categories: modification, memory
3061 Storage declared with observer may be modified through a call to an
3062 unconstrained function.
3065 unspecified modification of caller-visible state
3066 Categories: modification, specifications
3069 An externally-visible object is modified by a function, but not listed in
3070 its modifies clause.
3073 functions declared with a modifies clause but no globals list are assumed to
3075 Categories: modification, globals
3078 An implicit empty globals list is assumed for a function declared with a
3079 modifies clause but no globals list.
3081 modstrictglobsnomods
3082 undocumented modification of a strict checked global variable in a function
3083 declared with no modifies clause
3084 Categories: globals, modification
3087 A checked global variable is modified by the function, but not listed in
3088 its modifies clause.
3091 possible modification through a call to an unconstrained function
3092 Categories: modification, unconstrained
3095 An unconstrained function is called in a function body where
3096 modifications are checked. Since the unconstrained function may modify
3097 anything, there may be undetected modifications in the checked function.
3100 possible modification through a call to an unconstrained function in a
3101 function with no modifies clause
3102 Categories: modification, unconstrained
3105 An unconstrained function is called in a function body where
3106 modifications are checked. Since the unconstrained function may modify
3107 anything, there may be undetected modifications in the checked function.
3110 modification in unspecified functions (sets modnomods, modglobunspec and
3111 modstrictglobsunspec)
3112 Categories: modification, unconstrained
3117 load meta state declaration and corresponding xh file
3118 Categories: extensible, files
3121 Filename argument. No default.
3124 function is not reentrant
3125 Categories: warnuse, security
3128 Non-reentrant function should not be used in multithreaded code.
3131 out storage not defined before return or scope exit
3132 Categories: memory, definition
3135 An out parameter or global is not defined before control is transferred.
3138 fresh or only storage not released before return or scope exit (sets
3139 mustfreefresh and mustfreeonly)
3140 Categories: memory, leaks
3143 A memory leak has been detected.
3146 freshly allocated storage not released before return or scope exit
3147 Categories: memory, leaks
3150 A memory leak has been detected. Storage allocated locally is not
3151 released before the last reference to it is lost.
3154 only storage not released before return or scope exit
3155 Categories: memory, leaks
3158 A memory leak has been detected. Only-qualified storage is not released
3159 before the last reference to it is lost.
3162 specified modification is not detected
3163 Categories: modification, specifications
3166 An object listed in the modifies clause is not modified by the
3167 implementation of the function. The modification may not be detected if
3168 it is done through a call to an unspecified function.
3171 temp storage aliased at return point or scope exit
3172 Categories: aliasing, memory
3175 An alias has been added to a temp-qualifier parameter or global that is
3176 visible externally when the function returns. If the aliasing is needed,
3177 use the /*@shared@*/ annotation to indicate that new aliases to the
3178 parameter may be created.
3181 representation of mutable type has sharing semantics
3185 LCL semantics requires that a mutable type exhibits sharing semantics. In
3186 order for objects to be shared a indirection is necessary in the
3187 representation. A mutable type may be represented by a pointer or an
3188 abstract mutable type. Handles into static data are fine, too, but will
3189 generate this error message unless it is suppressed.
3192 controls name checking without changing other settings
3193 Categories: names, abstract
3198 information in specifications is not also included in syntactic comments
3199 Categories: initializations, specifications
3202 There is information in the specification that is not duplicated in
3203 syntactic comments. Normally, this is not an error, but it may be useful
3204 to detect it to make sure checking incomplete systems without the
3205 specifications will still use this information.
3208 comment begins inside comment
3209 Categories: comments,
3212 A comment open sequence (/*) appears within a comment. This usually
3213 means an earlier comment was not closed.
3216 an extern declaration is inside a function scope
3217 Category: declarations
3220 An extern declaration is used inside a function scope.
3223 optimize header inclusion to not include any header files
3224 Categories: headers, performance
3227 Ignore header includes. Only works if relevant information is loaded from
3231 report new global declarations in source files
3232 Categories: declarations, libraries
3235 There is a new declaration that is not declared in a loaded library or
3236 earlier file. (Use this flag to check for consistency against a
3240 new reference transfer to reference counted reference
3244 A new reference is transferred to a reference counted reference.
3247 the line after a constant or iter declaration must be a macro definition
3251 A constant or iter declaration is not immediately followed by a macro
3255 ignore access comments
3256 Categories: syncomments, abstract
3261 ignore all stylized comments
3262 Categories: syncomments, suppress
3267 statement with no effect
3268 Categories: effect, controlflow
3271 Statement has no visible effect --- no values are modified.
3274 statement with no effect (except possibly through call to unconstrained
3276 Categories: effect, controlflow
3279 Statement has no visible effect --- no values are modified. It may modify
3280 something through a call to an unconstrained function.
3283 do not read options file
3284 Categories: initializations, files
3287 Do not read the default options file (~/.splintrc)
3290 do not load standard library
3291 Categories: libraries, initializations
3296 function declaration has no parameter list
3297 Categories: prototypes, ansi
3300 A function declaration does not have a parameter list.
3303 do not pre-process input files
3309 path with no return detected in non-void function
3310 Category: controlflow
3313 There is a path through a function declared to return a value on which
3314 there is no return statement. This means the execution may fall through
3315 without returning a meaningful result to the caller.
3318 misuses of null pointer
3319 Categories: null, memory
3322 A possibly null pointer is misused (sets nullderef, nullpass, nullref,
3323 nullassign, and nullstate).
3326 inconsistent assignment or initialization involving null pointer
3327 Categories: null, memory
3330 A reference with no null annotation is assigned or initialized to NULL.
3331 Use /*@null@*/ to declare the reference as a possibly null pointer.
3334 possible dereferencce of null pointer
3335 Categories: null, memory
3338 A possibly null pointer is dereferenced. Value is either the result of a
3339 function which may return null (in which case, code should check it is
3340 not null), or a global, parameter or structure field declared with the
3344 possibly null pointer passed as formal with no null annotation
3345 Categories: null, memory
3348 A possibly null pointer is passed as a parameter corresponding to a
3349 formal parameter with no /*@null@*/ annotation. If NULL may be used for
3350 this parameter, add a /*@null@*/ annotation to the function parameter
3354 arithmetic involving possibly null pointer and integer
3355 Categories: operations, pointers
3358 Pointer arithmetic using a possibly null pointer and integer.
3361 possibly null pointer returned as result with no null annotation
3362 Categories: null, memory
3365 Function returns a possibly null pointer, but is not declared using
3366 /*@null@*/ annotation of result. If function may return NULL, add
3367 /*@null@*/ annotation to the return value declaration.
3370 possibly null pointer reachable from a reference with no null annotation
3371 Categories: null, memory
3374 A possibly null pointer is reachable from a parameter or global variable
3375 that is not declared using a /*@null@*/ annotation.
3378 misuse of nullterminated allocation
3379 Categories: memorybounds, memory
3382 A possibly non-nullterminated string/memory is used/referenced as a
3386 misuse of nullterminated allocation
3387 Categories: memorybounds, memory
3390 A possibly non-nullterminated string/memory is used/referenced as a
3394 set maximum number of members of an enum (ANSI89 minimum is 127;
3396 Categories: limits, ansi
3399 Numeric Argument. Default: 1023
3400 Limit on maximum number of members of an enum is exceeded.
3403 int literals can be reals
3404 Categories: typeequivalence, numbers
3407 An int literal is used as any numeric type (including float and long
3408 long). Use +numliteral to allow int literals to be used as any numeric
3412 set maximum number of fields in a struct or union (ANSI89 minimum is 127;
3414 Categories: limits, ansi
3417 Numeric Argument. Default: 1023
3418 Maximum number of fields in a struct or union exceeded.
3421 observer transfer errors
3425 Observer storage is transferred to a non-observer reference.
3428 assume loop that can be determined to always execute always does
3429 Categories: controlflow, memory
3434 old style function definition
3435 Categories: prototypes, ansi
3438 Function definition is in old style syntax. Standard prototype syntax is
3442 only storage transferred to non-only reference (memory leak)
3446 The only reference to this storage is transferred to another reference
3447 (e.g., by returning it) that does not have the only annotation. This may
3448 lead to a memory leak, since the new reference is not necessarily
3452 only storage transferred to an unqualified global or static reference
3457 The only reference to this storage is transferred to another reference
3458 that does not have an aliasing annotation. This may lead to a memory
3459 leak, since the new reference is not necessarily released.
3462 use limited OR expressions to resolve constraints
3463 Categories: memorybounds, memory
3468 library function overloaded
3469 Categories: declarations, libraries
3472 A function, variable or constant defined in the library is redefined with
3476 owned storage transferred to non-owned reference (memory leak)
3480 The owned reference to this storage is transferred to another reference
3481 (e.g., by returning it) that does not have the owned annotation. This may
3482 lead to a memory leak, since the new reference is not necessarily
3486 assume unannotated parameter is temp
3487 Categories: memory, implicit
3492 function parameter not used
3493 Categories: alluse, parameters
3496 A function parameter is not used in the body of the function. If the
3497 argument is needed for type compatibility or future plans, use
3498 /*@unused@*/ in the argument declaration.
3501 show column number where error is found
3502 Categories: format, display
3507 check as partial system (-specundef, -declundef, -exportlocal, don't check
3508 macros in headers without corresponding .c files)
3509 Categories: <No Category>, alluse
3514 passing a value as an un-annotated parameter clears its annotation
3515 Categories: memory, parameters
3520 function may have undefined behavior
3521 Categories: warnuse, security
3524 Use of function that may have implementation-dependent behavior.
3527 use POSIX standard library
3528 Categories: libraries, initializations
3531 POSIX version of the standard library is used.
3534 use strict POSIX standard library
3535 Categories: libraries, initializations
3538 POSIX version of the strict standard library is used.
3541 condition test (if, while or for) is an assignment
3542 Categories: booleans, predicates
3545 The condition test is an assignment expression. Probably, you mean to use
3546 == instead of =. If an assignment is intended, add an extra parentheses
3547 nesting (e.g., if ((a = b)) ...) to suppress this message.
3550 type of condition test (if, while or for) not bool (sets predboolint,
3551 predboolptr and predboolothers)
3552 Categories: booleans, predicates
3555 Test expression type is not boolean.
3558 type of condition test (if, while or for) is an integral type
3559 Categories: predicates, booleans
3562 Test expression type is not boolean or int.
3565 type of condition test (if, while or for) not bool, int or pointer
3566 Categories: booleans, predicates
3569 Test expression type is not boolean.
3572 type of condition test (if, while or for) is a pointer
3573 Categories: booleans, predicates
3576 Test expression type is not boolean.
3580 Categories: , preproc
3585 the name of a parameter in a function prototype and corresponding
3586 declaration must match (after removing the protoparamprefix
3587 Categories: names, prefixes
3590 A parameter in a function definition does not have the same name as the
3591 corresponding in the declaration of the function after removing the
3595 a parameter in a function prototype has a name
3596 Categories: names, prefixes
3599 A parameter in a function prototype has a name. This is dangerous, since
3600 a macro definition could be visible here.
3603 set namespace prefix for parameters in function prototype declarations
3604 Categories: names, prefixes
3607 String argument. No default.
3608 A parameter name in a function prototype declaration does not start with
3609 the declaration parameter prefix
3611 protoparamprefixexclude
3612 the protoparamprefix may not be used for non-declaraction parameter
3614 Categories: names, prefixes
3617 An identifier that is not a parameter name in a function prototype starts
3618 with the protoparamprefix.
3621 arithmetic involving pointer and integer
3622 Categories: operations, pointers
3625 Pointer arithmetic using pointer and integer.
3628 comparison between pointer and number
3629 Categories: operations, pointers
3632 A pointer is compared to a number.
3635 allow ! to be used on pointer operand
3636 Categories: booleans, pointers
3639 The operand of ! operator is a pointer.
3642 suppress herald and error count
3643 Categories: display, errors
3648 string literals are read-only (error if one is modified or released)
3652 String literals are read-only. An error is reported if a string literal
3653 may be modified or released.
3656 report memory transfer errors for initializations to read-only string
3661 A read-only string literal is assigned to a non-observer reference.
3664 dangerous comparison between reals (dangerous because of inexact floating
3665 point representations)
3666 Category: operations
3669 Two real (float, double, or long double) values are compared directly
3670 using a C primitive. This may produce unexpected results since floating
3671 point representations are inexact. Instead, compare the difference to
3672 FLT_EPSILON or DBL_EPSILON.
3675 function or variable redeclared
3676 Category: declarations
3679 A function or variable is declared in more than one place. This is not
3680 necessarily a problem, since the declarations are consistent.
3683 function or variable redefined
3684 Category: declarations
3687 A function or variable is redefined. One of the declarations should use
3690 redundantconstraints
3691 display seemingly redundant constraints
3692 Categories: memorybounds, display
3695 Display seemingly redundant constraints
3698 declaration uses observer qualifier that is always true
3699 Categories: declarations,
3702 A declaration of an immutable object uses a redundant observer qualifier.
3705 reference counted storage is transferred in an inconsistent way
3709 Reference counted storage is transferred in a way that may not be
3710 consistent with the reference count.
3713 report qualifier mismatches only if dangerous
3714 Categories: typeequivalence, numbers
3717 To allow qualifier mismatches that are not dangerous, use +relaxquals.
3720 allow all numeric types to match
3721 Categories: typeequivalence, numbers
3724 To allow all numeric types to match, use +relaxtypes.
3727 do not suppress repeated unrecognized identifier messages (instead of only
3728 reporting the first error)
3729 Categories: unrecognized, display
3732 Identifier used in code has not been declared. (Message repeated for
3733 future uses in this file.)
3736 abstract representation is exposed (sets assignexpose, retexpose, and
3738 Categories: exposure, abstract
3741 The internal representation of an abstract type is visible to the caller.
3742 This means clients may have access to a pointer into the abstract
3746 function returns alias to parameter or global
3750 The returned value shares storage with a parameter or global. If a
3751 parameter is to be returned, use the returned qualifier. If the result is
3752 not modified, use the observer qualifier on the result type. Otherwise,
3753 exposed can be used, but limited checking is done.
3756 abstract representation is exposed (return values only)
3757 Categories: exposure, abstract
3760 The return value shares storage with an instance of an abstract type.
3761 This means clients may have access to a pointer into the abstract
3762 representation. Use the observer qualifier to return exposed storage that
3763 may not be modified by the client. Use the exposed qualifier to return
3764 modifiable (but not deallocatable) exposed storage (dangerous).
3767 assume unannotated returned storage is only
3768 Categories: memory, implicit
3773 return value ignored (sets retvalint, retvalbool and retvalother)
3774 Category: returnvals
3777 Result returned by function call is not used. If this is intended, cast
3778 result to (void) to eliminate message.
3781 return value of manifest type bool ignored
3782 Categories: returnvals, booleans
3785 Result returned by function call is not used. If this is intended, can
3786 cast result to (void) to eliminate message.
3789 return value of type int ignored
3790 Category: returnvals
3793 Result returned by function call is not used. If this is intended, can
3794 cast result to (void) to eliminate message.
3797 return value of type other than bool or int ignored
3798 Categories: returnvals, booleans
3801 Result returned by function call is not used. If this is intended, can
3802 cast result to (void) to eliminate message.
3805 a parameter with side-effects is passed as a sef parameter
3806 Categories: macros, parameters
3809 An actual parameter corresponding to a sef parameter may have a
3813 a parameter with unconstrained side-effects is passed as a sef parameter
3814 Categories: macros, parameters
3817 An actual parameter corresponding to a sef parameter involves a call to a
3818 procedure with no modifies clause that may have a side-effect.
3821 declaration reuses name visible in outer scope
3822 Category: declarations
3825 An outer declaration is shadowed by the local declaration.
3828 shared storage transferred to non-shared reference
3832 Shared storage is transferred to a non-shared reference. The other
3833 reference may release storage needed by this reference.
3836 a shift left operand may be negative
3837 Categories: operations,
3840 The left operand to a shift operator may be negative (behavior is
3841 implementation-defined).
3844 a shift right operand may be negative
3845 Categories: operations,
3848 The right operand to a shift operator may be negative (behavior
3852 show all possible types
3856 When a library function is declared with multiple possible type, the
3857 alternate types are shown only if +showallconjs.
3860 show sorted list of uses of all globals
3861 Categories: display, alluse
3866 show column number where error is found
3867 Categories: format, display
3871 showconstraintlocation
3872 display location for every constraint generated
3873 Categories: memorybounds, display
3877 showconstraintparens
3878 display parentheses around constraint terms
3879 Categories: memorybounds, display
3884 show name of function containing error
3890 show file names are they are processed
3891 Categories: display, files
3896 display the source code location where a warning is produced
3902 show summary of all errors reported and suppressed
3903 Categories: display, errors
3908 optimize header inclusion to eliminate redundant includes
3909 Categories: headers, performance
3912 When checking multiple files, each header file is processed only once.
3913 This may change the meaning of the code, if the same header file is
3914 included in different contexts (e.g., the header file includes #if
3915 directives and the values are different when it is included in different
3919 sizeof operator has an array formal parameter argument
3920 Categories: operations,
3923 Operand of a sizeof operator is a function parameter declared as an
3924 array. The value of sizeof will be the size of a pointer to the element
3925 type, not the number of elements in the array.
3928 sizeof operator has a type argument
3929 Categories: operations,
3932 Operand of sizeof operator is a type. (Safer to use expression, int *x =
3933 sizeof (*x); instead of sizeof (int).)
3936 prevent inclusion of header files in a system directory with names that
3937 match standard ANSI headers. The symbolic information in the standard
3938 library is used instead. Flag in effect only if a library including the
3939 ANSI library is loaded. The ANSI headers are:
3940 assert, ctype, errno, float, limits, locale, math, setjmp, signal, stdarg,
3941 stddef, stdio, stdlib, strings, string, time, and wchar.
3942 Categories: directories, files
3947 prevent inclusion of header files in a system directory with names that
3948 match standard POSIX headers. The symbolic information in the posix library
3949 is used instead. The POSIX headers are:
3950 dirent, fcntl, grp, pwd, termios, sys/stat, sys/times, sys/types,
3951 sys/utsname, sys/wait, unistd, and utime.
3952 Categories: directories, files
3957 do not include header files in system directories (set by -sysdirs)
3958 Categories: headers, performance
3961 Do not include header files in system directories (set by -sysdirs)
3965 Categories: comments,
3968 A // comment is used. ISO C99 allows // comments, but earlier standards
3972 slovak naming convention violated
3973 Categories: names, abstract
3976 Name is not consistent with Slovak naming convention.
3979 slovak naming convention violated in a constant declaration
3980 Categories: names, abstract
3983 Constant name is not consistent with Slovak naming convention.
3986 slovak naming convention violated in a function or iterator declaration
3987 Categories: names, abstract
3990 Function or iterator name is not consistent with Slovak naming
3994 slovak naming convention violated in an expanded macro name
3995 Categories: names, abstract
3998 Expanded macro name is not consistent with Slovak naming convention.
4001 slovak naming convention violated in a use-defined type definition
4002 Categories: names, abstract
4005 Type name is not consistent with Slovak naming convention. Slovak type
4006 names may not include uppercase letters.
4009 slovak naming convention violated in a variable declaration
4010 Categories: names, abstract
4013 Variable name is not consistent with Slovak naming convention.
4016 assume unannotated global storage is only
4017 Categories: memory, implicit
4022 sets specglobimponly, specretimponly and specstructimponly
4023 Categories: memory, implicit
4028 check all macros corresponding to specified functions or constants
4032 Every macro declared a specification file is checked.
4035 assume unannotated returned storage is only
4036 Categories: memory, implicit
4041 assume unannotated structure field is only
4042 Categories: memory, implicit
4047 function or variable specified but never declared in a source file
4048 Categories: complete, specifications
4051 A function or variable is declared in an .lcl file, but not declared in
4052 any source code file.
4055 function or variable specified but never defined
4056 Categories: complete, specifications
4059 A function or variable is declared in an .lcl file, but not defined in
4060 any source code file.
4063 external reference to stack-allocated storage is created
4064 Categories: memory, released
4067 A stack reference is pointed to by an external reference when the
4068 function returns. The stack-allocated storage is destroyed after the
4069 call, leaving a dangling reference.
4072 control paths merge with storage in incompatible states
4073 Categories: extensible, memory
4076 Control path merge violates user-defined state merge rules.
4079 storage has been transfered with invalid state
4080 Categories: extensible, memory
4083 Transfer violates user-defined state rules.
4086 static storage is used as an initial value in an inconsistent way
4090 Static storage is used as an initial value in an inconsistent way.
4093 static storage is transferred in an inconsistent way
4097 Static storage is transferred in an inconsistent way.
4100 display lines processed and time
4106 storage through array fetch has inconsistent states of alternate paths
4111 The state of a variable through an array fetch is different depending on
4112 which branch is taken. This means no annotation can sensibly be applied
4116 report complete destruction errors for array elements that may have been
4118 Categories: memory, leaks
4123 interpret standard library strictly
4124 Categories: libraries, initializations
4127 Stricter version of the standard library is used. (The default library is
4128 standard.lcd; strict library is strict.lcd.)
4131 primitive operation does not type check strictly
4132 Categories: operations,
4135 A primitive operation does not type check strictly.
4138 element used after it may have been released
4139 Categories: memory, released
4142 Memory (through fetch) is used after it may have been released (either by
4143 passing as an only param or assigning to an only global).
4146 set maximum length of string literals (ANSI89 minimum is 509; ISO99 is 4095)
4147 Categories: limits, ansi
4150 Numeric Argument. Default: 4095
4151 Maximum length of string literal exceeded.
4154 string literal leaves no room for null terminator
4157 A string literal is assigned to a char array that is not big enough to
4158 hold the null terminator.
4160 stringliteralsmaller
4161 string literal is smaller than the char array it is assigned to
4164 A string literal is assigned to a char array that smaller than the string
4167 stringliteraltoolong
4168 string literal too long for character array
4171 A string literal is assigned to a char array too small to hold it.
4174 assume unannotated structure field is only
4175 Categories: memory, implicit
4180 The number of errors detected does not match number in /*@i<n>@*/.
4181 Categories: suppress, comments
4186 function is restricted to superusers
4187 Categories: warnuse, security
4190 Call to function restricted to superusers.
4193 break in loop inside switch
4194 Category: controlflow
4197 A break statement appears inside the body of a while or for statement
4198 within a switch. This is perfectly reasonable code, but check that the
4199 break is intended to break only the inner loop. The break statement may
4200 be preceded by /*@loopbreak@*/ to suppress the message for this break
4204 break in switch inside switch
4205 Category: controlflow
4208 A break statement appears inside a switch statement within another switch
4209 statement. This is perfectly reasonable code, but check that the break is
4210 intended to break only the inner switch. The break statement may be
4211 preceded by /*@innerbreak@*/ to suppress the message for this break only.
4214 syntax error in parsing
4217 Code cannot be parsed. For help on parse errors, see splint -help
4221 report errors in files in system directories (set by -sysdirs)
4222 Categories: directories, suppress
4227 expand macros in system directories regardless of other settings, except for
4228 macros corresponding to names defined in a load library
4229 Categories: directories, macros
4234 set directories for system files (default /usr/include). Separate
4235 directories with path separator (colons in Unix, semi-colons in Windows).
4236 Flag settings propagate to files in a system directory. If -sysdirerrors is
4237 set, no errors are reported for files in system directories.
4238 Categories: directories, files
4241 Path argument. Default: /usr/
4244 report unrecognized identifiers with system (__) prefix
4245 Categories: unrecognized, display
4248 Identifier used in code has not been declared. (Message repeated for
4249 future uses in this file.) Use +gnuextensions to make Splint recognize
4250 some keywords that are gnu extensions.
4253 set namespace prefix for struct, union and enum tags
4254 Categories: names, prefixes
4257 String argument. No default.
4258 A tag identifier does not start with the tagprefix.
4261 the tagprefix may not be used for non-tag identifiers
4262 Categories: names, prefixes
4265 An identifier that is not a tag starts with the tagprefix.
4268 temp storage transferred to non-temporary reference
4272 Temp storage (associated with a formal parameter) is transferred to a
4273 non-temporary reference. The storage may be released or new aliases
4277 display time distribution
4283 interpret t comments (ignore errors in lines marked with /*@t<n>@*/
4284 Categories: syncomments, suppress
4289 set directory for writing temp files
4290 Categories: directories, files
4293 Directory argument. Default: /tmp/
4296 possible time of check, time of use vulnerability
4297 Categories: warnuse, security
4300 Possible time of check, time of use vulnerability.
4303 declaration at top level not used
4304 Categories: alluse, complete
4307 An external declaration not used in any source file.
4310 try to recover from parse error
4313 Try to recover from parse error. It really means try - this doesn't
4320 Types are incompatible.
4323 set namespace prefix for user-defined types
4324 Categories: names, prefixes
4327 String argument. No default.
4328 A user-defined type does not start with the typeprefix
4331 the typeprefix may not be used for identifiers that are not type names
4332 Categories: names, prefixes
4335 An identifier that is not a type name starts with the typeprefix.
4338 type declared but not used
4342 A type is declared but not used. Use /*@unused@*/ in front of typedef to
4346 function returns with an unchecked global aliasing external state
4347 Categories: aliasing, globals
4350 A global variable aliases externally-visible state when the function
4353 uncheckedmacroprefix
4354 set namespace prefix for unchecked macros
4355 Categories: names, prefixes
4358 String argument. No default.
4359 An unchecked macro name does not start with the uncheckedmacroprefix
4361 uncheckedmacroprefixexclude
4362 the uncheckmacroprefix may not be used for identifiers that are not
4364 Categories: names, prefixes
4367 An identifier that is not the name of an unchecked macro starts with the
4368 uncheckedmacroprefix.
4371 at least one field of a union must be defined
4372 Categories: memory, definition
4375 No field of a union is defined. Generally, one field of a union is
4376 expected to be defined.
4379 use UNIX (sort-of) standard library
4380 Categories: libraries, initializations
4383 UNIX version of the standard library is used.
4386 function is not required in Standard UNIX Specification
4387 Categories: warnuse, security
4390 Use of function that need not be provided by UNIX implementations
4393 use strict version of UNIX (sort-of) library
4394 Categories: libraries, initializations
4397 strict version of the UNIX library is used.
4399 unqualifiedinittrans
4400 unqualified storage is used as an initial value in an inconsistent way
4404 Unqualified storage is used as an initial value in an inconsistent way.
4407 unqualified storage is transferred in an inconsistent way
4411 Unqualified storage is transferred in an inconsistent way.
4414 unreachable code detected
4415 Category: controlflow
4418 This code will never be reached on any possible execution.
4421 unrecognized identifier
4422 Category: unrecognized
4425 Identifier used in code has not been declared.
4428 stylized comment is unrecognized
4429 Categories: syncomments,
4432 Word after a stylized comment marker does not correspond to a stylized
4436 unrecognized pre-processor directive
4437 Categories: preproc,
4440 Pre-processor directive is not recognized.
4443 stylized flag comment uses an unrecognized flag
4444 Categories: syncomments,
4447 Semantic comment attempts to set a flag that is not recognized.
4450 comparison using <, <=, >= between an unsigned integral and zero constant
4451 Category: operations
4454 An unsigned value is used in a comparison with zero in a way that is
4455 either a bug or confusing.
4458 unused declaration in special file (corresponding to .l or .y file)
4459 Categories: alluse, complete
4464 use before definition
4465 Category: definition
4468 An rvalue is used that may not be initialized to a value on some
4472 storage used after release
4473 Categories: memory, released
4476 Memory is used after it has been released (either by passing as an only
4477 param or assigning to an only global).
4480 send error messages to standard error (instead of standard out)
4481 Categories: display, errors
4486 non-standard <varargs.h> included
4487 Categories: libraries, ansi
4490 Header <varargs.h> is not part of ANSI Standard. Should use <stdarg.h>
4494 variable declared but not used
4498 A variable is declared but never used. Use /*@unused@*/ in front of
4499 declaration to suppress message.
4502 void * matches pointers to abstract types, casting ok (dangerous)
4503 Categories: typeequivalence, abstract
4506 A pointer to void is cast to a pointer to an abstract type (or vice
4510 warn when command line sets flag in abnormal way
4514 Command line sets flag in abnormal way
4517 warn when a traditional lint comment is used
4518 Categories: syncomments, suppress
4521 A traditional lint comment is used. Some traditional lint comments are
4522 interpreted by Splint to enable easier checking of legacy code. It is
4523 preferable to replace these comments with the suggested Splint
4527 global variable used in modifies clause is not listed in globals list
4528 Categories: globals, modification
4531 A global variable is used in the modifies clause, but it not listed in
4532 the globals list. The variable will be added to the globals list.
4534 warnmissingglobsnoglobs
4535 global variable used in modifies clause in a function with no globals list
4536 Categories: globals, modification
4539 A global variable is used in the modifies clause, but the function has no
4540 globals list. The variable will be added to the globals list.
4543 a POSIX header is included, but the POSIX library is not used
4544 Categories: libraries, ansi
4547 Header name matches a POSIX header, but the POSIX library is not
4551 warn when there are problems with reading the initialization files
4555 There was a problem reading an initialization file
4558 warn when the unix library is used
4559 Categories: libraries, ansi
4562 Unix library may not be compatible with all platforms
4565 warn when declaration marked with warn is used
4569 Declaration marked with warn clause is used (can be suppresed by more
4573 show standard library filename
4574 Categories: libraries, initializations
4579 the body of a while statement is not a block
4580 Category: controlflow
4583 While body is a single statement, not a compound block.
4586 a while statement has no body
4587 Category: controlflow
4590 While statement has no body.
4593 assume all while loops execute at least once
4594 Categories: controlflow, memory
4599 treat 0 as a boolean
4600 Categories: typeequivalence, booleans
4605 tread 0 as a pointer
4606 Categories: typeequivalence, pointers
4614 ===================================
4616 A possibly null pointer is misused (sets nullderef, nullpass, nullref,
4617 nullassign, and nullstate).
4619 A possibly null pointer is dereferenced. Value is either the result of a
4620 function which may return null (in which case, code should check it is not
4621 null), or a global, parameter or structure field declared with the null
4624 A possibly null pointer is passed as a parameter corresponding to a formal
4625 parameter with no /*@null@*/ annotation. If NULL may be used for this
4626 parameter, add a /*@null@*/ annotation to the function parameter
4629 Function returns a possibly null pointer, but is not declared using
4630 /*@null@*/ annotation of result. If function may return NULL, add
4631 /*@null@*/ annotation to the return value declaration.
4633 A possibly null pointer is reachable from a parameter or global variable
4634 that is not declared using a /*@null@*/ annotation.
4635 nullassign: <M:-+++>
4636 A reference with no null annotation is assigned or initialized to NULL. Use
4637 /*@null@*/ to declare the reference as a possibly null pointer.
4640 ===================================
4642 An rvalue is used that may not be initialized to a value on some execution
4646 ===================================
4647 mustdefine: <M:-+++>
4648 An out parameter or global is not defined before control is transferred.
4650 No field of a union is defined. Generally, one field of a union is expected
4653 Storage derivable from a parameter, return value or global is not defined.
4654 Use /*@out@*/ to denote passed or returned storage which need not be
4658 ===================================
4659 fullinitblock: <P:+>
4660 Initializer does not set every field in the structure.
4661 initallelements: <P:+>
4662 Initializer does not define all elements of a declared array.
4664 Initializer block contains more elements than the size of a declared array.
4666 Pointer parameters to unspecified functions may be implicit out parameters.
4669 ===================================
4671 A function, variable or constant is redefined with a different type.
4672 matchfields: <M:-+++>
4673 A struct, union or enum type is redefined with inconsistent fields or
4677 ===================================
4679 A function type is dereferenced. The ANSI standard allows this because of
4680 implicit conversion of function designators, however the dereference is
4684 ===================================
4685 realcompare: <M:-+++>
4686 Two real (float, double, or long double) values are compared directly using
4687 a C primitive. This may produce unexpected results since floating point
4688 representations are inexact. Instead, compare the difference to FLT_EPSILON
4690 unsignedcompare: <M:-+++>
4691 An unsigned value is used in a comparison with zero in a way that is either
4694 Pointer arithmetic using pointer and integer.
4695 nullptrarith: <M:--++>
4696 Pointer arithmetic using a possibly null pointer and integer.
4697 ptrcompare: <M:-+++>
4698 A pointer is compared to a number.
4700 A primitive operation does not type check strictly.
4701 bitwisesigned: <M:---+>
4702 An operand to a bitwise operator is not an unsigned values. This may have
4703 unexpected results depending on the signed representations.
4704 shiftnegative: <M:-+++>
4705 The right operand to a shift operator may be negative (behavior undefined).
4706 shiftimplementation: <M:-+++>
4707 The left operand to a shift operator may be negative (behavior is
4708 implementation-defined).
4709 sizeoftype: <M:---+>
4710 Operand of sizeof operator is a type. (Safer to use expression, int *x =
4711 sizeof (*x); instead of sizeof (int).)
4712 sizeofformalarray: <P:+>
4713 Operand of a sizeof operator is a function parameter declared as an array.
4714 The value of sizeof will be the size of a pointer to the element type, not
4715 the number of elements in the array.
4718 ===================================
4719 fixedformalarray: <P:+>
4720 A formal parameter is declared as an array with size. The size of the array
4721 is ignored in this context, since the array formal parameter is treated as a
4723 incompletetype: <P:+>
4724 A formal parameter is declared with an incomplete type.
4726 A formal parameter is declared as an array. This can be confusing, since a
4727 formal array parameter is treated as a pointer.
4730 ===================================
4731 booltype <string> [lltX_bool]: <P:->
4732 Set name of boolean type (default bool).
4733 boolfalse <string> [FALSE]: <P:->
4734 Set name of boolean false (default FALSE).
4735 booltrue <string> [TRUE]: <P:->
4736 Set name of boolean true (default TRUE).
4738 Use the -booltype, -boolfalse and -booltrue flags to change the name of the
4739 default boolean type.
4740 boolcompare: <M:-+++>
4741 Two bool values are compared directly using a C primitive. This may produce
4742 unexpected results since all non-zero values are considered TRUE, so
4743 different TRUE values may not be equal. The file bool.h (included in
4744 splint/lib) provides bool_equal for safe bool comparisons.
4746 The operand of a boolean operator is not a boolean. Use +ptrnegate to allow
4747 ! to be used on pointers.
4749 The operand of ! operator is a pointer.
4751 The condition test is an assignment expression. Probably, you mean to use ==
4752 instead of =. If an assignment is intended, add an extra parentheses nesting
4753 (e.g., if ((a = b)) ...) to suppress this message.
4755 Test expression type is not boolean.
4758 ===================================
4759 predboolint: <M:-+++>
4760 Test expression type is not boolean or int.
4763 ===================================
4764 predboolptr: <M:--++>
4765 Test expression type is not boolean.
4766 predboolothers: <M:++++>
4767 Test expression type is not boolean.
4770 ===================================
4772 An abstraction barrier is broken. If necessary, use /*@access <type>@*/ to
4773 allow access to an abstract type.
4775 Assume user type definitions are abstract (unless /*@concrete@*/ is used).
4777 The representation of an abstract type defined in <M>.<x> is accessible
4778 anywhere in a file named <M>.<y>.
4780 The representation of an abstract type named <t> is accessible anywhere in a
4783 The representation of an abstract type named <t> is accessible in the
4784 definition of a function or constant named <t>_<name>
4786 The representation of an abstract type named <t> is accessible in the
4787 definition of a function or constant named <t><Name>
4788 accessczechoslovak: <P:->
4789 The representation of an abstract type named <t> is accessible in the
4790 definition of a function or constant named <t>_<name> or <t><Name>
4792 Sets accessmodule, accessfile and accessczech
4794 LCL semantics requires that a mutable type exhibits sharing semantics. In
4795 order for objects to be shared a indirection is necessary in the
4796 representation. A mutable type may be represented by a pointer or an
4797 abstract mutable type. Handles into static data are fine, too, but will
4798 generate this error message unless it is suppressed.
4801 ===================================
4802 mustfreefresh: <M:-+++>
4803 A memory leak has been detected. Storage allocated locally is not released
4804 before the last reference to it is lost.
4805 mustfreeonly: <M:-+++>
4806 A memory leak has been detected. Only-qualified storage is not released
4807 before the last reference to it is lost.
4809 A memory leak has been detected.
4810 usereleased: <M:-+++>
4811 Memory is used after it has been released (either by passing as an only
4812 param or assigning to an only global).
4813 strictusereleased: <M:---+>
4814 Memory (through fetch) is used after it may have been released (either by
4815 passing as an only param or assigning to an only global).
4816 compdestroy: <M:-+++>
4817 A storage leak due to incomplete deallocation of a structure or deep pointer
4818 is suspected. Unshared storage that is reachable from a reference that is
4819 being deallocated has not yet been deallocated. Splint assumes when an
4820 object is passed as an out only void pointer that the outer object will be
4821 deallocated, but the inner objects will not.
4822 strictdestroy: <M:---+>
4823 Report complete destruction errors for array elements that may have been
4826 When an element is fetched from an array, Splint analysis is not able to
4827 determine if the same element is reused. If +deparrays, Splint will mark
4828 local storage assigned from array fetches as dependent.
4829 branchstate: <M:-+++>
4830 The state of a variable is different depending on which branch is taken.
4831 This means no annotation can sensibly be applied to the storage.
4832 strictbranchstate: <M:---+>
4833 The state of a variable through an array fetch is different depending on
4834 which branch is taken. This means no annotation can sensibly be applied to
4837 Sets all dynamic memory checking flags (memimplicit, mustfree, mustdefine,
4838 mustnotalias, null, memtrans).
4839 compmempass: <M:-+++>
4840 Storage derivable from a parameter does not match the alias kind expected
4841 for the formal parameter.
4843 A stack reference is pointed to by an external reference when the function
4844 returns. The stack-allocated storage is destroyed after the call, leaving a
4847 Memory is transferred in a way that violates annotations.
4848 dependenttrans: <M:-+++>
4849 Dependent storage is transferred to a non-dependent reference.
4850 newreftrans: <M:-+++>
4851 A new reference is transferred to a reference counted reference.
4853 The only reference to this storage is transferred to another reference
4854 (e.g., by returning it) that does not have the only annotation. This may
4855 lead to a memory leak, since the new reference is not necessarily released.
4856 onlyunqglobaltrans: <M:--++>
4857 The only reference to this storage is transferred to another reference that
4858 does not have an aliasing annotation. This may lead to a memory leak, since
4859 the new reference is not necessarily released.
4860 ownedtrans: <M:-+++>
4861 The owned reference to this storage is transferred to another reference
4862 (e.g., by returning it) that does not have the owned annotation. This may
4863 lead to a memory leak, since the new reference is not necessarily released.
4864 freshtrans: <M:-+++>
4865 Fresh storage (newly allocated in this function) is transferred in a way
4866 that the obligation to release storage is not propagated. Use the
4867 /*@only@*/ annotation to indicate the a return value is the only reference
4868 to the returned storage.
4869 sharedtrans: <M:-+++>
4870 Shared storage is transferred to a non-shared reference. The other reference
4871 may release storage needed by this reference.
4873 Temp storage (associated with a formal parameter) is transferred to a
4874 non-temporary reference. The storage may be released or new aliases created.
4876 storage is transferred to a non-temporary reference after being passed as
4877 keep parameter. The storage may be released or new aliases created.
4879 Keep storage is transferred inconsistently --- either in a way that may add
4880 a new alias to it, or release it.
4881 immediatetrans: <M:-+++>
4882 An immediate address (result of & operator) is transferred inconsistently.
4883 refcounttrans: <M:-+++>
4884 Reference counted storage is transferred in a way that may not be consistent
4885 with the reference count.
4886 statictrans: <M:-+++>
4887 Static storage is transferred in an inconsistent way.
4888 unqualifiedtrans: <M:-+++>
4889 Unqualified storage is transferred in an inconsistent way.
4890 staticinittrans: <M:--++>
4891 Static storage is used as an initial value in an inconsistent way.
4892 unqualifiedinittrans: <M:--++>
4893 Unqualified storage is used as an initial value in an inconsistent way.
4894 readonlytrans: <M:--++>
4895 A read-only string literal is assigned to a non-observer reference.
4896 passunknown: <M:---->
4897 Passing a value as an un-annotated parameter clears its annotation.
4898 readonlystrings: <M:-+++>
4899 String literals are read-only. An error is reported if a string literal may
4900 be modified or released.
4902 Memory errors for unqualified storage.
4904 Assume unannotated parameter is temp.
4905 allimponly: <S><P:->
4906 Sets globimponly, retimponly, structimponly, specglobimponly, specretimponly
4907 and specstructimponly.
4908 codeimponly: <S><P:->
4909 Sets globimponly, retimponly and structimponly.
4910 specimponly: <S><P:->
4911 Sets specglobimponly, specretimponly and specstructimponly.
4913 Assume unannotated global storage is only.
4915 Assume unannotated returned storage is only.
4916 structimponly: <P:+>
4917 Assume unannotated structure field is only.
4918 specglobimponly: <P:->
4919 Assume unannotated global storage is only.
4920 specretimponly: <P:->
4921 Assume unannotated returned storage is only.
4922 specstructimponly: <P:->
4923 Assume unannotated structure field is only.
4926 ===================================
4927 aliasunique: <M:-+++>
4928 A unique or only parameter is aliased by some other parameter or visible
4930 mayaliasunique: <M:-+++>
4931 A unique or only parameter may be aliased by some other parameter or visible
4933 mustnotalias: <M:-+++>
4934 An alias has been added to a temp-qualifier parameter or global that is
4935 visible externally when the function returns. If the aliasing is needed, use
4936 the /*@shared@*/ annotation to indicate that new aliases to the parameter
4939 The returned value shares storage with a parameter or global. If a parameter
4940 is to be returned, use the returned qualifier. If the result is not
4941 modified, use the observer qualifier on the result type. Otherwise, exposed
4942 can be used, but limited checking is done.
4944 A global variable aliases externally-visible state when the function
4946 checkstrictglobalias: <M:-+++>
4947 A global variable aliases externally-visible state when the function
4949 checkedglobalias: <M:-+++>
4950 A global variable aliases externally-visible state when the function
4952 checkmodglobalias: <M:-+++>
4953 A global variable aliases externally-visible state when the function
4955 uncheckedglobalias: <M:--++>
4956 A global variable aliases externally-visible state when the function
4960 ===================================
4961 exposetrans: <M:-+++>
4962 Exposed storage is transferred to a non-exposed, non-observer reference.
4963 observertrans: <M:-+++>
4964 Observer storage is transferred to a non-observer reference.
4967 ===================================
4969 The internal representation of an abstract type is visible to the caller.
4970 This means clients may have access to a pointer into the abstract
4973 The return value shares storage with an instance of an abstract type. This
4974 means clients may have access to a pointer into the abstract representation.
4975 Use the observer qualifier to return exposed storage that may not be
4976 modified by the client. Use the exposed qualifier to return modifiable (but
4977 not deallocatable) exposed storage (dangerous).
4978 assignexpose: <M:--++>
4979 Storage internal to the representation of an abstract type is assigned to an
4980 external pointer. This means clients may have access to a pointer into the
4981 abstract representation. If the external pointer is a parameter, the exposed
4982 qualifier can be used to allow the assignment, however, this is considered
4983 dangerous programming practice.
4984 castexpose: <M:--++>
4985 Storage internal to the representation of an abstract type is exposed
4986 through a type cast. This means clients may have access to a pointer into
4987 the abstract representation.
4990 ===================================
4991 redundantsharequal: <M:--++>
4992 A declaration of an immutable object uses a redundant observer qualifier.
4993 misplacedsharequal: <M:-+++>
4994 A declaration of an unsharable object uses a sharing annotation.
4997 ===================================
4999 An externally-visible object is modified by a function, but not listed in
5000 its modifies clause.
5002 An object listed in the modifies clause is not modified by the
5003 implementation of the function. The modification may not be detected if it
5004 is done through a call to an unspecified function.
5006 Storage declared with observer is possibly modified. Observer storage may
5008 modobserveruncon: <M:---+>
5009 Storage declared with observer may be modified through a call to an
5010 unconstrained function.
5011 modinternalstrict: <M:---+>
5012 A function that modifies internalState is called from a function that does
5013 not list internalState in its modifies clause
5014 modfilesys: <M:---+>
5015 Report undocumented file system modifications (applies to unspecified
5016 functions if modnomods is set).
5018 Modification in unspecified functions (sets modnomods, modglobunspec and
5019 modstrictglobsunspec).
5021 An externally-visible object is modified by a function with no
5022 /*@modifies@*/ comment. The /*@modifies ... @*/ control comment can be used
5023 to give a modifies list for an unspecified function.
5025 An unconstrained function is called in a function body where modifications
5026 are checked. Since the unconstrained function may modify anything, there may
5027 be undetected modifications in the checked function.
5028 modunconnomods: <M:---+>
5029 An unconstrained function is called in a function body where modifications
5030 are checked. Since the unconstrained function may modify anything, there may
5031 be undetected modifications in the checked function.
5032 globsimpmodsnothing: <M:--++>
5033 An implicit modifies nothing clause is assumed for a function declared with
5034 a globals list but not modifies clause.
5035 modsimpnoglobs: <M:---->
5036 An implicit empty globals list is assumed for a function declared with a
5037 modifies clause but no globals list.
5040 ===================================
5042 A global variable does not satisfy its annotations when control is
5045 A checked global variable is used in the function, but not listed in its
5046 globals clause. By default, only globals specified in .lcl files are
5047 checked. To check all globals, use +allglobals. To check globals selectively
5048 use /*@checked@*/ in the global declaration.
5050 A global variable listed in the function's globals list is not used in the
5051 body of the function.
5052 internalglobs: <M:---+>
5053 A called function uses internal state, but the globals list for the function
5054 being checked does not include internalState
5055 internalglobsnoglobs: <M:---+>
5056 A called function uses internal state, but the function being checked has no
5058 warnmissingglobs: <M:---+>
5059 A global variable is used in the modifies clause, but it not listed in the
5060 globals list. The variable will be added to the globals list.
5061 warnmissingglobsnoglobs: <M:---+>
5062 A global variable is used in the modifies clause, but the function has no
5063 globals list. The variable will be added to the globals list.
5064 globnoglobs: <M:---+>
5065 A specified global variable is used in the function, but not listed in its
5066 globals list. Without +globnoglobs, only globals declared with
5067 /*@checkedstrict@*/ will produce use errors in functions without globals
5068 lists. The /*@globals ... @*/ control comment can be used to give a globals
5069 list for an unspecified function.
5071 Report use and modification errors for globals not annotated with unchecked.
5072 checkstrictglobs: <M:++++>
5073 Report use and modification errors for checkedstrict globals.
5074 impcheckedspecglobs: <M:-+++>
5075 Assume checked qualifier for unqualified global declarations in .lcl files.
5076 impcheckmodspecglobs: <M:---->
5077 Assume checkmod qualifier for unqualified global declarations in .lcl files.
5078 impcheckedstrictspecglobs: <M:---+>
5079 Assume checkmod qualifier for unqualified global declarations in .lcl files.
5080 impcheckedglobs: <M:---->
5081 Assume checked qualifier for unqualified global declarations.
5082 impcheckmodglobs: <M:---->
5083 Assume checkmod qualifier for unqualified global declarations.
5084 impcheckedstrictglobs: <M:---+>
5085 Assume checkedstrict qualifier for unqualified global declarations.
5086 impcheckedstatics: <M:---->
5087 Assume checked qualifier for unqualified file static declarations.
5088 impcheckmodstatics: <M:---->
5089 Assume checkmod qualifier for unqualified file static declarations.
5090 impcheckmodinternals: <M:--++>
5091 Assume checkmod qualifier for unqualified local static declarations (for
5092 internal state modifications).
5093 impcheckedstrictstatics: <M:---+>
5094 Assume checkedstrict qualifier for unqualified file static declarations.
5096 A checked global variable is modified by the function, but not listed in its
5098 modglobsnomods: <M:---+>
5099 A checked global variable is modified by the function, but not listed in its
5101 modstrictglobsnomods: <M:---+>
5102 A checked global variable is modified by the function, but not listed in its
5104 modglobsunchecked: <M:---+>
5105 An unchecked global variable is modified by the function, but not listed in
5106 its modifies clause.
5109 ===================================
5111 There is a path through a function declared to return a value on which there
5112 is no return statement. This means the execution may fall through without
5113 returning a meaningful result to the caller.
5115 Empty return in function declared to return value.
5117 Loop predicate always exits.
5119 Assume all loops execute at least once (sets forloopexec, whileloopexec and
5122 Assume all for loops execute at least once.
5123 whileloopexec: <P:->
5124 Assume all while loops execute at least once.
5126 Assume all iterator loops execute at least once.
5127 obviousloopexec: <P:+>
5128 Assume loop that can be determined to always execute always does.
5131 ===================================
5133 Code has unspecified behavior. Order of evaluation of function parameters or
5134 subexpressions is not defined, so if a value is used and modified in
5135 different places not separated by a sequence point constraining evaluation
5136 order, then the result of the expression is unspecified.
5137 evalorderuncon: <M:---+>
5138 Code involving a call to function with no modifies or globals clause may
5139 have undefined or implementation-dependent behavior (Splint assumes the
5140 unconstrained call may modify any reachable state or use any global). Add a
5141 specification for the function.
5144 ===================================
5146 This appears to be an infinite loop. Nothing in the body of the loop or the
5147 loop test modifies the value of the loop test. Perhaps the specification of
5148 a function called in the loop body is missing a modification.
5149 infloopsuncon: <M:--++>
5150 This appears to be an infinite loop. Nothing in the body of the loop or the
5151 loop test modifies the value of the loop test. There may be a modification
5152 through a call to an unconstrained function, or an unconstrained function in
5153 the loop test may use a global variable modified by the loop body.
5155 Execution falls through from the previous case.
5157 Not all values in an enumeration are present as cases in the switch.
5159 The first statement after a switch is not a case.
5160 duplicatecases: <P:+>
5161 Duplicate cases in switch.
5163 A break statement appears inside the body of a nested while, for or switch
5164 statement. Sets looploopbreak, loopswitchbreak, switchloopbreak,
5165 switchswitchbreak, and looploopcontinue.
5166 looploopbreak: <M:--++>
5167 A break statement appears inside the body of a nested while or for
5168 statement. This is perfectly reasonable code, but check that the break is
5169 intended to break only the inner loop. The break statement may be preceded
5170 by /*@innerbreak@*/ to suppress the message for this break only.
5171 switchloopbreak: <M:--++>
5172 A break statement appears inside the body of a while or for statement within
5173 a switch. This is perfectly reasonable code, but check that the break is
5174 intended to break only the inner loop. The break statement may be preceded
5175 by /*@loopbreak@*/ to suppress the message for this break only.
5176 loopswitchbreak: <M:---+>
5177 A break statement appears inside a switch statement within a while or for
5178 loop. This is perfectly reasonable code, but check that the break is
5179 intended to break only the inner loop. The break statement may be preceded
5180 by /*@switchbreak@*/ to suppress the message for this break only.
5181 switchswitchbreak: <M:---+>
5182 A break statement appears inside a switch statement within another switch
5183 statement. This is perfectly reasonable code, but check that the break is
5184 intended to break only the inner switch. The break statement may be preceded
5185 by /*@innerbreak@*/ to suppress the message for this break only.
5186 looploopcontinue: <M:---+>
5187 A continue statement appears inside a loop within a loop. This is perfectly
5188 reasonable code, but check that the continue is intended to continue only
5189 the inner loop. The continue statement may be preceded by
5190 /*@innercontinue@*/ to suppress the message for this continue only.
5191 whileempty: <M:--++>
5192 While statement has no body.
5193 whileblock: <M:---+>
5194 While body is a single statement, not a compound block.
5196 For statement has no body.
5198 Loop body is a single statement, not a compound block.
5200 If statement has no body.
5202 If body is a single statement, not a compound block.
5204 An if, while or for statement has no body (sets ifempty, whileempty and
5207 Body is a single statement, not a compound block.
5208 elseifcomplete: <M:---+>
5209 There is no final else following an else if construct.
5210 unreachable: <M:-+++>
5211 This code will never be reached on any possible execution.
5214 ===================================
5216 Statement has no visible effect --- no values are modified.
5217 noeffectuncon: <M:---+>
5218 Statement has no visible effect --- no values are modified. It may modify
5219 something through a call to an unconstrained function.
5222 ===================================
5224 Result returned by function call is not used. If this is intended, cast
5225 result to (void) to eliminate message.
5226 retvalother: <M:++++>
5227 Result returned by function call is not used. If this is intended, can cast
5228 result to (void) to eliminate message.
5229 retvalbool: <M:-+++>
5230 Result returned by function call is not used. If this is intended, can cast
5231 result to (void) to eliminate message.
5233 Result returned by function call is not used. If this is intended, can cast
5234 result to (void) to eliminate message.
5237 ===================================
5238 nullterminated: <M:---->
5239 A possibly non-nullterminated string/memory is used/referenced as a
5242 Memory read or write may be out of bounds of allocated storage.
5243 boundsread: <M:---->
5244 A memory read references memory beyond the allocated storage.
5245 boundswrite: <M:---->
5246 A memory write may write to an address beyond the allocated buffer.
5248 Display function post conditions.
5249 redundantconstraints: <M:---->
5250 Display seemingly redundant constraints
5252 The function implementation may not satisfy a post condition given in an
5254 implictconstraint: <M:---->
5255 Generate implicit constraints for functions.
5256 orconstraint: <M:---->
5257 Use limited OR expressions to resolve constraints.
5258 nullterminated: <M:---->
5259 A user annotated non-nullterminated buffer is used/referenced as a
5261 showconstraintparens: <M:---->
5262 Display parentheses around constraint terms.
5263 showconstraintlocation: <M:---->
5264 Display location for every constraint generated.
5267 ===================================
5268 mts <filename>: <G><P:->
5269 Load meta state declaration and corresponding xh file.
5270 statetransfer: <M:++++>
5271 Transfer violates user-defined state rules.
5272 statemerge: <M:++++>
5273 Control path merge violates user-defined state merge rules.
5276 ===================================
5277 macroredef: <M:-+++>
5278 A macro is defined in more than one place.
5279 macrounrecog: <M:-+++>
5280 An unrecognized identifier appears in a macro. If the identifier is defined
5281 before the macro is used, then this is okay.
5282 macroconstdecl: <M:-+++>
5283 Macro constant has no declaration. Use /*@constant ...@*/ to declare the
5286 A macro is defined in a way that may cause syntactic problems. If the macro
5287 returns a value, use commas to separate expressions;
5288 otherwise, use do { <macro body> } while (FALSE) construct.
5289 macroempty: <M:---+>
5290 A macro definition has no body.
5291 macroparams: <M:-+++>
5292 A macro parameter is not used exactly once in all possible invocations of
5293 the macro. To behave like a function, each macro parameter must be used
5294 exactly once on all invocations of the macro so that parameters with
5295 side-effects are evaluated exactly once. Use /*@sef@*/ to denote parameters
5296 that must be side-effect free.
5297 macroreturn: <M:---->
5298 The body of a macro declared as a function uses a return statement. This
5299 exhibits behavior that could not be implemented by a function.
5300 macroassign: <M:-+++>
5301 A macro parameter is used as the left side of an assignment expression. This
5302 exhibits behavior that could not be implemented by a function.
5303 macroparens: <M:-+++>
5304 A macro parameter is used without parentheses. This could be dangerous if
5305 the macro is invoked with a complex expression and precedence rules will
5306 change the evaluation inside the macro.
5308 Argument checking cannot be done well for macros without prototypes or
5309 specifications, since the types of the arguments are unknown.
5310 macrofcndecl: <M:-+++>
5311 Function macro has no declaration.
5313 An actual parameter corresponding to a sef parameter may have a side-effect.
5315 An actual parameter corresponding to a sef parameter involves a call to a
5316 procedure with no modifies clause that may have a side-effect.
5318 Every non-parameterized macro (not preceded by /*@notfunction@*/) is checked
5321 Every parameterized macro (not preceded by /*@notfunction@*/) is checked as
5324 All macros (not preceded by /*@notfunction@*/) are checked as functions or
5325 constants depending on whether or not they have parameter lists.
5327 Every macro declared in the load library is checked.
5329 Every macro declared a specification file is checked.
5330 macromatchname: <M:++++>
5331 A iter or constant macro is defined using a different name from the one used
5332 in the previous syntactic comment
5333 nextlinemacros: <P:+>
5334 A constant or iter declaration is not immediately followed by a macro
5338 ===================================
5340 Iter is not balanced with end_<iter>.
5342 Iter yield parameter is inappropriate.
5344 An iterator has been declared with no parameters annotated with yield. This
5345 may be what you want, if the iterator is meant to do something a fixed
5346 number of times, but returns no information to the calling context.
5347 Probably, a parameter is missing the yield annotation to indicate that it is
5348 assigned a value in the calling context.
5351 ===================================
5353 Controls name checking without changing other settings.
5355 Name is not consistent with Czech naming convention.
5357 Function or iterator name is not consistent with Czech naming convention.
5359 Variable name is not consistent with Czech naming convention.
5361 Expanded macro name is not consistent with Czech naming convention.
5363 Constant name is not consistent with Czech naming convention.
5365 Type name is not consistent with Czech naming convention. Czech type names
5366 must not use the underscore character.
5368 Name is not consistent with Slovak naming convention.
5370 Function or iterator name is not consistent with Slovak naming convention.
5372 Expanded macro name is not consistent with Slovak naming convention.
5374 Variable name is not consistent with Slovak naming convention.
5376 Constant name is not consistent with Slovak naming convention.
5378 Type name is not consistent with Slovak naming convention. Slovak type names
5379 may not include uppercase letters.
5380 czechoslovak: <S><P:->
5381 Name is not consistent with either Czech or Slovak naming convention.
5382 czechoslovakfcns: <P:->
5383 Function name is not consistent with Czechoslovak naming convention.
5384 czechoslovakmacros: <P:->
5385 Expanded macro name is not consistent with Czechoslovak naming convention.
5386 czechoslovakvars: <P:->
5387 Variable name is not consistent with Czechoslovak naming convention.
5388 czechoslovakconsts: <P:->
5389 Constant name is not consistent with Czechoslovak naming convention.
5390 czechoslovaktypes: <P:->
5391 Type name is not consistent with Czechoslovak naming convention.
5392 Czechoslovak type names may not include uppercase letters or the underscore
5394 macrovarprefix <string> [m_]: <-><P:+>
5395 A variable declared in a macro body does not start with the macrovarprefix.
5396 macrovarprefixexclude: <P:+>
5397 A variable declared outside a macro body starts with the macrovarprefix.
5398 tagprefix <string>: <-><P:->
5399 A tag identifier does not start with the tagprefix.
5400 tagprefixexclude: <P:->
5401 An identifier that is not a tag starts with the tagprefix.
5402 enumprefix <string>: <-><P:->
5403 An enum member does not start with the enumprefix.
5404 enumprefixexclude: <P:->
5405 An identifier that is not an enum member starts with the enumprefix.
5406 filestaticprefix <string>: <-><P:->
5407 A file-static identifier does not start with the filestaticprefix.
5408 filestaticprefixexclude: <P:->
5409 An identifier that is not file static starts with the filestaticprefix.
5410 globalprefix <string>: <-><P:->
5411 A global variable does not start with the globalprefix
5412 globalprefixexclude: <P:->
5413 An identifier that is not a global variable starts with the globalprefix.
5414 typeprefix <string>: <-><P:->
5415 A user-defined type does not start with the typeprefix
5416 typeprefixexclude: <P:->
5417 An identifier that is not a type name starts with the typeprefix.
5418 externalprefix <string>: <-><P:->
5419 An external identifier does not start with the externalprefix
5420 externalprefixexclude: <P:->
5421 An identifier that is not external starts with the externalprefix.
5422 localprefix <string>: <-><P:->
5423 A local variable does not start with the localprefix
5424 localprefixexclude: <P:->
5425 An identifier that is not a local variable starts with the localprefix.
5426 uncheckedmacroprefix <string>: <-><P:->
5427 An unchecked macro name does not start with the uncheckedmacroprefix
5428 uncheckedmacroprefixexclude: <P:->
5429 An identifier that is not the name of an unchecked macro starts with the
5430 uncheckedmacroprefix.
5431 constprefix <string>: <-><P:->
5432 A constant does not start with the constantprefix
5433 constprefixexclude: <P:->
5434 An identifier that is not a constant starts with the constantprefix.
5435 iterprefix <string>: <-><P:->
5436 An iter does not start with the iterator prefix
5437 iterprefixexclude: <P:->
5438 An identifier that is not a iter starts with the iterprefix.
5439 protoparamprefix <string>: <-><P:->
5440 A parameter name in a function prototype declaration does not start with the
5441 declaration parameter prefix
5442 isoreserved: <M:--++>
5443 External name is reserved for system use by ISO C99 standard.
5445 External name is a C++ keyword or reserved word. This could lead to problems
5446 if the code is compiled with a C++ compiler.
5447 isoreservedinternal: <M:---+>
5448 Internal name is reserved for system in ISO C99 standard (this should not be
5449 necessary unless you are worried about C library implementations that
5450 violate the standard and use macros).
5451 distinctexternalnames: <P:->
5452 An external name is not distinguishable from another external name using the
5453 number of significant characters. According to ANSI Standard (3.1), an
5454 implementation may only consider the first 6 characters significant, and
5455 ignore alphabetical case distinctions (ISO C99 requires 31). The
5456 +externalnamelen <n> flag may be used to change the number of significant
5457 characters, and -externalnamecaseinsensitive to make alphabetical case
5458 significant in external names.
5459 externalnamelen <number> [31]: <S><P:->
5460 Sets the number of significant characters in an external name (default is 6
5461 for old ANSI89 limit, C99 requires 31). Sets +distinctexternalnames.
5462 externalnamecaseinsensitive: <S><P:+>
5463 Make alphabetic case insignificant in external names. By ANSI89 standard,
5464 case need not be significant in an external name. If +distinctexternalnames
5465 is not set, sets +distinctexternalnames with unlimited external name length.
5466 distinctinternalnames: <P:->
5467 An internal name is not distinguishable from another internal name using the
5468 number of significant characters. According to ANSI89 Standard (3.1), an
5469 implementation may only consider the first 31 characters significant (ISO
5470 C99 specified 63). The +internalnamelen <n> flag changes the number of
5471 significant characters, -internalnamecaseinsensitive to makes alphabetical
5472 case significant, and +internalnamelookalike to make similar-looking
5473 characters non-distinct.
5474 internalnamelen <number> [63]: <S><P:->
5475 Sets the number of significant characters in an internal name (ANSI89
5476 default is 31.) Sets +distinctinternalnames.
5477 internalnamecaseinsensitive: <S><P:->
5478 Set whether case is significant an internal names (-internalnamecaseinsensiti
5479 ve means case is significant). By ANSI89 default, case is not significant.
5480 If +distinctinternalnames is not set, sets +distinctinternalnames with
5481 unlimited internal name length.
5482 internalnamelookalike: <S><P:->
5483 Set whether similar looking characters (e.g., "1" and "l") match in internal
5485 protoparamname: <M:---+>
5486 A parameter in a function prototype has a name. This is dangerous, since a
5487 macro definition could be visible here.
5488 protoparammatch: <M:--++>
5489 A parameter in a function definition does not have the same name as the
5490 corresponding in the declaration of the function after removing the
5492 protoparamprefixexclude: <P:->
5493 An identifier that is not a parameter name in a function prototype starts
5494 with the protoparamprefix.
5497 ===================================
5499 An external declaration not used in any source file.
5500 exportlocal: <M:-+++>
5501 A declaration is exported, but not used outside this module. Declaration can
5502 use static qualifier.
5503 exportheader: <M:--++>
5504 A declaration is exported, but does not appear in a header file.
5505 exportheadervar: <M:--++>
5506 A variable declaration is exported, but does not appear in a header file.
5507 (Used with exportheader.)
5509 A field is present in a structure type but never used. Use /*@unused@*/ in
5510 front of field declaration to suppress message.
5511 enummemuse: <M:-+++>
5512 A member of an enum type is never used.
5514 A constant is declared but not used. Use unused in the constant declaration
5515 to suppress message.
5517 A function is declared but not used. Use /*@unused@*/ in front of function
5518 header to suppress message.
5520 A function parameter is not used in the body of the function. If the
5521 argument is needed for type compatibility or future plans, use /*@unused@*/
5522 in the argument declaration.
5524 A type is declared but not used. Use /*@unused@*/ in front of typedef to
5527 A variable is declared but never used. Use /*@unused@*/ in front of
5528 declaration to suppress message.
5529 unusedspecial: <M:---+>
5530 Unused declaration in special file (corresponding to .l or .y file).
5533 ===================================
5535 A function or variable is declared, but not defined in any source code file.
5537 A function or variable is declared in an .lcl file, but not defined in any
5540 A function or variable is declared in an .lcl file, but not declared in any
5544 ===================================
5546 There is a new declaration that is not declared in a loaded library or
5547 earlier file. (Use this flag to check for consistency against a library.)
5550 ===================================
5552 There is information in the specification that is not duplicated in
5553 syntactic comments. Normally, this is not an error, but it may be useful to
5554 detect it to make sure checking incomplete systems without the
5555 specifications will still use this information.
5558 ===================================
5560 Do not load standard library.
5562 Library based on the ISO standard library specification is used.
5564 Stricter version of the standard library is used. (The default library is
5565 standard.lcd; strict library is strict.lcd.)
5567 UNIX version of the standard library is used.
5568 unixstrictlib: <G><P:->
5569 strict version of the UNIX library is used.
5571 POSIX version of the standard library is used.
5572 posixstrictlib: <G><P:->
5573 POSIX version of the strict standard library is used.
5575 Show standard library filename.
5576 warnposixheaders: <P:+>
5577 Header name matches a POSIX header, but the POSIX library is not selected.
5579 Unix library may not be compatible with all platforms
5581 Header <varargs.h> is not part of ANSI Standard. Should use <stdarg.h>
5583 dump <filename>: <G><P:->
5584 Save state for merging (default suffix .lcd).
5585 load <filename>: <G><P:->
5586 Load state from dump file (default suffix .lcd).
5589 ===================================
5590 singleinclude: <G><P:->
5591 When checking multiple files, each header file is processed only once. This
5592 may change the meaning of the code, if the same header file is included in
5593 different contexts (e.g., the header file includes #if directives and the
5594 values are different when it is included in different places.)
5595 neverinclude: <G><P:->
5596 Ignore header includes. Only works if relevant information is loaded from a
5598 skipsysheaders: <G><P:->
5599 Do not include header files in system directories (set by -sysdirs)
5602 ===================================
5603 gnuextensions: <P:+>
5604 ANSI C does not allow some language features supported by gcc and other
5605 compilers. Use +gnuextensions to allow some of these extensions.
5608 ===================================
5610 A function declaration does not have a parameter list.
5612 Function definition is in old style syntax. Standard prototype syntax is
5616 ===================================
5618 The function main does not match the expected type.
5620 The argument to exit should be 0, EXIT_SUCCESS or EXIT_FAILURE
5623 ===================================
5625 An outer declaration is shadowed by the local declaration.
5626 incondefslib: <M:-+++>
5627 A function, variable or constant previously defined in a library is
5628 redefined with a different type.
5630 A function, variable or constant defined in the library is redefined with a
5632 nestedextern: <M:-+++>
5633 An extern declaration is used inside a function scope.
5635 A function or variable is declared in more than one place. This is not
5636 necessarily a problem, since the declarations are consistent.
5638 A function or variable is redefined. One of the declarations should use
5641 A variable declaration has no explicit type. The type is implicitly int.
5644 ===================================
5645 tmpdir <directory> [/tmp/]: <G><P:->
5646 Set directory for writing temp files.
5647 *** Note: possible difference in the test result because of the default path here:
5648 larchpath <path> [.:/usr/local/share/splint/lib:/af10/evans/LCLintDev/lib:]:
5650 Set path for searching for library files (overrides LARCH_PATH environment
5652 *** Note: possible difference in the test result because of the default path here:
5653 lclimportdir <directory> [.:/usr/local/share/splint/imports:/af10/evans/LCLintDe
5654 v/imports]: <G><P:->
5655 Set directory to search for LCL import files (overrides LCLIMPORTDIR).
5656 sysdirs <path> [/usr/]: <G><P:->
5657 Set directories for system files (default /usr/include). Separate
5658 directories with path separator (colons in Unix, semi-colons in Windows).
5659 Flag settings propagate to files in a system directory. If -sysdirerrors is
5660 set, no errors are reported for files in system directories..
5661 skipansiheaders: <P:+>
5662 Prevent inclusion of header files in a system directory with names that
5663 match standard ANSI headers. The symbolic information in the standard
5664 library is used instead. Flag in effect only if a library including the
5665 ANSI library is loaded. The ANSI headers are:
5666 assert, ctype, errno, float, limits, locale, math, setjmp, signal, stdarg,
5667 stddef, stdio, stdlib, strings, string, time, and wchar..
5668 skipposixheaders: <P:+>
5669 Prevent inclusion of header files in a system directory with names that
5670 match standard POSIX headers. The symbolic information in the posix library
5671 is used instead. The POSIX headers are:
5672 dirent, fcntl, grp, pwd, termios, sys/stat, sys/times, sys/types,
5673 sys/utsname, sys/wait, unistd, and utime..
5674 sysdirerrors: <M:---+>
5675 Report errors in files in system directories (set by -sysdirs).
5676 sysdirexpandmacros: <P:+>
5677 Expand macros in system directories regardless of other settings, except for
5678 macros corresponding to names defined in a load library.
5679 I<directory>: <G><P:->
5680 Add to C include path.
5681 S<directory>: <G><P:->
5685 ===================================
5687 A variable, function or type is exported, but not specified.
5689 A function is exported, but not specified.
5690 exportmacro: <M:---+>
5691 A macro is exported, but not specified.
5692 exporttype: <M:---+>
5693 A type is exported, but not specified.
5695 A variable is exported, but not specified.
5696 exportconst: <M:---+>
5697 A constant is exported, but not specified.
5698 exportiter: <M:---+>
5699 A constant is exported, but not specified.
5702 ===================================
5703 linelen <number> [80]: <P:->
5704 Set length of messages (number of chars).
5705 indentspaces <number> [3]: <P:->
5706 Set number of spaces to indent sub-messages.
5708 Show column number where error is found.
5709 parenfileformat: <P:->
5710 Show column number where error is found.
5712 Show name of function containing error.
5714 When a library function is declared with multiple possible type, the
5715 alternate types are shown only if +showallconjs.
5718 ===================================
5720 Make all alternate types implicit (useful for making system libraries.
5723 ===================================
5724 expect <number> [0]: <G><P:->
5725 Expect <int> code errors.
5726 lclexpect <number> [0]: <G><P:->
5727 Expect <int> spec errors.
5728 partial: <-><S><P:->
5729 Check as partial system (-specundef, -declundef, -exportlocal, don't check
5730 macros in headers without corresponding .c files).
5733 ===================================
5737 Generate .lcs files.
5740 ===================================
5742 Command line sets flag in abnormal way
5744 There was a problem reading an initialization file
5746 A flag is not recognized or used in an incorrect way
5747 fileextensions: <P:+>
5748 Warn when command line file does not have a recognized extension.
5753 ===================================
5754 f <filename>: <G><P:->
5755 Read an options file (instead of loading default ~/.splintc)
5756 i <filename>: <G><P:->
5757 Set LCL initilization file.
5759 Do not read the default options file (~/.splintrc)
5760 commentchar <character> [@]: <P:->
5761 Set the marker character for syntactic comments. Comments beginning with
5762 /*<char> are interpreted by Splint, where <char> is the comment marker
5766 ===================================
5767 controlnestdepth <number> [63]: <M:---+>
5768 Maximum number of control levels exceeded.
5769 stringliterallen <number> [4095]: <M:---+>
5770 Maximum length of string literal exceeded.
5771 numstructfields <number> [1023]: <M:---+>
5772 Maximum number of fields in a struct or union exceeded.
5773 numenummembers <number> [1023]: <M:---+>
5774 Limit on maximum number of members of an enum is exceeded.
5775 includenest <number> [63]: <M:--++>
5776 Maximum number of nested #include files exceeded.
5777 ansi89limits: <S><P:->
5778 Check for violations of standard limits (controlnestdepth, stringliterallen,
5779 includenest, numstructfields, numenummembers) based on ANSI89 standard.
5780 iso99limits: <S><P:->
5781 Check for violations of standard limits (controlnestdepth, stringliterallen,
5782 includenest, numstructfields, numenummembers) based on ISO99 standard.
5785 ===================================
5786 D<initializer>: <G><P:->
5787 Passed to pre-processor.
5788 U<initializer>: <G><P:->
5789 Passed to pre-processor.
5790 unrecogdirective: <P:+>
5791 Pre-processor directive is not recognized.
5794 ===================================
5796 The number of errors detected does not match number in /*@i<n>@*/..
5797 limit <number> [-1]: <P:->
5798 Limit <int> consecutive repeated errors.
5801 ===================================
5803 Code cannot be parsed. For help on parse errors, see splint -help
5806 Try to recover from parse error. It really means try - this doesn't usually
5809 Preprocessing error.
5812 ===================================
5814 Types are incompatible.
5815 stringliteraltoolong: <P:+>
5816 A string literal is assigned to a char array too small to hold it.
5817 stringliteralnoroom: <M:-+++>
5818 A string literal is assigned to a char array that is not big enough to hold
5819 the null terminator.
5820 stringliteralsmaller: <M:--++>
5821 A string literal is assigned to a char array that smaller than the string
5823 enummembers: <M:---->
5824 Type of initial values for enum members must be int.
5826 Type of parameter is not consistent with corresponding code in format
5828 formatconst: <M:-+++>
5829 Format parameter is not known at compile-time. This can lead to security
5830 vulnerabilities because the arguments cannot be type checked.
5832 Format code in a format string is not valid.
5835 ===================================
5836 forwarddecl: <M:+--->
5837 Forward declarations of pointers to abstract representation match abstract
5839 voidabstract: <M:+--->
5840 A pointer to void is cast to a pointer to an abstract type (or vice versa).
5842 A pointer to a function is cast to (or used as) a pointer to void (or vice
5845 To allow char types to index arrays, use +charindex.
5847 To allow enum types to index arrays, use +enumindex.
5849 To make bool and int types equivalent, use +boolint.
5851 To make char and int types equivalent, use +charint.
5853 To make enum and int types equivalent, use +enumint.
5854 floatdouble: <M:+--->
5855 To make float and double types equivalent, use +floatdouble.
5856 ignorequals: <M:---->
5857 To ignore type qualifiers in type comparisons use +ignorequals.
5858 duplicatequals: <P:+>
5859 Duplicate type qualifiers not supported by ISO standard.
5860 ignoresigns: <M:---->
5861 To ignore signs in type comparisons use +ignoresigns
5862 numliteral: <M:++-->
5863 An int literal is used as any numeric type (including float and long long).
5864 Use +numliteral to allow int literals to be used as any numeric type.
5865 charintliteral: <M:+--->
5866 A character constant is used as an int. Use +charintliteral to allow
5867 character constants to be used as ints. (This is safe since the actual type
5868 of a char constant is int.)
5869 relaxquals: <M:++-->
5870 To allow qualifier mismatches that are not dangerous, use +relaxquals.
5871 relaxtypes: <M:---->
5872 To allow all numeric types to match, use +relaxtypes.
5873 charunsignedchar: <M:+--->
5874 To allow char and unsigned char types to match use +charunsignedchar.
5875 matchanyintegral: <M:---->
5876 To allow arbitrary integral types to match any integral type, use
5878 longunsignedintegral: <M:+--->
5879 To allow arbitrary integral types to match long unsigned, use
5880 +longunsignedintegral.
5881 longintegral: <M:---->
5882 To allow arbitrary integral types to match long unsigned, use +longintegral.
5883 longunsignedunsignedintegral: <M:+--->
5884 To allow arbitrary unsigned integral types to match long unsigned, use
5885 +longunsignedunsignedintegral.
5886 longsignedintegral: <M:---->
5887 To allow arbitrary signed integral types to match long unsigned, use
5888 +longsignedintegral.
5890 Tread 0 as a pointer.
5892 Treat 0 as a boolean.
5895 ===================================
5896 repeatunrecog: <P:->
5897 Identifier used in code has not been declared. (Message repeated for future
5900 Identifier used in code has not been declared. (Message repeated for future
5901 uses in this file.) Use +gnuextensions to make Splint recognize some
5902 keywords that are gnu extensions.
5904 Identifier used in code has not been declared.
5907 ===================================
5908 annotationerror: <P:+>
5909 A declaration uses an invalid annotation.
5911 A syntactic comment is used inconsistently.
5914 ===================================
5916 Declaration marked with warn clause is used (can be suppresed by more
5918 bufferoverflow: <M:-+++>
5919 Use of function that may lead to buffer overflow.
5920 bufferoverflowhigh: <M:++++>
5921 Use of function that may lead to buffer overflow.
5922 implementationoptional: <M:--++>
5923 Use of a declarator that is implementation optional, not required by ISO99.
5925 Use of a declarator that is marked as a legacy entry in the Unix Standard.
5926 multithreaded: <M:--++>
5927 Non-reentrant function should not be used in multithreaded code.
5928 portability: <M:--++>
5929 Use of function that may have implementation-dependent behavior.
5931 Call to function restricted to superusers.
5933 Possible time of check, time of use vulnerability.
5934 unixstandard: <M:---->
5935 Use of function that need not be provided by UNIX implementations
5938 ===================================
5939 its4mostrisky: <S><P:->
5940 Security vulnerability classified as most risky in its4 database.
5941 its4veryrisky: <S><P:->
5942 Security vulnerability classified as very risky in its4 database.
5944 Security vulnerability classified as risky in its4 database.
5945 its4moderate: <S><P:->
5946 Security vulnerability classified as moderate risk in its4 database.
5948 Security vulnerability classified as risky in its4 database.
5951 ===================================
5953 Ignore all stylized comments.
5955 Ignore access comments.
5956 unrecogcomments: <P:+>
5957 Word after a stylized comment marker does not correspond to a stylized
5959 unrecogflagcomments: <P:+>
5960 Semantic comment attempts to set a flag that is not recognized.
5961 tmpcomments: <M:---->
5962 Interpret t comments (ignore errors in lines marked with /*@t<n>@*/.
5964 Interpret traditional lint comments (/*FALLTHROUGH*/, /*NOTREACHED*/).
5965 warnlintcomments: <M:-+++>
5966 A traditional lint comment is used. Some traditional lint comments are
5967 interpreted by Splint to enable easier checking of legacy code. It is
5968 preferable to replace these comments with the suggested Splint alternative.
5971 ===================================
5972 continuecomment: <P:->
5973 A line continuation marker (\) appears inside a comment on the same line as
5974 the comment close. Preprocessors should handle this correctly, but it causes
5975 problems for some preprocessors.
5976 slashslashcomment: <P:->
5977 A // comment is used. ISO C99 allows // comments, but earlier standards did
5980 A comment open sequence (/*) appears within a comment. This usually means
5981 an earlier comment was not closed.
5984 ===================================
5986 Suppress herald and error count.
5988 Send error messages to standard error (instead of standard out).
5990 Show summary of all errors reported and suppressed.
5992 Show file names are they are processed.
5994 Display lines processed and time.
5996 Display time distribution.
5997 showalluses: <G><P:->
5998 Show sorted list of uses of all globals.
6001 ===================================
6003 Provide a hint the first time a particular warning appears
6005 Provide a hint for every warning
6008 ===================================
6009 bugslimit <number> [3]: <P:->
6010 Set maximum number of bugs detected before giving up.
6011 debugfcnconstraint: <M:---->
6012 Perform buffer overflow checking even if the errors would be surpressed.
6013 grammar: <-><S><P:->
6016 Do not delete temporary files.
6018 Do not pre-process input files.
6019 showsourceloc: <-><P:->
6020 Display the source code location where a warning is produced.
andersk / splint.git / blob