2 Source files are .c, .h and .lcl files. If there is no suffix,
3 Splint will look for <file>.c and <file>.lcl.
5 Use splint -help <topic or flag name> for more information
9 annotations (describes source-code annotations)
10 comments (describes control comments)
11 flags (describes flag categories)
12 flags <category> (describes flags in category)
13 flags all (short description of all flags)
14 flags alpha (list all flags alphabetically)
15 flags full (full description of all flags)
16 mail (information on mailing lists)
17 modes (show mode settings)
18 parseerrors (help on handling parser errors)
19 prefixcodes (character codes in namespace prefixes)
20 references (sources for more information)
21 vars (environment variables)
22 version (information on compilation, maintainer)
25 Finished checking --- no code processed
27 Source files are .c, .h and .lcl files. If there is no suffix,
28 Splint will look for <file>.c and <file>.lcl.
30 Use splint -help <topic or flag name> for more information
34 annotations (describes source-code annotations)
35 comments (describes control comments)
36 flags (describes flag categories)
37 flags <category> (describes flags in category)
38 flags all (short description of all flags)
39 flags alpha (list all flags alphabetically)
40 flags full (full description of all flags)
41 mail (information on mailing lists)
42 modes (show mode settings)
43 parseerrors (help on handling parser errors)
44 prefixcodes (character codes in namespace prefixes)
45 references (sources for more information)
46 vars (environment variables)
47 version (information on compilation, maintainer)
51 Command Line: Unrecognized option: asdf
52 A flag is not recognized or used in an incorrect way (Use -badflag to inhibit
55 Finished checking --- no code processed
57 Warning: setting +boolint redundant with current value
59 Finished checking --- no code processed
139 distinctexternalnames
140 distinctinternalnames
167 externalnamecaseinsensitive
170 externalprefixexclude
179 filestaticprefixexclude
218 impcheckedstrictglobs
219 impcheckedstrictspecglobs
220 impcheckedstrictstatics
226 implementationoptional
241 internalnamecaseinsensitive
243 internalnamelookalike
278 longunsignedunsignedintegral
296 macrovarprefixexclude
383 protoparamprefixexclude
416 showconstraintlocation
482 uncheckedmacroprefixexclude
505 warnmissingglobsnoglobs
517 null --- misuses of null pointer
518 nullderef --- possible dereferencce of null pointer
519 nullpass --- possibly null pointer passed as formal with no null annotation
520 nullret --- possibly null pointer returned as result with no null annotation
521 nullstate --- possibly null pointer reachable from a reference with no null
523 nullassign --- inconsistent assignment or initialization involving null pointer
524 usedef --- use before definition
525 mustdefine --- out storage not defined before return or scope exit
526 uniondef --- at least one field of a union must be defined
527 compdef --- parameter, return value or global completely defined
528 fullinitblock --- initializer sets all fields
529 initallelements --- initializer defines all array elements
530 initsize --- initializer defines extra array elements
531 impouts --- pointer parameters to unspecified functions may be implicit out
533 incondefs --- function, variable or constant redefined with inconsistent type
534 matchfields --- struct or enum type redefined with inconsistent fields or
536 fcnderef --- dereferencce of a function type
537 realcompare --- dangerous comparison between reals (dangerous because of
538 inexact floating point representations)
539 unsignedcompare --- comparison using <, <=, >= between an unsigned integral and
541 ptrarith --- arithmetic involving pointer and integer
542 nullptrarith --- arithmetic involving possibly null pointer and integer
543 ptrcompare --- comparison between pointer and number
544 strictops --- primitive operation does not type check strictly
545 bitwisesigned --- a bitwise logical operator does not have unsigned operands
546 shiftnegative --- a shift right operand may be negative
547 shiftimplementation --- a shift left operand may be negative
548 sizeoftype --- sizeof operator has a type argument
549 sizeofformalarray --- sizeof operator has an array formal parameter argument
550 fixedformalarray --- formal parameter of type array is declared with size
551 incompletetype --- formal parameter has an incomplete type
552 formalarray --- formal parameter is an array
553 booltype --- set name of boolean type (default bool)
554 boolfalse --- set name of boolean false (default FALSE)
555 booltrue --- set name of boolean true (default TRUE)
556 likelybool --- type name is probably a boolean type but does not match default
557 boolean type name, "bool", and alternate name is not set
558 boolcompare --- comparison between bools (dangerous because of multiple TRUE
560 boolops --- primitive operation (!, && or ||) does not has a boolean argument
561 ptrnegate --- allow ! to be used on pointer operand
562 predassign --- condition test (if, while or for) is an assignment
563 predbool --- type of condition test (if, while or for) not bool (sets
564 predboolint, predboolptr and predboolothers)
565 predboolint --- type of condition test (if, while or for) is an integral type
566 predboolptr --- type of condition test (if, while or for) is a pointer
567 predboolothers --- type of condition test (if, while or for) not bool, int or
569 abstract --- data abstraction barriers
570 impabstract --- assume user type definitions are abstract (unless
571 /*@concrete@*/ is used)
572 accessmodule --- allow access to abstract types in definition module
573 accessfile --- allow access to abstract types by file name convention
574 accessczech --- allow access to abstract types by czech naming convention
575 accessslovak --- allow access to abstract types by slovak naming convention
576 accessczechoslovak --- allow access to abstract types by czechoslovak naming
578 accessall --- set accessmodule, accessfile and accessczech
579 mutrep --- representation of mutable type has sharing semantics
580 mustfreefresh --- freshly allocated storage not released before return or scope
582 mustfreeonly --- only storage not released before return or scope exit
583 mustfree --- fresh or only storage not released before return or scope exit
584 (sets mustfreefresh and mustfreeonly)
585 usereleased --- storage used after release
586 strictusereleased --- element used after it may have been released
587 compdestroy --- all only references derivable from void pointer out only
588 parameter are released
589 strictdestroy --- report complete destruction errors for array elements that
590 may have been released
591 deparrays --- array elements are dependent storage
592 branchstate --- storage has inconsistent states of alternate paths through a
594 strictbranchstate --- storage through array fetch has inconsistent states of
595 alternate paths through a branch
596 memchecks --- sets all dynamic memory checking flags (memimplicit, mustfree,
597 mustdefine, mustnotalias, null, memtrans)
598 compmempass --- actual parameter matches alias kind of formal parameter
600 stackref --- external reference to stack-allocated storage is created
601 memtrans --- memory transfer errors (sets all *trans flags)
602 dependenttrans --- dependent transfer errors
603 newreftrans --- new reference transfer to reference counted reference
604 onlytrans --- only storage transferred to non-only reference (memory leak)
605 onlyunqglobaltrans --- only storage transferred to an unqualified global or
606 static reference (memory leak)
607 ownedtrans --- owned storage transferred to non-owned reference (memory leak)
608 freshtrans --- fresh storage transferred to non-only reference (memory leak)
609 sharedtrans --- shared storage transferred to non-shared reference
610 temptrans --- temp storage transferred to non-temporary reference
611 kepttrans --- kept storage transferred to non-temporary reference
612 keeptrans --- keep storage transferred inconsistently
613 immediatetrans --- an immediate address (result of &) is transferred
615 refcounttrans --- reference counted storage is transferred in an inconsistent
617 statictrans --- static storage is transferred in an inconsistent way
618 unqualifiedtrans --- unqualified storage is transferred in an inconsistent way
619 staticinittrans --- static storage is used as an initial value in an
621 unqualifiedinittrans --- unqualified storage is used as an initial value in an
623 readonlytrans --- report memory transfer errors for initializations to
624 read-only string literals
625 passunknown --- passing a value as an un-annotated parameter clears its
627 readonlystrings --- string literals are read-only (error if one is modified or
629 memimp --- memory errors for unqualified storage
630 paramimptemp --- assume unannotated parameter is temp
631 allimponly --- sets globimponly, retimponly, structimponly, specglobimponly,
632 specretimponly and specstructimponly
633 codeimponly --- sets globimponly, retimponly and structimponly
634 specimponly --- sets specglobimponly, specretimponly and specstructimponly
635 globimponly --- assume unannotated global storage is only
636 retimponly --- assume unannotated returned storage is only
637 structimponly --- assume unannotated structure field is only
638 specglobimponly --- assume unannotated global storage is only
639 specretimponly --- assume unannotated returned storage is only
640 specstructimponly --- assume unannotated structure field is only
641 aliasunique --- unique parameter is aliased
642 mayaliasunique --- unique parameter may be aliased
643 mustnotalias --- temp storage aliased at return point or scope exit
644 retalias --- function returns alias to parameter or global
645 globalias --- function returns with global aliasing external state (sets
646 checkstrictglobalias, checkedglobalias, checkmodglobalias and
648 checkstrictglobalias --- function returns with a checkstrict global aliasing
650 checkedglobalias --- function returns with a checked global aliasing external
652 checkmodglobalias --- function returns with a checkmod global aliasing external
654 uncheckedglobalias --- function returns with an unchecked global aliasing
656 exposetrans --- exposure transfer errors
657 observertrans --- observer transfer errors
658 repexpose --- abstract representation is exposed (sets assignexpose, retexpose,
660 retexpose --- abstract representation is exposed (return values only)
661 assignexpose --- abstract representation is exposed (assignments only)
662 castexpose --- abstract representation is exposed through a cast
663 redundantsharequal --- declaration uses observer qualifier that is always true
664 misplacedsharequal --- declaration of unsharable storage uses sharing
666 mods --- unspecified modification of caller-visible state
667 mustmod --- specified modification is not detected
668 modobserver --- possible modification of observer storage
669 modobserveruncon --- possible modification of observer storage through
671 modinternalstrict --- possible modification of internal storage through
673 modfilesys --- report undocumented file system modifications (applies to
674 unspecified functions if modnomods is set)
675 modunspec --- modification in unspecified functions (sets modnomods,
676 modglobunspec and modstrictglobsunspec)
677 modnomods --- modification in a function with no modifies clause
678 moduncon --- possible modification through a call to an unconstrained function
679 modunconnomods --- possible modification through a call to an unconstrained
680 function in a function with no modifies clause
681 globsimpmodsnothing --- functions declared with a globals list but no modifies
682 clause are assumed to modify nothing
683 modsimpnoglobs --- functions declared with a modifies clause but no globals
684 list are assumed to use no globals
685 globstate --- returns with global in inconsistent state (null or undefined)
686 globs --- undocumented use of a checked global variable
687 globuse --- global listed for a function not used
688 internalglobs --- use of internalState
689 internalglobsnoglobs --- use of internalState (in function with no globals
691 warnmissingglobs --- global variable used in modifies clause is not listed in
693 warnmissingglobsnoglobs --- global variable used in modifies clause in a
694 function with no globals list
695 globnoglobs --- use of checked global in a function with no globals list or
697 allglobs --- report use and modification errors for globals not annotated with
699 checkstrictglobs --- report use and modification errors for checkedstrict
701 impcheckedspecglobs --- assume checked qualifier for unqualified global
702 declarations in .lcl files
703 impcheckmodspecglobs --- assume checkmod qualifier for unqualified global
704 declarations in .lcl files
705 impcheckedstrictspecglobs --- assume checkmod qualifier for unqualified global
706 declarations in .lcl files
707 impcheckedglobs --- assume checked qualifier for unqualified global
709 impcheckmodglobs --- assume checkmod qualifier for unqualified global
711 impcheckedstrictglobs --- assume checkedstrict qualifier for unqualified global
713 impcheckedstatics --- assume checked qualifier for unqualified file static
715 impcheckmodstatics --- assume checkmod qualifier for unqualified file static
717 impcheckmodinternals --- assume checkmod qualifier for unqualified local static
718 declarations (for internal state modifications)
719 impcheckedstrictstatics --- assume checkedstrict qualifier for unqualified file
721 modglobs --- undocumented modification of a checked global variable
722 modglobsnomods --- undocumented modification of a checked global variable in a
723 function declared with no modifies clause
724 modstrictglobsnomods --- undocumented modification of a strict checked global
725 variable in a function declared with no modifies clause
726 modglobsunchecked --- undocumented modification of an unchecked checked global
728 noret --- path with no return detected in non-void function
729 emptyreturn --- empty return in function declared to return value
730 alwaysexits --- loop predicate always exits
731 loopexec --- assume all loops execute at least once (sets forloopexec,
732 whileloopexec and iterloopexec)
733 forloopexec --- assume all for loops execute at least once
734 whileloopexec --- assume all while loops execute at least once
735 iterloopexec --- assume all iterator loops execute at least once
736 obviousloopexec --- assume loop that can be determined to always execute always
738 evalorder --- code has unspecified or implementation-dependent behavior because
739 of order of evaluation
740 evalorderuncon --- code involving call to unspecified function has undefined or
741 implementation-dependent behavior
742 infloops --- likely infinite loop is detected
743 infloopsuncon --- likely infinite loop is detected (may result from
744 unconstrained function)
745 casebreak --- non-empty case in a switch without preceding break
746 misscase --- switch on enum type missing case for some value
747 firstcase --- first statement in switch is not a case
748 duplicatecases --- duplicate cases in switch
749 deepbreak --- break inside nested while or for or switch
750 looploopbreak --- break inside nested while or for
751 switchloopbreak --- break in loop inside switch
752 loopswitchbreak --- break in switch inside loop
753 switchswitchbreak --- break in switch inside switch
754 looploopcontinue --- continue inside nested loop
755 whileempty --- a while statement has no body
756 whileblock --- the body of a while statement is not a block
757 forempty --- a for statement has no body
758 forblock --- the body of a for statement is not a block
759 ifempty --- an if statement has no body
760 ifblock --- the body of an if statement is not a block
761 allempty --- an if, while or for statement has no body (sets ifempty,
762 whileempty and forempty
763 allblock --- the body of an if, while or for statement is not a block (sets
764 ifblock, whileblock and forblock)
765 elseifcomplete --- if ... else if chains must have final else
766 unreachable --- unreachable code detected
767 noeffect --- statement with no effect
768 noeffectuncon --- statement with no effect (except possibly through call to
769 unconstrained function)
770 retval --- return value ignored (sets retvalint, retvalbool and retvalother)
771 retvalother --- return value of type other than bool or int ignored
772 retvalbool --- return value of manifest type bool ignored
773 retvalint --- return value of type int ignored
774 nullterminated --- misuse of nullterminated allocation
775 bounds --- memory bounds checking (sets boundsread and boundswrite)
776 boundsread --- possible out of bounds read
777 boundswrite --- possible buffer overflow from an out of bounds write
778 fcnpost --- display function post conditions
779 redundantconstraints --- display seemingly redundant constraints
780 checkpost --- unable to verify predicate in ensures clause
781 implictconstraint --- generate implicit constraints for functions
782 orconstraint --- use limited OR expressions to resolve constraints
783 nullterminated --- misuse of nullterminated allocation
784 showconstraintparens --- display parentheses around constraint terms
785 showconstraintlocation --- display location for every constraint generated
786 mts --- load meta state declaration and corresponding xh file
787 statetransfer --- storage has been transfered with invalid state
788 statemerge --- control paths merge with storage in incompatible states
789 macroredef --- macro redefined
790 macrounrecog --- unrecognized identifier in macro
791 macroconstdecl --- non-parameterized macro without prototype or specification
792 macrostmt --- macro definition is syntactically not equivalent to function
793 macroempty --- macro definition for is empty
794 macroparams --- macro parameter not used exactly once
795 macroreturn --- return statement in macro body
796 macroassign --- assignment to a macro parameter
797 macroparens --- macro parameter used without parentheses (in potentially
799 macrodecl --- macro without prototype or specification (sets macrofcndecl and
801 macrofcndecl --- parameterized macro without prototype or specification
802 sefparams --- a parameter with side-effects is passed as a sef parameter
803 sefuncon --- a parameter with unconstrained side-effects is passed as a sef
805 constmacros --- check all macros without parameter lists as constants
806 fcnmacros --- check all macros with parameter lists as functions
807 allmacros --- sets fcnmacros and constmacros
808 libmacros --- check all macros with declarations in library as functions
809 specmacros --- check all macros corresponding to specified functions or
811 macromatchname --- macro definition does not match iter or constant declaration
812 nextlinemacros --- the line after a constant or iter declaration must be a
814 iterbalance --- iter is not balanced with end_<iter>
815 iteryield --- iter yield parameter is inappropriate
816 hasyield --- iter declaration has no yield parameters
817 namechecks --- controls name checking without changing other settings
818 czech --- czech naming convention (sets accessczech, czechfunctions, czechvars,
819 czechconstants, czechenums, and czechmacros)
820 czechfcns --- czech naming convention violated in a function or iterator
822 czechvars --- czech naming convention violated in a variable declaration
823 czechmacros --- czech naming convention violated in an expanded macro name
824 czechconsts --- czech naming convention violated in a constant declaration
825 czechtypes --- czech naming convention violated in a user-defined type
827 slovak --- slovak naming convention violated
828 slovakfcns --- slovak naming convention violated in a function or iterator
830 slovakmacros --- slovak naming convention violated in an expanded macro name
831 slovakvars --- slovak naming convention violated in a variable declaration
832 slovakconsts --- slovak naming convention violated in a constant declaration
833 slovaktypes --- slovak naming convention violated in a use-defined type
835 czechoslovak --- czech or slovak naming convention violated
836 czechoslovakfcns --- czechoslovak naming convention violated in a function or
838 czechoslovakmacros --- czechoslovak naming convention violated in an expanded
840 czechoslovakvars --- czechoslovak naming convention violated in a variable
842 czechoslovakconsts --- czechoslovak naming convention violated in a constant
844 czechoslovaktypes --- czechoslovak naming convention violated in a user-defined
846 macrovarprefix --- set namespace prefix for variables declared in a macro body
847 macrovarprefixexclude --- the macrovarprefix may not be used for non-macro
849 tagprefix --- set namespace prefix for struct, union and enum tags
850 tagprefixexclude --- the tagprefix may not be used for non-tag identifiers
851 enumprefix --- set namespace prefix for enum members
852 enumprefixexclude --- the enumprefix may not be used for non-enum member
854 filestaticprefix --- set namespace prefix for file static declarations
855 filestaticprefixexclude --- the filestaticprefix may not be used for
856 identifiers that are not file static
857 globalprefix --- set namespace prefix for global variables
858 globalprefixexclude --- the globalprefix may not be used for non-global
860 typeprefix --- set namespace prefix for user-defined types
861 typeprefixexclude --- the typeprefix may not be used for identifiers that are
863 externalprefix --- set namespace prefix for external identifiers
864 externalprefixexclude --- the externalprefix may not be used for non-external
866 localprefix --- set namespace prefix for local variables
867 localprefixexclude --- the localprefix may not be used for non-local
869 uncheckedmacroprefix --- set namespace prefix for unchecked macros
870 uncheckedmacroprefixexclude --- the uncheckmacroprefix may not be used for
871 identifiers that are not unchecked macros
872 constprefix --- set namespace prefix for constants
873 constprefixexclude --- the constprefix may not be used for non-constant
875 iterprefix --- set namespace prefix for iterators
876 iterprefixexclude --- the iterprefix may not be used for non-iter identifiers
877 protoparamprefix --- set namespace prefix for parameters in function prototype
879 isoreserved --- external name conflicts with name reserved for system or
881 cppnames --- external or internal name is a C++ keyword or reserved word
882 isoreservedinternal --- internal name conflicts with name reserved for system
884 distinctexternalnames --- external name is not distinguishable from another
885 external name using the number of significant characters
886 externalnamelen --- set the number of significant characters in an external
888 externalnamecaseinsensitive --- alphabetic comparisons for external names are
890 distinctinternalnames --- internal name is not distinguishable from another
891 internal name using the number of significant characters
892 internalnamelen --- set the number of significant characters in an internal
894 internalnamecaseinsensitive --- set whether case is significant an internal
895 names (-internalnamecaseinsensitive means case is significant)
896 internalnamelookalike --- lookalike characters match in internal names
897 protoparamname --- a parameter in a function prototype has a name
898 protoparammatch --- the name of a parameter in a function prototype and
899 corresponding declaration must match (after removing the protoparamprefix
900 protoparamprefixexclude --- the protoparamprefix may not be used for
901 non-declaraction parameter identifiers
902 topuse --- declaration at top level not used
903 exportlocal --- a declaration is exported but not used outside this module
904 exportheader --- a declaration is exported but does not appear in a header file
905 exportheadervar --- a variable declaration is exported but does not appear in a
907 fielduse --- field of structure type not used
908 enummemuse --- member of an enum type not used
909 constuse --- constant declared but not used
910 fcnuse --- function declared but not used
911 paramuse --- function parameter not used
912 typeuse --- type declared but not used
913 varuse --- variable declared but not used
914 unusedspecial --- unused declaration in special file (corresponding to .l or .y
916 declundef --- function or variable declared but never defined
917 specundef --- function or variable specified but never defined
918 specundecl --- function or variable specified but never declared in a source
920 newdecl --- report new global declarations in source files
921 needspec --- information in specifications is not also included in syntactic
923 nolib --- do not load standard library
924 isolib --- use normal standard library
925 strictlib --- interpret standard library strictly
926 unixlib --- use UNIX (sort-of) standard library
927 unixstrictlib --- use strict version of UNIX (sort-of) library
928 posixlib --- use POSIX standard library
929 posixstrictlib --- use strict POSIX standard library
930 whichlib --- show standard library filename
931 warnposixheaders --- a POSIX header is included, but the POSIX library is not
933 warnunixlib --- warn when the unix library is used
934 usevarargs --- non-standard <varargs.h> included
935 dump --- save state for merging (default suffix .lcd)
936 load --- load state from dump file (default suffix .lcd)
937 singleinclude --- optimize header inclusion to eliminate redundant includes
938 neverinclude --- optimize header inclusion to not include any header files
939 skipsysheaders --- do not include header files in system directories (set by
941 gnuextensions --- support some gnu (gcc) language extensions
942 noparams --- function declaration has no parameter list
943 oldstyle --- old style function definition
944 maintype --- type of main does not match expected type
945 exitarg --- argument to exit has implementation defined behavior
946 shadow --- declaration reuses name visible in outer scope
947 incondefslib --- function, variable or constant defined in a library is
948 redefined with inconsistent type
949 overload --- library function overloaded
950 nestedextern --- an extern declaration is inside a function scope
951 redecl --- function or variable redeclared
952 redef --- function or variable redefined
953 imptype --- variable declaration has unknown (implicitly int) type
954 tmpdir --- set directory for writing temp files
955 larchpath --- set path for searching for library files (overrides LARCH_PATH
956 environment variable)
957 lclimportdir --- set directory to search for LCL import files (overrides
959 sysdirs --- set directories for system files (default /usr/include). Separate
960 directories with path separator (colons in Unix, semi-colons in Windows). Flag
961 settings propagate to files in a system directory. If -sysdirerrors is set, no
962 errors are reported for files in system directories.
963 skipansiheaders --- prevent inclusion of header files in a system directory
964 with names that match standard ANSI headers. The symbolic information in the
965 standard library is used instead. Flag in effect only if a library including
966 the ANSI library is loaded. The ANSI headers are:
967 assert, ctype, errno, float, limits, locale, math, setjmp, signal, stdarg,
968 stddef, stdio, stdlib, strings, string, time, and wchar.
969 skipposixheaders --- prevent inclusion of header files in a system directory
970 with names that match standard POSIX headers. The symbolic information in the
971 posix library is used instead. The POSIX headers are:
972 dirent, fcntl, grp, pwd, termios, sys/stat, sys/times, sys/types, sys/utsname,
973 sys/wait, unistd, and utime.
974 sysdirerrors --- report errors in files in system directories (set by -sysdirs)
975 sysdirexpandmacros --- expand macros in system directories regardless of other
976 settings, except for macros corresponding to names defined in a load library
977 I<directory> --- add to C include path
978 S<directory> --- add to spec path
979 exportany --- variable, function or type exported but not specified
980 exportfcn --- function exported but not specified
981 exportmacro --- expanded macro exported but not specified
982 exporttype --- type definition exported but not specified
983 exportvar --- variable exported but not specified
984 exportconst --- constant exported but not specified
985 exportiter --- constant exported but not specified
986 linelen --- set length of messages (number of chars)
987 indentspaces --- set number of spaces to indent sub-messages
988 showcolumn --- show column number where error is found
989 parenfileformat --- show column number where error is found
990 showfunc --- show name of function containing error
991 showallconjs --- show all possible types
992 impconj --- make all alternate types implicit (useful for making system
994 expect --- expect <int> code errors
995 lclexpect --- expect <int> spec errors
996 partial --- check as partial system (-specundef, -declundef, -exportlocal,
997 don't check macros in headers without corresponding .c files)
998 lh --- generate .lh files
999 lcs --- generate .lcs files
1000 warnflags --- warn when command line sets flag in abnormal way
1001 warnrc --- warn when there are problems with reading the initialization files
1002 badflag --- warn about bad command line flags
1003 fileextensions --- warn when command line file does not have a recognized
1005 help --- -help <flags> will describe flags
1006 f --- read an options file (default ~/.splintrc not loaded)
1007 i --- set LCL initilization file
1008 nof --- do not read options file
1009 commentchar --- set marker character for syntactic comments (default is '@')
1010 controlnestdepth --- set maximum nesting depth of compound statements,
1011 iteration control structures, and selection control structures (ANSI89 minimum
1013 stringliterallen --- set maximum length of string literals (ANSI89 minimum is
1015 numstructfields --- set maximum number of fields in a struct or union (ANSI89
1016 minimum is 127; ISO99 is 1023)
1017 numenummembers --- set maximum number of members of an enum (ANSI89 minimum is
1019 includenest --- set maximum number of nested #include files (ANSI89 minimum is
1021 ansi89limits --- check for violations of standard limits (controlnestdepth,
1022 stringliterallen, includenest, numstructfields, numenummembers) based on ANSI89
1024 iso99limits --- check for violations of standard limits (controlnestdepth,
1025 stringliterallen, includenest, numstructfields, numenummembers) based on ISO99
1027 D<initializer> --- passed to pre-processor
1028 U<initializer> --- passed to pre-processor
1029 unrecogdirective --- unrecognized pre-processor directive
1030 supcounts --- The number of errors detected does not match number in
1032 limit --- limit <int> consecutive repeated errors
1033 syntax --- syntax error in parsing
1034 trytorecover --- try to recover from parse error
1035 preproc --- preprocessing error
1036 type --- type mismatch
1037 stringliteraltoolong --- string literal too long for character array
1038 stringliteralnoroom --- string literal leaves no room for null terminator
1039 stringliteralsmaller --- string literal is smaller than the char array it is
1041 enummembers --- enum members must be int values
1042 formattype --- type-mismatch in parameter corresponding to format code in a
1043 printf or scanf-like function
1044 formatconst --- format parameter is not a string constant (hence variable
1045 arguments cannot be typechecked)
1046 formatcode --- invalid format code in format string for printf or scanf-like
1048 forwarddecl --- forward declarations of pointers to abstract representation
1050 voidabstract --- void * matches pointers to abstract types, casting ok
1052 castfcnptr --- a pointer to a function is cast to a pointer to void (or vice
1054 charindex --- char can be used to index arrays
1055 enumindex --- enum can be used to index arrays
1056 boolint --- bool and int are equivalent
1057 charint --- char and int are equivalent
1058 enumint --- enum and int are equivalent
1059 floatdouble --- float and double are equivalent
1060 ignorequals --- ignore type qualifiers (long, short, unsigned)
1061 duplicatequals --- report duplicate type qualifiers (e.g., unsigned unsigned)
1062 ignoresigns --- ignore signs in type comparisons (unsigned matches signed)
1063 numliteral --- int literals can be reals
1064 charintliteral --- character constants (e.g., 'a') can be used as ints
1065 relaxquals --- report qualifier mismatches only if dangerous
1066 relaxtypes --- allow all numeric types to match
1067 charunsignedchar --- allow char and unsigned char types to match
1068 matchanyintegral --- allow any intergral type to match an arbitrary integral
1070 longunsignedintegral --- allow long unsigned type to match an arbitrary
1071 integral type (e.g., dev_t)
1072 longintegral --- allow long type to match an arbitrary integral type (e.g.,
1074 longunsignedunsignedintegral --- allow long unsigned type to match an arbitrary
1075 unsigned integral type (e.g., size_t)
1076 longsignedintegral --- allow long type to match an arbitrary signed integral
1077 type (e.g., ssize_t)
1078 zeroptr --- tread 0 as a pointer
1079 zerobool --- treat 0 as a boolean
1080 repeatunrecog --- do not suppress repeated unrecognized identifier messages
1081 (instead of only reporting the first error)
1082 sysunrecog --- report unrecognized identifiers with system (__) prefix
1083 unrecog --- unrecognized identifier
1084 annotationerror --- annotation is used in inconsistent location
1085 commenterror --- inconsistent syntactic comment
1086 warnuse --- warn when declaration marked with warn is used
1087 bufferoverflow --- possible buffer overflow vulnerability
1088 bufferoverflowhigh --- likely buffer overflow vulnerability
1089 implementationoptional --- declarator is implementation optional (ISO99 does
1090 not require an implementation to provide it)
1091 legacy --- legacy declaration in Unix Standard
1092 multithreaded --- function is not reentrant
1093 portability --- function may have undefined behavior
1094 superuser --- function is restricted to superusers
1095 toctou --- possible time of check, time of use vulnerability
1096 unixstandard --- function is not required in Standard UNIX Specification
1097 its4mostrisky --- most risky security vulnerabilities (from its4 database)
1098 its4veryrisky --- very risky security vulnerabilities (from its4 database)
1099 its4risky --- risky security vulnerabilities (from its4 database)
1100 its4moderate --- moderately risky security vulnerabilities (from its4 database)
1101 its4low --- risky security vulnerabilities (from its4 database)
1102 nocomments --- ignore all stylized comments
1103 noaccess --- ignore access comments
1104 unrecogcomments --- stylized comment is unrecognized
1105 unrecogflagcomments --- stylized flag comment uses an unrecognized flag
1106 tmpcomments --- interpret t comments (ignore errors in lines marked with
1108 lintcomments --- interpret traditional lint comments (/*FALLTHROUGH*/,
1110 warnlintcomments --- warn when a traditional lint comment is used
1111 continuecomment --- line continuation marker (\) in comment before */ on same
1113 slashslashcomment --- use of // comment
1114 nestcomment --- comment begins inside comment
1115 quiet --- suppress herald and error count
1116 usestderr --- send error messages to standard error (instead of standard out)
1117 showsummary --- show summary of all errors reported and suppressed
1118 showscan --- show file names are they are processed
1119 stats --- display lines processed and time
1120 timedist --- display time distribution
1121 showalluses --- show sorted list of uses of all globals
1122 hints --- provide a hint the first time a particular warning appears
1123 forcehints --- provide a hint for every warnings
1124 bugslimit --- set maximum number of bugs detected before giving up
1125 debugfcnconstraint --- debug function constraints
1126 grammar --- debug parsing
1127 keep --- do not delete temporary files
1128 nopp --- do not pre-process input files
1129 showsourceloc --- display the source code location where a warning is produced
1133 passed to pre-processor
1139 add to C include path
1140 Categories: directories, headers
1146 Categories: directories, specifications
1151 passed to pre-processor
1157 data abstraction barriers
1161 An abstraction barrier is broken. If necessary, use /*@access <type>@*/
1162 to allow access to an abstract type.
1165 set accessmodule, accessfile and accessczech
1166 Categories: abstract, names
1169 Sets accessmodule, accessfile and accessczech
1172 allow access to abstract types by czech naming convention
1173 Categories: abstract, names
1176 The representation of an abstract type named <t> is accessible in the
1177 definition of a function or constant named <t>_<name>
1180 allow access to abstract types by czechoslovak naming convention
1181 Categories: abstract, names
1184 The representation of an abstract type named <t> is accessible in the
1185 definition of a function or constant named <t>_<name> or <t><Name>
1188 allow access to abstract types by file name convention
1189 Categories: abstract, names
1192 The representation of an abstract type named <t> is accessible anywhere
1193 in a file named <t>.<x>.
1196 allow access to abstract types in definition module
1197 Categories: abstract, names
1200 The representation of an abstract type defined in <M>.<x> is accessible
1201 anywhere in a file named <M>.<y>.
1204 allow access to abstract types by slovak naming convention
1205 Categories: abstract, names
1208 The representation of an abstract type named <t> is accessible in the
1209 definition of a function or constant named <t><Name>
1212 unique parameter is aliased
1213 Categories: aliasing, memory
1216 A unique or only parameter is aliased by some other parameter or visible
1220 the body of an if, while or for statement is not a block (sets ifblock,
1221 whileblock and forblock)
1222 Category: controlflow
1225 Body is a single statement, not a compound block.
1228 an if, while or for statement has no body (sets ifempty, whileempty and
1230 Category: controlflow
1235 report use and modification errors for globals not annotated with unchecked
1236 Categories: globals, implicit
1241 sets globimponly, retimponly, structimponly, specglobimponly, specretimponly
1242 and specstructimponly
1243 Categories: memory, implicit
1248 sets fcnmacros and constmacros
1252 All macros (not preceded by /*@notfunction@*/) are checked as functions
1253 or constants depending on whether or not they have parameter lists.
1256 loop predicate always exits
1257 Category: controlflow
1262 annotation is used in inconsistent location
1263 Categories: declarations,
1266 A declaration uses an invalid annotation.
1269 check for violations of standard limits (controlnestdepth, stringliterallen,
1270 includenest, numstructfields, numenummembers) based on ANSI89 standard
1271 Categories: limits, ansi
1276 abstract representation is exposed (assignments only)
1277 Categories: exposure, abstract
1280 Storage internal to the representation of an abstract type is assigned to
1281 an external pointer. This means clients may have access to a pointer into
1282 the abstract representation. If the external pointer is a parameter, the
1283 exposed qualifier can be used to allow the assignment, however, this is
1284 considered dangerous programming practice.
1287 warn about bad command line flags
1291 A flag is not recognized or used in an incorrect way
1294 a bitwise logical operator does not have unsigned operands
1295 Categories: operations,
1298 An operand to a bitwise operator is not an unsigned values. This may
1299 have unexpected results depending on the signed representations.
1302 comparison between bools (dangerous because of multiple TRUE values)
1303 Categories: booleans, operations
1306 Two bool values are compared directly using a C primitive. This may
1307 produce unexpected results since all non-zero values are considered TRUE,
1308 so different TRUE values may not be equal. The file bool.h (included in
1309 splint/lib) provides bool_equal for safe bool comparisons.
1312 set name of boolean false (default FALSE)
1316 String argument. Default: FALSE
1319 bool and int are equivalent
1320 Categories: typeequivalence, booleans
1323 To make bool and int types equivalent, use +boolint.
1326 primitive operation (!, && or ||) does not has a boolean argument
1327 Categories: booleans, operations
1330 The operand of a boolean operator is not a boolean. Use +ptrnegate to
1331 allow ! to be used on pointers.
1334 set name of boolean true (default TRUE)
1338 String argument. Default: TRUE
1341 set name of boolean type (default bool)
1345 String argument. Default: lltX_bool
1348 memory bounds checking (sets boundsread and boundswrite)
1349 Categories: memorybounds, memory
1352 Memory read or write may be out of bounds of allocated storage.
1355 possible out of bounds read
1356 Categories: memorybounds, memory
1359 A memory read references memory beyond the allocated storage.
1362 possible buffer overflow from an out of bounds write
1363 Categories: memorybounds, memory
1366 A memory write may write to an address beyond the allocated buffer.
1369 storage has inconsistent states of alternate paths through a branch
1373 The state of a variable is different depending on which branch is taken.
1374 This means no annotation can sensibly be applied to the storage.
1377 possible buffer overflow vulnerability
1378 Categories: warnuse, security
1381 Use of function that may lead to buffer overflow.
1384 likely buffer overflow vulnerability
1385 Categories: warnuse, security
1388 Use of function that may lead to buffer overflow.
1391 set maximum number of bugs detected before giving up
1395 Numeric Argument. Default: 3
1398 non-empty case in a switch without preceding break
1399 Category: controlflow
1402 Execution falls through from the previous case.
1405 abstract representation is exposed through a cast
1406 Categories: exposure, abstract
1409 Storage internal to the representation of an abstract type is exposed
1410 through a type cast. This means clients may have access to a pointer into
1411 the abstract representation.
1414 a pointer to a function is cast to a pointer to void (or vice versa)
1415 Categories: typeequivalence, pointers
1418 A pointer to a function is cast to (or used as) a pointer to void (or
1422 char can be used to index arrays
1423 Categories: typeequivalence, arrays
1426 To allow char types to index arrays, use +charindex.
1429 char and int are equivalent
1430 Category: typeequivalence
1433 To make char and int types equivalent, use +charint.
1436 character constants (e.g., 'a') can be used as ints
1437 Categories: typeequivalence, numbers
1440 A character constant is used as an int. Use +charintliteral to allow
1441 character constants to be used as ints. (This is safe since the actual
1442 type of a char constant is int.)
1445 allow char and unsigned char types to match
1446 Category: typeequivalence
1449 To allow char and unsigned char types to match use +charunsignedchar.
1452 function returns with a checked global aliasing external state
1453 Categories: aliasing, globals
1456 A global variable aliases externally-visible state when the function
1460 function returns with a checkmod global aliasing external state
1461 Categories: aliasing, globals
1464 A global variable aliases externally-visible state when the function
1468 unable to verify predicate in ensures clause
1469 Categories: memorybounds, memory
1472 The function implementation may not satisfy a post condition given in an
1475 checkstrictglobalias
1476 function returns with a checkstrict global aliasing external state
1477 Categories: aliasing, globals
1480 A global variable aliases externally-visible state when the function
1484 report use and modification errors for checkedstrict globals
1485 Categories: globals, unconstrained
1490 sets globimponly, retimponly and structimponly
1491 Categories: memory, implicit
1496 set marker character for syntactic comments (default is '@')
1497 Categories: initializations, comments
1500 Character Argument. Default: @
1501 Set the marker character for syntactic comments. Comments beginning with
1502 /*<char> are interpreted by Splint, where <char> is the comment marker
1506 inconsistent syntactic comment
1507 Categories: declarations,
1510 A syntactic comment is used inconsistently.
1513 parameter, return value or global completely defined
1514 Categories: memory, definition
1517 Storage derivable from a parameter, return value or global is not
1518 defined. Use /*@out@*/ to denote passed or returned storage which need
1522 all only references derivable from void pointer out only parameter are
1524 Categories: memory, leaks
1527 A storage leak due to incomplete deallocation of a structure or deep
1528 pointer is suspected. Unshared storage that is reachable from a reference
1529 that is being deallocated has not yet been deallocated. Splint assumes
1530 when an object is passed as an out only void pointer that the outer
1531 object will be deallocated, but the inner objects will not.
1534 actual parameter matches alias kind of formal parameter completely
1535 Categories: memory, definition
1538 Storage derivable from a parameter does not match the alias kind expected
1539 for the formal parameter.
1542 check all macros without parameter lists as constants
1546 Every non-parameterized macro (not preceded by /*@notfunction@*/) is
1547 checked as a constant.
1550 set namespace prefix for constants
1551 Categories: names, prefixes
1554 String argument. No default.
1555 A constant does not start with the constantprefix
1558 the constprefix may not be used for non-constant identifiers
1559 Categories: names, prefixes
1562 An identifier that is not a constant starts with the constantprefix.
1565 constant declared but not used
1569 A constant is declared but not used. Use unused in the constant
1570 declaration to suppress message.
1573 line continuation marker (\) in comment before */ on same line
1574 Categories: comments,
1577 A line continuation marker (\) appears inside a comment on the same line
1578 as the comment close. Preprocessors should handle this correctly, but it
1579 causes problems for some preprocessors.
1582 set maximum nesting depth of compound statements, iteration control
1583 structures, and selection control structures (ANSI89 minimum is 15;
1585 Categories: limits, ansi
1588 Numeric Argument. Default: 63
1589 Maximum number of control levels exceeded.
1592 external or internal name is a C++ keyword or reserved word
1593 Categories: names, ansi
1596 External name is a C++ keyword or reserved word. This could lead to
1597 problems if the code is compiled with a C++ compiler.
1600 czech naming convention (sets accessczech, czechfunctions, czechvars,
1601 czechconstants, czechenums, and czechmacros)
1602 Categories: names, abstract
1605 Name is not consistent with Czech naming convention.
1608 czech naming convention violated in a constant declaration
1609 Categories: names, abstract
1612 Constant name is not consistent with Czech naming convention.
1615 czech naming convention violated in a function or iterator declaration
1616 Categories: names, abstract
1619 Function or iterator name is not consistent with Czech naming convention.
1622 czech naming convention violated in an expanded macro name
1623 Categories: names, abstract
1626 Expanded macro name is not consistent with Czech naming convention.
1629 czech or slovak naming convention violated
1630 Categories: names, abstract
1633 Name is not consistent with either Czech or Slovak naming convention.
1636 czechoslovak naming convention violated in a constant declaration
1637 Categories: names, abstract
1640 Constant name is not consistent with Czechoslovak naming convention.
1643 czechoslovak naming convention violated in a function or iterator
1645 Categories: names, abstract
1648 Function name is not consistent with Czechoslovak naming convention.
1651 czechoslovak naming convention violated in an expanded macro name
1652 Categories: names, abstract
1655 Expanded macro name is not consistent with Czechoslovak naming
1659 czechoslovak naming convention violated in a user-defined type definition
1660 Categories: names, abstract
1663 Type name is not consistent with Czechoslovak naming convention.
1664 Czechoslovak type names may not include uppercase letters or the
1665 underscore character.
1668 czechoslovak naming convention violated in a variable declaration
1669 Categories: names, abstract
1672 Variable name is not consistent with Czechoslovak naming convention.
1675 czech naming convention violated in a user-defined type definition
1676 Categories: names, abstract
1679 Type name is not consistent with Czech naming convention. Czech type
1680 names must not use the underscore character.
1683 czech naming convention violated in a variable declaration
1684 Categories: names, abstract
1687 Variable name is not consistent with Czech naming convention.
1690 debug function constraints
1691 Categories: debug, memorybounds
1694 Perform buffer overflow checking even if the errors would be surpressed.
1697 function or variable declared but never defined
1701 A function or variable is declared, but not defined in any source code
1705 break inside nested while or for or switch
1706 Category: controlflow
1709 A break statement appears inside the body of a nested while, for or
1710 switch statement. Sets looploopbreak, loopswitchbreak, switchloopbreak,
1711 switchswitchbreak, and looploopcontinue.
1714 array elements are dependent storage
1715 Categories: memory, arrays
1718 When an element is fetched from an array, Splint analysis is not able to
1719 determine if the same element is reused. If +deparrays, Splint will mark
1720 local storage assigned from array fetches as dependent.
1723 dependent transfer errors
1727 Dependent storage is transferred to a non-dependent reference.
1729 distinctexternalnames
1730 external name is not distinguishable from another external name using the
1731 number of significant characters
1732 Categories: names, ansi
1735 An external name is not distinguishable from another external name using
1736 the number of significant characters. According to ANSI Standard (3.1),
1737 an implementation may only consider the first 6 characters significant,
1738 and ignore alphabetical case distinctions (ISO C99 requires 31). The
1739 +externalnamelen <n> flag may be used to change the number of significant
1740 characters, and -externalnamecaseinsensitive to make alphabetical case
1741 significant in external names.
1743 distinctinternalnames
1744 internal name is not distinguishable from another internal name using the
1745 number of significant characters
1746 Categories: names, ansi
1749 An internal name is not distinguishable from another internal name using
1750 the number of significant characters. According to ANSI89 Standard (3.1),
1751 an implementation may only consider the first 31 characters significant
1752 (ISO C99 specified 63). The +internalnamelen <n> flag changes the number
1753 of significant characters, -internalnamecaseinsensitive to makes
1754 alphabetical case significant, and +internalnamelookalike to make
1755 similar-looking characters non-distinct.
1758 save state for merging (default suffix .lcd)
1759 Categories: libraries, files
1762 Filename argument. No default.
1765 duplicate cases in switch
1766 Category: controlflow
1769 Duplicate cases in switch.
1772 report duplicate type qualifiers (e.g., unsigned unsigned)
1773 Categories: typeequivalence,
1776 Duplicate type qualifiers not supported by ISO standard.
1779 if ... else if chains must have final else
1780 Category: controlflow
1783 There is no final else following an else if construct.
1785 emptyreturn: <invalid flag>
1788 enum can be used to index arrays
1789 Categories: typeequivalence, arrays
1792 To allow enum types to index arrays, use +enumindex.
1795 enum and int are equivalent
1796 Category: typeequivalence
1799 To make enum and int types equivalent, use +enumint.
1802 enum members must be int values
1805 Type of initial values for enum members must be int.
1808 member of an enum type not used
1812 A member of an enum type is never used.
1815 set namespace prefix for enum members
1816 Categories: names, prefixes
1819 String argument. No default.
1820 An enum member does not start with the enumprefix.
1823 the enumprefix may not be used for non-enum member identifiers
1824 Categories: names, prefixes
1827 An identifier that is not an enum member starts with the enumprefix.
1830 code has unspecified or implementation-dependent behavior because of order
1832 Categories: undefined, ansi
1835 Code has unspecified behavior. Order of evaluation of function parameters
1836 or subexpressions is not defined, so if a value is used and modified in
1837 different places not separated by a sequence point constraining
1838 evaluation order, then the result of the expression is unspecified.
1841 code involving call to unspecified function has undefined or
1842 implementation-dependent behavior
1843 Categories: undefined, ansi
1846 Code involving a call to function with no modifies or globals clause may
1847 have undefined or implementation-dependent behavior (Splint assumes the
1848 unconstrained call may modify any reachable state or use any global). Add
1849 a specification for the function.
1852 argument to exit has implementation defined behavior
1853 Categories: systemfunctions, undefined
1856 The argument to exit should be 0, EXIT_SUCCESS or EXIT_FAILURE
1859 expect <int> code errors
1860 Categories: <No Category>, errors
1863 Numeric Argument. Default: 0
1866 variable, function or type exported but not specified
1867 Categories: export, specifications
1870 A variable, function or type is exported, but not specified.
1873 constant exported but not specified
1874 Categories: export, specifications
1877 A constant is exported, but not specified.
1880 function exported but not specified
1881 Categories: export, specifications
1884 A function is exported, but not specified.
1887 a declaration is exported but does not appear in a header file
1888 Categories: alluse, export
1891 A declaration is exported, but does not appear in a header file.
1894 a variable declaration is exported but does not appear in a header file
1895 Categories: alluse, export
1898 A variable declaration is exported, but does not appear in a header file.
1899 (Used with exportheader.)
1902 constant exported but not specified
1903 Categories: export, specifications
1906 A constant is exported, but not specified.
1909 a declaration is exported but not used outside this module
1910 Categories: alluse, export
1913 A declaration is exported, but not used outside this module. Declaration
1914 can use static qualifier.
1917 expanded macro exported but not specified
1918 Categories: export, specifications
1921 A macro is exported, but not specified.
1924 type definition exported but not specified
1925 Categories: export, specifications
1928 A type is exported, but not specified.
1931 variable exported but not specified
1932 Categories: export, specifications
1935 A variable is exported, but not specified.
1938 exposure transfer errors
1942 Exposed storage is transferred to a non-exposed, non-observer reference.
1944 externalnamecaseinsensitive
1945 alphabetic comparisons for external names are case-insensitive
1946 Categories: names, ansi
1949 Make alphabetic case insignificant in external names. By ANSI89 standard,
1950 case need not be significant in an external name. If +distinctexternalname
1951 s is not set, sets +distinctexternalnames with unlimited external name
1955 set the number of significant characters in an external name
1956 Categories: names, ansi
1959 Numeric Argument. Default: 31
1960 Sets the number of significant characters in an external name (default is
1961 6 for old ANSI89 limit, C99 requires 31). Sets +distinctexternalnames.
1964 set namespace prefix for external identifiers
1965 Categories: names, prefixes
1968 String argument. No default.
1969 An external identifier does not start with the externalprefix
1971 externalprefixexclude
1972 the externalprefix may not be used for non-external identifiers
1973 Categories: names, prefixes
1976 An identifier that is not external starts with the externalprefix.
1979 read an options file (default ~/.splintrc not loaded)
1980 Categories: initializations, files
1983 Filename argument. No default.
1984 Read an options file (instead of loading default ~/.splintc)
1987 dereferencce of a function type
1990 A function type is dereferenced. The ANSI standard allows this because
1991 of implicit conversion of function designators, however the dereference
1995 check all macros with parameter lists as functions
1999 Every parameterized macro (not preceded by /*@notfunction@*/) is checked
2003 display function post conditions
2004 Categories: memorybounds, display
2007 Display function post conditions.
2010 function declared but not used
2014 A function is declared but not used. Use /*@unused@*/ in front of
2015 function header to suppress message.
2018 field of structure type not used
2022 A field is present in a structure type but never used. Use /*@unused@*/
2023 in front of field declaration to suppress message.
2026 warn when command line file does not have a recognized extension
2032 set namespace prefix for file static declarations
2033 Categories: names, prefixes
2036 String argument. No default.
2037 A file-static identifier does not start with the filestaticprefix.
2039 filestaticprefixexclude
2040 the filestaticprefix may not be used for identifiers that are not file
2042 Categories: names, prefixes
2045 An identifier that is not file static starts with the filestaticprefix.
2048 first statement in switch is not a case
2049 Category: controlflow
2052 The first statement after a switch is not a case.
2055 formal parameter of type array is declared with size
2056 Categories: declarations,
2059 A formal parameter is declared as an array with size. The size of the
2060 array is ignored in this context, since the array formal parameter is
2061 treated as a pointer.
2064 float and double are equivalent
2065 Category: typeequivalence
2068 To make float and double types equivalent, use +floatdouble.
2071 the body of a for statement is not a block
2072 Category: controlflow
2075 Loop body is a single statement, not a compound block.
2078 provide a hint for every warnings
2079 Categories: hints, format
2082 Provide a hint for every warning
2085 a for statement has no body
2086 Category: controlflow
2089 For statement has no body.
2092 assume all for loops execute at least once
2093 Categories: controlflow, memory
2098 formal parameter is an array
2099 Categories: declarations,
2102 A formal parameter is declared as an array. This can be confusing, since
2103 a formal array parameter is treated as a pointer.
2106 invalid format code in format string for printf or scanf-like function
2109 Format code in a format string is not valid.
2112 format parameter is not a string constant (hence variable arguments cannot
2116 Format parameter is not known at compile-time. This can lead to security
2117 vulnerabilities because the arguments cannot be type checked.
2120 type-mismatch in parameter corresponding to format code in a printf or
2124 Type of parameter is not consistent with corresponding code in format
2128 forward declarations of pointers to abstract representation match abstract
2130 Categories: typeequivalence, abstract
2135 fresh storage transferred to non-only reference (memory leak)
2139 Fresh storage (newly allocated in this function) is transferred in a way
2140 that the obligation to release storage is not propagated. Use the
2141 /*@only@*/ annotation to indicate the a return value is the only
2142 reference to the returned storage.
2145 initializer sets all fields
2146 Category: definition
2149 Initializer does not set every field in the structure.
2152 function returns with global aliasing external state (sets
2153 checkstrictglobalias, checkedglobalias, checkmodglobalias and
2155 Categories: aliasing, globals
2158 A global variable aliases externally-visible state when the function
2162 set namespace prefix for global variables
2163 Categories: names, prefixes
2166 String argument. No default.
2167 A global variable does not start with the globalprefix
2170 the globalprefix may not be used for non-global identifiers
2171 Categories: names, prefixes
2174 An identifier that is not a global variable starts with the globalprefix.
2177 assume unannotated global storage is only
2178 Categories: memory, implicit
2183 use of checked global in a function with no globals list or specification
2184 Categories: globals, unconstrained
2187 A specified global variable is used in the function, but not listed in
2188 its globals list. Without +globnoglobs, only globals declared with
2189 /*@checkedstrict@*/ will produce use errors in functions without globals
2190 lists. The /*@globals ... @*/ control comment can be used to give a
2191 globals list for an unspecified function.
2194 undocumented use of a checked global variable
2195 Categories: globals, specifications
2198 A checked global variable is used in the function, but not listed in its
2199 globals clause. By default, only globals specified in .lcl files are
2200 checked. To check all globals, use +allglobals. To check globals
2201 selectively use /*@checked@*/ in the global declaration.
2204 functions declared with a globals list but no modifies clause are assumed to
2206 Categories: modification, globals
2209 An implicit modifies nothing clause is assumed for a function declared
2210 with a globals list but not modifies clause.
2213 returns with global in inconsistent state (null or undefined)
2217 A global variable does not satisfy its annotations when control is
2221 global listed for a function not used
2222 Categories: globals, specifications
2225 A global variable listed in the function's globals list is not used in
2226 the body of the function.
2229 support some gnu (gcc) language extensions
2233 ANSI C does not allow some language features supported by gcc and other
2234 compilers. Use +gnuextensions to allow some of these extensions.
2243 iter declaration has no yield parameters
2247 An iterator has been declared with no parameters annotated with yield.
2248 This may be what you want, if the iterator is meant to do something a
2249 fixed number of times, but returns no information to the calling context.
2250 Probably, a parameter is missing the yield annotation to indicate that it
2251 is assigned a value in the calling context.
2254 -help <flags> will describe flags
2261 provide a hint the first time a particular warning appears
2262 Categories: hints, format
2265 Provide a hint the first time a particular warning appears
2268 set LCL initilization file
2269 Categories: initializations, files
2272 Filename argument. No default.
2275 the body of an if statement is not a block
2276 Category: controlflow
2279 If body is a single statement, not a compound block.
2282 an if statement has no body
2283 Category: controlflow
2286 If statement has no body.
2289 ignore type qualifiers (long, short, unsigned)
2290 Categories: typeequivalence, numbers
2293 To ignore type qualifiers in type comparisons use +ignorequals.
2296 ignore signs in type comparisons (unsigned matches signed)
2297 Categories: typeequivalence, numbers
2300 To ignore signs in type comparisons use +ignoresigns
2303 an immediate address (result of &) is transferred inconsistently
2307 An immediate address (result of & operator) is transferred
2311 assume user type definitions are abstract (unless /*@concrete@*/ is used)
2312 Categories: abstract, implicit
2317 assume checked qualifier for unqualified global declarations
2318 Categories: globals, unconstrained
2323 assume checked qualifier for unqualified global declarations in .lcl files
2324 Categories: globals, unconstrained
2329 assume checked qualifier for unqualified file static declarations
2330 Categories: globals, unconstrained
2334 impcheckedstrictglobs
2335 assume checkedstrict qualifier for unqualified global declarations
2336 Categories: globals, unconstrained
2340 impcheckedstrictspecglobs
2341 assume checkmod qualifier for unqualified global declarations in .lcl files
2342 Categories: globals, unconstrained
2346 impcheckedstrictstatics
2347 assume checkedstrict qualifier for unqualified file static declarations
2348 Categories: globals, unconstrained
2353 assume checkmod qualifier for unqualified global declarations
2354 Categories: globals, unconstrained
2358 impcheckmodinternals
2359 assume checkmod qualifier for unqualified local static declarations (for
2360 internal state modifications)
2361 Categories: globals, unconstrained
2365 impcheckmodspecglobs
2366 assume checkmod qualifier for unqualified global declarations in .lcl files
2367 Categories: globals, unconstrained
2372 assume checkmod qualifier for unqualified file static declarations
2373 Categories: globals, unconstrained
2378 make all alternate types implicit (useful for making system libraries
2383 implementationoptional
2384 declarator is implementation optional (ISO99 does not require an
2385 implementation to provide it)
2386 Categories: warnuse, security
2389 Use of a declarator that is implementation optional, not required by
2393 generate implicit constraints for functions
2394 Categories: memorybounds, memory
2399 pointer parameters to unspecified functions may be implicit out parameters
2400 Categories: definition, implicit
2405 variable declaration has unknown (implicitly int) type
2406 Categories: declarations,
2409 A variable declaration has no explicit type. The type is implicitly int.
2412 set maximum number of nested #include files (ANSI89 minimum is 8;
2414 Categories: limits, ansi
2417 Numeric Argument. Default: 63
2418 Maximum number of nested #include files exceeded.
2421 formal parameter has an incomplete type
2422 Categories: declarations,
2425 A formal parameter is declared with an incomplete type.
2428 function, variable or constant redefined with inconsistent type
2429 Categories: declarations,
2432 A function, variable or constant is redefined with a different type.
2435 function, variable or constant defined in a library is redefined with
2437 Categories: declarations, libraries
2440 A function, variable or constant previously defined in a library is
2441 redefined with a different type.
2444 set number of spaces to indent sub-messages
2445 Categories: format, display
2448 Numeric Argument. Default: 3
2451 likely infinite loop is detected
2452 Category: controlflow
2455 This appears to be an infinite loop. Nothing in the body of the loop or
2456 the loop test modifies the value of the loop test. Perhaps the
2457 specification of a function called in the loop body is missing a
2461 likely infinite loop is detected (may result from unconstrained function)
2462 Category: controlflow
2465 This appears to be an infinite loop. Nothing in the body of the loop or
2466 the loop test modifies the value of the loop test. There may be a
2467 modification through a call to an unconstrained function, or an
2468 unconstrained function in the loop test may use a global variable
2469 modified by the loop body.
2472 initializer defines all array elements
2473 Category: definition
2476 Initializer does not define all elements of a declared array.
2479 initializer defines extra array elements
2480 Category: definition
2483 Initializer block contains more elements than the size of a declared
2487 use of internalState
2491 A called function uses internal state, but the globals list for the
2492 function being checked does not include internalState
2494 internalglobsnoglobs
2495 use of internalState (in function with no globals list)
2499 A called function uses internal state, but the function being checked has
2502 internalnamecaseinsensitive
2503 set whether case is significant an internal names (-internalnamecaseinsensiti
2504 ve means case is significant)
2505 Categories: names, ansi
2508 Set whether case is significant an internal names (-internalnamecaseinsens
2509 itive means case is significant). By ANSI89 default, case is not
2510 significant. If +distinctinternalnames is not set, sets
2511 +distinctinternalnames with unlimited internal name length.
2514 set the number of significant characters in an internal name
2515 Categories: names, ansi
2518 Numeric Argument. Default: 63
2519 Sets the number of significant characters in an internal name (ANSI89
2520 default is 31.) Sets +distinctinternalnames.
2522 internalnamelookalike
2523 lookalike characters match in internal names
2524 Categories: names, ansi
2527 Set whether similar looking characters (e.g., "1" and "l") match in
2531 check for violations of standard limits (controlnestdepth, stringliterallen,
2532 includenest, numstructfields, numenummembers) based on ISO99 standard
2533 Categories: limits, ansi
2538 use normal standard library
2539 Categories: libraries, initializations
2542 Library based on the ISO standard library specification is used.
2545 external name conflicts with name reserved for system or standard library
2546 Categories: names, ansi
2549 External name is reserved for system use by ISO C99 standard.
2552 internal name conflicts with name reserved for system or standard library
2553 Categories: names, ansi
2556 Internal name is reserved for system in ISO C99 standard (this should not
2557 be necessary unless you are worried about C library implementations that
2558 violate the standard and use macros).
2561 iter is not balanced with end_<iter>
2567 assume all iterator loops execute at least once
2568 Categories: controlflow, memory
2573 set namespace prefix for iterators
2574 Categories: names, prefixes
2577 String argument. No default.
2578 An iter does not start with the iterator prefix
2581 the iterprefix may not be used for non-iter identifiers
2582 Categories: names, prefixes
2585 An identifier that is not a iter starts with the iterprefix.
2588 iter yield parameter is inappropriate
2594 risky security vulnerabilities (from its4 database)
2595 Categories: its4, security
2598 Security vulnerability classified as risky in its4 database.
2601 moderately risky security vulnerabilities (from its4 database)
2602 Categories: its4, security
2605 Security vulnerability classified as moderate risk in its4 database.
2608 most risky security vulnerabilities (from its4 database)
2609 Categories: its4, security
2612 Security vulnerability classified as most risky in its4 database.
2615 risky security vulnerabilities (from its4 database)
2616 Categories: its4, security
2619 Security vulnerability classified as risky in its4 database.
2622 very risky security vulnerabilities (from its4 database)
2623 Categories: its4, security
2626 Security vulnerability classified as very risky in its4 database.
2629 do not delete temporary files
2635 keep storage transferred inconsistently
2639 Keep storage is transferred inconsistently --- either in a way that may
2640 add a new alias to it, or release it.
2643 kept storage transferred to non-temporary reference
2647 storage is transferred to a non-temporary reference after being passed as
2648 keep parameter. The storage may be released or new aliases created.
2651 set path for searching for library files (overrides LARCH_PATH environment
2653 Categories: directories, files
2656 Path argument. Default: .:/usr/local/share/splint/lib:/af9/drl7x/reTmp/LCLin
2660 expect <int> spec errors
2661 Categories: <No Category>, errors
2664 Numeric Argument. Default: 0
2667 set directory to search for LCL import files (overrides LCLIMPORTDIR)
2668 Categories: directories, files
2671 Directory argument. Default: .:/usr/local/share/splint/imports:/af9/drl7x/re
2672 Tmp/LCLintDev/imports
2676 Categories: headers, specifications
2681 legacy declaration in Unix Standard
2685 Use of a declarator that is marked as a legacy entry in the Unix
2690 Categories: headers, specifications
2695 check all macros with declarations in library as functions
2699 Every macro declared in the load library is checked.
2702 type name is probably a boolean type but does not match default boolean type
2703 name, "bool", and alternate name is not set
2704 Categories: booleans, help
2707 Use the -booltype, -boolfalse and -booltrue flags to change the name of
2708 the default boolean type.
2711 limit <int> consecutive repeated errors
2712 Categories: suppress, errors
2715 Numeric Argument. Default: -1
2718 set length of messages (number of chars)
2719 Categories: format, display
2722 Numeric Argument. Default: 80
2725 interpret traditional lint comments (/*FALLTHROUGH*/, /*NOTREACHED*/)
2726 Categories: syncomments, suppress
2731 load state from dump file (default suffix .lcd)
2732 Categories: libraries, files
2735 Filename argument. No default.
2738 set namespace prefix for local variables
2739 Categories: names, prefixes
2742 String argument. No default.
2743 A local variable does not start with the localprefix
2746 the localprefix may not be used for non-local identifiers
2747 Categories: names, prefixes
2750 An identifier that is not a local variable starts with the localprefix.
2753 allow long type to match an arbitrary integral type (e.g., dev_t)
2754 Categories: typeequivalence, numbers
2757 To allow arbitrary integral types to match long unsigned, use
2761 allow long type to match an arbitrary signed integral type (e.g., ssize_t)
2762 Categories: typeequivalence, numbers
2765 To allow arbitrary signed integral types to match long unsigned, use
2766 +longsignedintegral.
2768 longunsignedintegral
2769 allow long unsigned type to match an arbitrary integral type (e.g., dev_t)
2770 Categories: typeequivalence, numbers
2773 To allow arbitrary integral types to match long unsigned, use
2774 +longunsignedintegral.
2776 longunsignedunsignedintegral
2777 allow long unsigned type to match an arbitrary unsigned integral type (e.g.,
2779 Categories: typeequivalence, numbers
2782 To allow arbitrary unsigned integral types to match long unsigned, use
2783 +longunsignedunsignedintegral.
2786 assume all loops execute at least once (sets forloopexec, whileloopexec and
2788 Categories: controlflow, memory
2793 break inside nested while or for
2794 Category: controlflow
2797 A break statement appears inside the body of a nested while or for
2798 statement. This is perfectly reasonable code, but check that the break is
2799 intended to break only the inner loop. The break statement may be
2800 preceded by /*@innerbreak@*/ to suppress the message for this break only.
2803 continue inside nested loop
2804 Category: controlflow
2807 A continue statement appears inside a loop within a loop. This is
2808 perfectly reasonable code, but check that the continue is intended to
2809 continue only the inner loop. The continue statement may be preceded by
2810 /*@innercontinue@*/ to suppress the message for this continue only.
2813 break in switch inside loop
2814 Category: controlflow
2817 A break statement appears inside a switch statement within a while or for
2818 loop. This is perfectly reasonable code, but check that the break is
2819 intended to break only the inner loop. The break statement may be
2820 preceded by /*@switchbreak@*/ to suppress the message for this break
2824 assignment to a macro parameter
2825 Categories: macros, parameters
2828 A macro parameter is used as the left side of an assignment expression.
2829 This exhibits behavior that could not be implemented by a function.
2832 non-parameterized macro without prototype or specification
2833 Categories: macros, prototypes
2836 Macro constant has no declaration. Use /*@constant ...@*/ to declare the
2840 macro without prototype or specification (sets macrofcndecl and
2842 Categories: macros, prototypes
2845 Argument checking cannot be done well for macros without prototypes or
2846 specifications, since the types of the arguments are unknown.
2849 macro definition for is empty
2853 A macro definition has no body.
2856 parameterized macro without prototype or specification
2857 Categories: macros, prototypes
2860 Function macro has no declaration.
2863 macro definition does not match iter or constant declaration
2867 A iter or constant macro is defined using a different name from the one
2868 used in the previous syntactic comment
2871 macro parameter not used exactly once
2872 Categories: macros, parameters
2875 A macro parameter is not used exactly once in all possible invocations of
2876 the macro. To behave like a function, each macro parameter must be used
2877 exactly once on all invocations of the macro so that parameters with
2878 side-effects are evaluated exactly once. Use /*@sef@*/ to denote
2879 parameters that must be side-effect free.
2882 macro parameter used without parentheses (in potentially dangerous context)
2886 A macro parameter is used without parentheses. This could be dangerous if
2887 the macro is invoked with a complex expression and precedence rules will
2888 change the evaluation inside the macro.
2895 A macro is defined in more than one place.
2897 macroreturn: <invalid flag>
2900 macro definition is syntactically not equivalent to function
2904 A macro is defined in a way that may cause syntactic problems. If the
2905 macro returns a value, use commas to separate expressions;
2906 otherwise, use do { <macro body> } while (FALSE) construct.
2909 unrecognized identifier in macro
2910 Categories: macros, unrecognized
2913 An unrecognized identifier appears in a macro. If the identifier is
2914 defined before the macro is used, then this is okay.
2917 set namespace prefix for variables declared in a macro body
2918 Categories: names, prefixes
2921 String argument. Default: m_
2922 A variable declared in a macro body does not start with the
2925 macrovarprefixexclude
2926 the macrovarprefix may not be used for non-macro variables
2927 Categories: names, prefixes
2930 A variable declared outside a macro body starts with the macrovarprefix.
2933 type of main does not match expected type
2934 Categories: systemfunctions,
2937 The function main does not match the expected type.
2940 allow any intergral type to match an arbitrary integral type (e.g., dev_t)
2941 Categories: typeequivalence, numbers
2944 To allow arbitrary integral types to match any integral type, use
2948 struct or enum type redefined with inconsistent fields or members
2949 Categories: declarations,
2952 A struct, union or enum type is redefined with inconsistent fields or
2956 unique parameter may be aliased
2957 Categories: aliasing, memory
2960 A unique or only parameter may be aliased by some other parameter or
2964 sets all dynamic memory checking flags (memimplicit, mustfree, mustdefine,
2965 mustnotalias, null, memtrans)
2971 memory errors for unqualified storage
2972 Categories: memory, implicit
2977 memory transfer errors (sets all *trans flags)
2981 Memory is transferred in a way that violates annotations.
2984 declaration of unsharable storage uses sharing annotation
2985 Categories: declarations,
2988 A declaration of an unsharable object uses a sharing annotation.
2991 switch on enum type missing case for some value
2992 Category: controlflow
2995 Not all values in an enumeration are present as cases in the switch.
2998 report undocumented file system modifications (applies to unspecified
2999 functions if modnomods is set)
3000 Categories: modification, unconstrained
3005 undocumented modification of a checked global variable
3006 Categories: globals, modification
3009 A checked global variable is modified by the function, but not listed in
3010 its modifies clause.
3013 undocumented modification of a checked global variable in a function
3014 declared with no modifies clause
3015 Categories: globals, modification
3018 A checked global variable is modified by the function, but not listed in
3019 its modifies clause.
3022 undocumented modification of an unchecked checked global variable
3023 Categories: globals, modification
3026 An unchecked global variable is modified by the function, but not listed
3027 in its modifies clause.
3030 possible modification of internal storage through function call
3031 Categories: modification, memory
3034 A function that modifies internalState is called from a function that
3035 does not list internalState in its modifies clause
3038 modification in a function with no modifies clause
3039 Categories: modification, unconstrained
3042 An externally-visible object is modified by a function with no
3043 /*@modifies@*/ comment. The /*@modifies ... @*/ control comment can be
3044 used to give a modifies list for an unspecified function.
3047 possible modification of observer storage
3048 Categories: modification, memory
3051 Storage declared with observer is possibly modified. Observer storage may
3055 possible modification of observer storage through unconstrained call
3056 Categories: modification, memory
3059 Storage declared with observer may be modified through a call to an
3060 unconstrained function.
3063 unspecified modification of caller-visible state
3064 Categories: modification, specifications
3067 An externally-visible object is modified by a function, but not listed in
3068 its modifies clause.
3071 functions declared with a modifies clause but no globals list are assumed to
3073 Categories: modification, globals
3076 An implicit empty globals list is assumed for a function declared with a
3077 modifies clause but no globals list.
3079 modstrictglobsnomods
3080 undocumented modification of a strict checked global variable in a function
3081 declared with no modifies clause
3082 Categories: globals, modification
3085 A checked global variable is modified by the function, but not listed in
3086 its modifies clause.
3089 possible modification through a call to an unconstrained function
3090 Categories: modification, unconstrained
3093 An unconstrained function is called in a function body where
3094 modifications are checked. Since the unconstrained function may modify
3095 anything, there may be undetected modifications in the checked function.
3098 possible modification through a call to an unconstrained function in a
3099 function with no modifies clause
3100 Categories: modification, unconstrained
3103 An unconstrained function is called in a function body where
3104 modifications are checked. Since the unconstrained function may modify
3105 anything, there may be undetected modifications in the checked function.
3108 modification in unspecified functions (sets modnomods, modglobunspec and
3109 modstrictglobsunspec)
3110 Categories: modification, unconstrained
3115 load meta state declaration and corresponding xh file
3116 Categories: extensible, files
3119 Filename argument. No default.
3122 function is not reentrant
3123 Categories: warnuse, security
3126 Non-reentrant function should not be used in multithreaded code.
3129 out storage not defined before return or scope exit
3130 Categories: memory, definition
3133 An out parameter or global is not defined before control is transferred.
3136 fresh or only storage not released before return or scope exit (sets
3137 mustfreefresh and mustfreeonly)
3138 Categories: memory, leaks
3141 A memory leak has been detected.
3144 freshly allocated storage not released before return or scope exit
3145 Categories: memory, leaks
3148 A memory leak has been detected. Storage allocated locally is not
3149 released before the last reference to it is lost.
3152 only storage not released before return or scope exit
3153 Categories: memory, leaks
3156 A memory leak has been detected. Only-qualified storage is not released
3157 before the last reference to it is lost.
3160 specified modification is not detected
3161 Categories: modification, specifications
3164 An object listed in the modifies clause is not modified by the
3165 implementation of the function. The modification may not be detected if
3166 it is done through a call to an unspecified function.
3169 temp storage aliased at return point or scope exit
3170 Categories: aliasing, memory
3173 An alias has been added to a temp-qualifier parameter or global that is
3174 visible externally when the function returns. If the aliasing is needed,
3175 use the /*@shared@*/ annotation to indicate that new aliases to the
3176 parameter may be created.
3179 representation of mutable type has sharing semantics
3183 LCL semantics requires that a mutable type exhibits sharing semantics. In
3184 order for objects to be shared a indirection is necessary in the
3185 representation. A mutable type may be represented by a pointer or an
3186 abstract mutable type. Handles into static data are fine, too, but will
3187 generate this error message unless it is suppressed.
3190 controls name checking without changing other settings
3191 Categories: names, abstract
3196 information in specifications is not also included in syntactic comments
3197 Categories: initializations, specifications
3200 There is information in the specification that is not duplicated in
3201 syntactic comments. Normally, this is not an error, but it may be useful
3202 to detect it to make sure checking incomplete systems without the
3203 specifications will still use this information.
3206 comment begins inside comment
3207 Categories: comments,
3210 A comment open sequence (/*) appears within a comment. This usually
3211 means an earlier comment was not closed.
3214 an extern declaration is inside a function scope
3215 Category: declarations
3218 An extern declaration is used inside a function scope.
3221 optimize header inclusion to not include any header files
3222 Categories: headers, performance
3225 Ignore header includes. Only works if relevant information is loaded from
3229 report new global declarations in source files
3230 Categories: declarations, libraries
3233 There is a new declaration that is not declared in a loaded library or
3234 earlier file. (Use this flag to check for consistency against a
3238 new reference transfer to reference counted reference
3242 A new reference is transferred to a reference counted reference.
3245 the line after a constant or iter declaration must be a macro definition
3249 A constant or iter declaration is not immediately followed by a macro
3253 ignore access comments
3254 Categories: syncomments, abstract
3259 ignore all stylized comments
3260 Categories: syncomments, suppress
3265 statement with no effect
3266 Categories: effect, controlflow
3269 Statement has no visible effect --- no values are modified.
3272 statement with no effect (except possibly through call to unconstrained
3274 Categories: effect, controlflow
3277 Statement has no visible effect --- no values are modified. It may modify
3278 something through a call to an unconstrained function.
3281 do not read options file
3282 Categories: initializations, files
3285 Do not read the default options file (~/.splintrc)
3288 do not load standard library
3289 Categories: libraries, initializations
3294 function declaration has no parameter list
3295 Categories: prototypes, ansi
3298 A function declaration does not have a parameter list.
3301 do not pre-process input files
3307 path with no return detected in non-void function
3308 Category: controlflow
3311 There is a path through a function declared to return a value on which
3312 there is no return statement. This means the execution may fall through
3313 without returning a meaningful result to the caller.
3316 misuses of null pointer
3317 Categories: null, memory
3320 A possibly null pointer is misused (sets nullderef, nullpass, nullref,
3321 nullassign, and nullstate).
3324 inconsistent assignment or initialization involving null pointer
3325 Categories: null, memory
3328 A reference with no null annotation is assigned or initialized to NULL.
3329 Use /*@null@*/ to declare the reference as a possibly null pointer.
3332 possible dereferencce of null pointer
3333 Categories: null, memory
3336 A possibly null pointer is dereferenced. Value is either the result of a
3337 function which may return null (in which case, code should check it is
3338 not null), or a global, parameter or structure field declared with the
3342 possibly null pointer passed as formal with no null annotation
3343 Categories: null, memory
3346 A possibly null pointer is passed as a parameter corresponding to a
3347 formal parameter with no /*@null@*/ annotation. If NULL may be used for
3348 this parameter, add a /*@null@*/ annotation to the function parameter
3352 arithmetic involving possibly null pointer and integer
3353 Categories: operations, pointers
3356 Pointer arithmetic using a possibly null pointer and integer.
3359 possibly null pointer returned as result with no null annotation
3360 Categories: null, memory
3363 Function returns a possibly null pointer, but is not declared using
3364 /*@null@*/ annotation of result. If function may return NULL, add
3365 /*@null@*/ annotation to the return value declaration.
3368 possibly null pointer reachable from a reference with no null annotation
3369 Categories: null, memory
3372 A possibly null pointer is reachable from a parameter or global variable
3373 that is not declared using a /*@null@*/ annotation.
3376 misuse of nullterminated allocation
3377 Categories: memorybounds, memory
3380 A possibly non-nullterminated string/memory is used/referenced as a
3384 misuse of nullterminated allocation
3385 Categories: memorybounds, memory
3388 A possibly non-nullterminated string/memory is used/referenced as a
3392 set maximum number of members of an enum (ANSI89 minimum is 127;
3394 Categories: limits, ansi
3397 Numeric Argument. Default: 1023
3398 Limit on maximum number of members of an enum is exceeded.
3401 int literals can be reals
3402 Categories: typeequivalence, numbers
3405 An int literal is used as any numeric type (including float and long
3406 long). Use +numliteral to allow int literals to be used as any numeric
3410 set maximum number of fields in a struct or union (ANSI89 minimum is 127;
3412 Categories: limits, ansi
3415 Numeric Argument. Default: 1023
3416 Maximum number of fields in a struct or union exceeded.
3419 observer transfer errors
3423 Observer storage is transferred to a non-observer reference.
3426 assume loop that can be determined to always execute always does
3427 Categories: controlflow, memory
3432 old style function definition
3433 Categories: prototypes, ansi
3436 Function definition is in old style syntax. Standard prototype syntax is
3440 only storage transferred to non-only reference (memory leak)
3444 The only reference to this storage is transferred to another reference
3445 (e.g., by returning it) that does not have the only annotation. This may
3446 lead to a memory leak, since the new reference is not necessarily
3450 only storage transferred to an unqualified global or static reference
3455 The only reference to this storage is transferred to another reference
3456 that does not have an aliasing annotation. This may lead to a memory
3457 leak, since the new reference is not necessarily released.
3460 use limited OR expressions to resolve constraints
3461 Categories: memorybounds, memory
3466 library function overloaded
3467 Categories: declarations, libraries
3470 A function, variable or constant defined in the library is redefined with
3474 owned storage transferred to non-owned reference (memory leak)
3478 The owned reference to this storage is transferred to another reference
3479 (e.g., by returning it) that does not have the owned annotation. This may
3480 lead to a memory leak, since the new reference is not necessarily
3484 assume unannotated parameter is temp
3485 Categories: memory, implicit
3490 function parameter not used
3491 Categories: alluse, parameters
3494 A function parameter is not used in the body of the function. If the
3495 argument is needed for type compatibility or future plans, use
3496 /*@unused@*/ in the argument declaration.
3499 show column number where error is found
3500 Categories: format, display
3505 check as partial system (-specundef, -declundef, -exportlocal, don't check
3506 macros in headers without corresponding .c files)
3507 Categories: <No Category>, alluse
3512 passing a value as an un-annotated parameter clears its annotation
3513 Categories: memory, parameters
3518 function may have undefined behavior
3519 Categories: warnuse, security
3522 Use of function that may have implementation-dependent behavior.
3525 use POSIX standard library
3526 Categories: libraries, initializations
3529 POSIX version of the standard library is used.
3532 use strict POSIX standard library
3533 Categories: libraries, initializations
3536 POSIX version of the strict standard library is used.
3539 condition test (if, while or for) is an assignment
3540 Categories: booleans, predicates
3543 The condition test is an assignment expression. Probably, you mean to use
3544 == instead of =. If an assignment is intended, add an extra parentheses
3545 nesting (e.g., if ((a = b)) ...) to suppress this message.
3548 type of condition test (if, while or for) not bool (sets predboolint,
3549 predboolptr and predboolothers)
3550 Categories: booleans, predicates
3553 Test expression type is not boolean.
3556 type of condition test (if, while or for) is an integral type
3557 Categories: predicates, booleans
3560 Test expression type is not boolean or int.
3563 type of condition test (if, while or for) not bool, int or pointer
3564 Categories: booleans, predicates
3567 Test expression type is not boolean.
3570 type of condition test (if, while or for) is a pointer
3571 Categories: booleans, predicates
3574 Test expression type is not boolean.
3578 Categories: , preproc
3583 the name of a parameter in a function prototype and corresponding
3584 declaration must match (after removing the protoparamprefix
3585 Categories: names, prefixes
3588 A parameter in a function definition does not have the same name as the
3589 corresponding in the declaration of the function after removing the
3593 a parameter in a function prototype has a name
3594 Categories: names, prefixes
3597 A parameter in a function prototype has a name. This is dangerous, since
3598 a macro definition could be visible here.
3601 set namespace prefix for parameters in function prototype declarations
3602 Categories: names, prefixes
3605 String argument. No default.
3606 A parameter name in a function prototype declaration does not start with
3607 the declaration parameter prefix
3609 protoparamprefixexclude
3610 the protoparamprefix may not be used for non-declaraction parameter
3612 Categories: names, prefixes
3615 An identifier that is not a parameter name in a function prototype starts
3616 with the protoparamprefix.
3619 arithmetic involving pointer and integer
3620 Categories: operations, pointers
3623 Pointer arithmetic using pointer and integer.
3626 comparison between pointer and number
3627 Categories: operations, pointers
3630 A pointer is compared to a number.
3633 allow ! to be used on pointer operand
3634 Categories: booleans, pointers
3637 The operand of ! operator is a pointer.
3640 suppress herald and error count
3641 Categories: display, errors
3646 string literals are read-only (error if one is modified or released)
3650 String literals are read-only. An error is reported if a string literal
3651 may be modified or released.
3654 report memory transfer errors for initializations to read-only string
3659 A read-only string literal is assigned to a non-observer reference.
3662 dangerous comparison between reals (dangerous because of inexact floating
3663 point representations)
3664 Category: operations
3667 Two real (float, double, or long double) values are compared directly
3668 using a C primitive. This may produce unexpected results since floating
3669 point representations are inexact. Instead, compare the difference to
3670 FLT_EPSILON or DBL_EPSILON.
3673 function or variable redeclared
3674 Category: declarations
3677 A function or variable is declared in more than one place. This is not
3678 necessarily a problem, since the declarations are consistent.
3681 function or variable redefined
3682 Category: declarations
3685 A function or variable is redefined. One of the declarations should use
3688 redundantconstraints
3689 display seemingly redundant constraints
3690 Categories: memorybounds, display
3693 Display seemingly redundant constraints
3696 declaration uses observer qualifier that is always true
3697 Categories: declarations,
3700 A declaration of an immutable object uses a redundant observer qualifier.
3703 reference counted storage is transferred in an inconsistent way
3707 Reference counted storage is transferred in a way that may not be
3708 consistent with the reference count.
3711 report qualifier mismatches only if dangerous
3712 Categories: typeequivalence, numbers
3715 To allow qualifier mismatches that are not dangerous, use +relaxquals.
3718 allow all numeric types to match
3719 Categories: typeequivalence, numbers
3722 To allow all numeric types to match, use +relaxtypes.
3725 do not suppress repeated unrecognized identifier messages (instead of only
3726 reporting the first error)
3727 Categories: unrecognized, display
3730 Identifier used in code has not been declared. (Message repeated for
3731 future uses in this file.)
3734 abstract representation is exposed (sets assignexpose, retexpose, and
3736 Categories: exposure, abstract
3739 The internal representation of an abstract type is visible to the caller.
3740 This means clients may have access to a pointer into the abstract
3744 function returns alias to parameter or global
3748 The returned value shares storage with a parameter or global. If a
3749 parameter is to be returned, use the returned qualifier. If the result is
3750 not modified, use the observer qualifier on the result type. Otherwise,
3751 exposed can be used, but limited checking is done.
3754 abstract representation is exposed (return values only)
3755 Categories: exposure, abstract
3758 The return value shares storage with an instance of an abstract type.
3759 This means clients may have access to a pointer into the abstract
3760 representation. Use the observer qualifier to return exposed storage that
3761 may not be modified by the client. Use the exposed qualifier to return
3762 modifiable (but not deallocatable) exposed storage (dangerous).
3765 assume unannotated returned storage is only
3766 Categories: memory, implicit
3771 return value ignored (sets retvalint, retvalbool and retvalother)
3772 Category: returnvals
3775 Result returned by function call is not used. If this is intended, cast
3776 result to (void) to eliminate message.
3779 return value of manifest type bool ignored
3780 Categories: returnvals, booleans
3783 Result returned by function call is not used. If this is intended, can
3784 cast result to (void) to eliminate message.
3787 return value of type int ignored
3788 Category: returnvals
3791 Result returned by function call is not used. If this is intended, can
3792 cast result to (void) to eliminate message.
3795 return value of type other than bool or int ignored
3796 Categories: returnvals, booleans
3799 Result returned by function call is not used. If this is intended, can
3800 cast result to (void) to eliminate message.
3803 a parameter with side-effects is passed as a sef parameter
3804 Categories: macros, parameters
3807 An actual parameter corresponding to a sef parameter may have a
3811 a parameter with unconstrained side-effects is passed as a sef parameter
3812 Categories: macros, parameters
3815 An actual parameter corresponding to a sef parameter involves a call to a
3816 procedure with no modifies clause that may have a side-effect.
3819 declaration reuses name visible in outer scope
3820 Category: declarations
3823 An outer declaration is shadowed by the local declaration.
3826 shared storage transferred to non-shared reference
3830 Shared storage is transferred to a non-shared reference. The other
3831 reference may release storage needed by this reference.
3834 a shift left operand may be negative
3835 Categories: operations,
3838 The left operand to a shift operator may be negative (behavior is
3839 implementation-defined).
3842 a shift right operand may be negative
3843 Categories: operations,
3846 The right operand to a shift operator may be negative (behavior
3850 show all possible types
3854 When a library function is declared with multiple possible type, the
3855 alternate types are shown only if +showallconjs.
3858 show sorted list of uses of all globals
3859 Categories: display, alluse
3864 show column number where error is found
3865 Categories: format, display
3869 showconstraintlocation
3870 display location for every constraint generated
3871 Categories: memorybounds, display
3875 showconstraintparens
3876 display parentheses around constraint terms
3877 Categories: memorybounds, display
3882 show name of function containing error
3888 show file names are they are processed
3889 Categories: display, files
3894 display the source code location where a warning is produced
3900 show summary of all errors reported and suppressed
3901 Categories: display, errors
3906 optimize header inclusion to eliminate redundant includes
3907 Categories: headers, performance
3910 When checking multiple files, each header file is processed only once.
3911 This may change the meaning of the code, if the same header file is
3912 included in different contexts (e.g., the header file includes #if
3913 directives and the values are different when it is included in different
3917 sizeof operator has an array formal parameter argument
3918 Categories: operations,
3921 Operand of a sizeof operator is a function parameter declared as an
3922 array. The value of sizeof will be the size of a pointer to the element
3923 type, not the number of elements in the array.
3926 sizeof operator has a type argument
3927 Categories: operations,
3930 Operand of sizeof operator is a type. (Safer to use expression, int *x =
3931 sizeof (*x); instead of sizeof (int).)
3934 prevent inclusion of header files in a system directory with names that
3935 match standard ANSI headers. The symbolic information in the standard
3936 library is used instead. Flag in effect only if a library including the
3937 ANSI library is loaded. The ANSI headers are:
3938 assert, ctype, errno, float, limits, locale, math, setjmp, signal, stdarg,
3939 stddef, stdio, stdlib, strings, string, time, and wchar.
3940 Categories: directories, files
3945 prevent inclusion of header files in a system directory with names that
3946 match standard POSIX headers. The symbolic information in the posix library
3947 is used instead. The POSIX headers are:
3948 dirent, fcntl, grp, pwd, termios, sys/stat, sys/times, sys/types,
3949 sys/utsname, sys/wait, unistd, and utime.
3950 Categories: directories, files
3955 do not include header files in system directories (set by -sysdirs)
3956 Categories: headers, performance
3959 Do not include header files in system directories (set by -sysdirs)
3963 Categories: comments,
3966 A // comment is used. ISO C99 allows // comments, but earlier standards
3970 slovak naming convention violated
3971 Categories: names, abstract
3974 Name is not consistent with Slovak naming convention.
3977 slovak naming convention violated in a constant declaration
3978 Categories: names, abstract
3981 Constant name is not consistent with Slovak naming convention.
3984 slovak naming convention violated in a function or iterator declaration
3985 Categories: names, abstract
3988 Function or iterator name is not consistent with Slovak naming
3992 slovak naming convention violated in an expanded macro name
3993 Categories: names, abstract
3996 Expanded macro name is not consistent with Slovak naming convention.
3999 slovak naming convention violated in a use-defined type definition
4000 Categories: names, abstract
4003 Type name is not consistent with Slovak naming convention. Slovak type
4004 names may not include uppercase letters.
4007 slovak naming convention violated in a variable declaration
4008 Categories: names, abstract
4011 Variable name is not consistent with Slovak naming convention.
4014 assume unannotated global storage is only
4015 Categories: memory, implicit
4020 sets specglobimponly, specretimponly and specstructimponly
4021 Categories: memory, implicit
4026 check all macros corresponding to specified functions or constants
4030 Every macro declared a specification file is checked.
4033 assume unannotated returned storage is only
4034 Categories: memory, implicit
4039 assume unannotated structure field is only
4040 Categories: memory, implicit
4045 function or variable specified but never declared in a source file
4046 Categories: complete, specifications
4049 A function or variable is declared in an .lcl file, but not declared in
4050 any source code file.
4053 function or variable specified but never defined
4054 Categories: complete, specifications
4057 A function or variable is declared in an .lcl file, but not defined in
4058 any source code file.
4061 external reference to stack-allocated storage is created
4062 Categories: memory, released
4065 A stack reference is pointed to by an external reference when the
4066 function returns. The stack-allocated storage is destroyed after the
4067 call, leaving a dangling reference.
4070 control paths merge with storage in incompatible states
4071 Categories: extensible, memory
4074 Control path merge violates user-defined state merge rules.
4077 storage has been transfered with invalid state
4078 Categories: extensible, memory
4081 Transfer violates user-defined state rules.
4084 static storage is used as an initial value in an inconsistent way
4088 Static storage is used as an initial value in an inconsistent way.
4091 static storage is transferred in an inconsistent way
4095 Static storage is transferred in an inconsistent way.
4098 display lines processed and time
4104 storage through array fetch has inconsistent states of alternate paths
4109 The state of a variable through an array fetch is different depending on
4110 which branch is taken. This means no annotation can sensibly be applied
4114 report complete destruction errors for array elements that may have been
4116 Categories: memory, leaks
4121 interpret standard library strictly
4122 Categories: libraries, initializations
4125 Stricter version of the standard library is used. (The default library is
4126 standard.lcd; strict library is strict.lcd.)
4129 primitive operation does not type check strictly
4130 Categories: operations,
4133 A primitive operation does not type check strictly.
4136 element used after it may have been released
4137 Categories: memory, released
4140 Memory (through fetch) is used after it may have been released (either by
4141 passing as an only param or assigning to an only global).
4144 set maximum length of string literals (ANSI89 minimum is 509; ISO99 is 4095)
4145 Categories: limits, ansi
4148 Numeric Argument. Default: 4095
4149 Maximum length of string literal exceeded.
4152 string literal leaves no room for null terminator
4155 A string literal is assigned to a char array that is not big enough to
4156 hold the null terminator.
4158 stringliteralsmaller
4159 string literal is smaller than the char array it is assigned to
4162 A string literal is assigned to a char array that smaller than the string
4165 stringliteraltoolong
4166 string literal too long for character array
4169 A string literal is assigned to a char array too small to hold it.
4172 assume unannotated structure field is only
4173 Categories: memory, implicit
4178 The number of errors detected does not match number in /*@i<n>@*/.
4179 Categories: suppress, comments
4184 function is restricted to superusers
4185 Categories: warnuse, security
4188 Call to function restricted to superusers.
4191 break in loop inside switch
4192 Category: controlflow
4195 A break statement appears inside the body of a while or for statement
4196 within a switch. This is perfectly reasonable code, but check that the
4197 break is intended to break only the inner loop. The break statement may
4198 be preceded by /*@loopbreak@*/ to suppress the message for this break
4202 break in switch inside switch
4203 Category: controlflow
4206 A break statement appears inside a switch statement within another switch
4207 statement. This is perfectly reasonable code, but check that the break is
4208 intended to break only the inner switch. The break statement may be
4209 preceded by /*@innerbreak@*/ to suppress the message for this break only.
4212 syntax error in parsing
4215 Code cannot be parsed. For help on parse errors, see splint -help
4219 report errors in files in system directories (set by -sysdirs)
4220 Categories: directories, suppress
4225 expand macros in system directories regardless of other settings, except for
4226 macros corresponding to names defined in a load library
4227 Categories: directories, macros
4232 set directories for system files (default /usr/include). Separate
4233 directories with path separator (colons in Unix, semi-colons in Windows).
4234 Flag settings propagate to files in a system directory. If -sysdirerrors is
4235 set, no errors are reported for files in system directories.
4236 Categories: directories, files
4239 Path argument. Default: /usr/
4242 report unrecognized identifiers with system (__) prefix
4243 Categories: unrecognized, display
4246 Identifier used in code has not been declared. (Message repeated for
4247 future uses in this file.) Use +gnuextensions to make Splint recognize
4248 some keywords that are gnu extensions.
4251 set namespace prefix for struct, union and enum tags
4252 Categories: names, prefixes
4255 String argument. No default.
4256 A tag identifier does not start with the tagprefix.
4259 the tagprefix may not be used for non-tag identifiers
4260 Categories: names, prefixes
4263 An identifier that is not a tag starts with the tagprefix.
4266 temp storage transferred to non-temporary reference
4270 Temp storage (associated with a formal parameter) is transferred to a
4271 non-temporary reference. The storage may be released or new aliases
4275 display time distribution
4281 interpret t comments (ignore errors in lines marked with /*@t<n>@*/
4282 Categories: syncomments, suppress
4287 set directory for writing temp files
4288 Categories: directories, files
4291 Directory argument. Default: /tmp/
4294 possible time of check, time of use vulnerability
4295 Categories: warnuse, security
4298 Possible time of check, time of use vulnerability.
4301 declaration at top level not used
4302 Categories: alluse, complete
4305 An external declaration not used in any source file.
4308 try to recover from parse error
4311 Try to recover from parse error. It really means try - this doesn't
4318 Types are incompatible.
4321 set namespace prefix for user-defined types
4322 Categories: names, prefixes
4325 String argument. No default.
4326 A user-defined type does not start with the typeprefix
4329 the typeprefix may not be used for identifiers that are not type names
4330 Categories: names, prefixes
4333 An identifier that is not a type name starts with the typeprefix.
4336 type declared but not used
4340 A type is declared but not used. Use /*@unused@*/ in front of typedef to
4344 function returns with an unchecked global aliasing external state
4345 Categories: aliasing, globals
4348 A global variable aliases externally-visible state when the function
4351 uncheckedmacroprefix
4352 set namespace prefix for unchecked macros
4353 Categories: names, prefixes
4356 String argument. No default.
4357 An unchecked macro name does not start with the uncheckedmacroprefix
4359 uncheckedmacroprefixexclude
4360 the uncheckmacroprefix may not be used for identifiers that are not
4362 Categories: names, prefixes
4365 An identifier that is not the name of an unchecked macro starts with the
4366 uncheckedmacroprefix.
4369 at least one field of a union must be defined
4370 Categories: memory, definition
4373 No field of a union is defined. Generally, one field of a union is
4374 expected to be defined.
4377 use UNIX (sort-of) standard library
4378 Categories: libraries, initializations
4381 UNIX version of the standard library is used.
4384 function is not required in Standard UNIX Specification
4385 Categories: warnuse, security
4388 Use of function that need not be provided by UNIX implementations
4391 use strict version of UNIX (sort-of) library
4392 Categories: libraries, initializations
4395 strict version of the UNIX library is used.
4397 unqualifiedinittrans
4398 unqualified storage is used as an initial value in an inconsistent way
4402 Unqualified storage is used as an initial value in an inconsistent way.
4405 unqualified storage is transferred in an inconsistent way
4409 Unqualified storage is transferred in an inconsistent way.
4412 unreachable code detected
4413 Category: controlflow
4416 This code will never be reached on any possible execution.
4419 unrecognized identifier
4420 Category: unrecognized
4423 Identifier used in code has not been declared.
4426 stylized comment is unrecognized
4427 Categories: syncomments,
4430 Word after a stylized comment marker does not correspond to a stylized
4434 unrecognized pre-processor directive
4435 Categories: preproc,
4438 Pre-processor directive is not recognized.
4441 stylized flag comment uses an unrecognized flag
4442 Categories: syncomments,
4445 Semantic comment attempts to set a flag that is not recognized.
4448 comparison using <, <=, >= between an unsigned integral and zero constant
4449 Category: operations
4452 An unsigned value is used in a comparison with zero in a way that is
4453 either a bug or confusing.
4456 unused declaration in special file (corresponding to .l or .y file)
4457 Categories: alluse, complete
4462 use before definition
4463 Category: definition
4466 An rvalue is used that may not be initialized to a value on some
4470 storage used after release
4471 Categories: memory, released
4474 Memory is used after it has been released (either by passing as an only
4475 param or assigning to an only global).
4478 send error messages to standard error (instead of standard out)
4479 Categories: display, errors
4484 non-standard <varargs.h> included
4485 Categories: libraries, ansi
4488 Header <varargs.h> is not part of ANSI Standard. Should use <stdarg.h>
4492 variable declared but not used
4496 A variable is declared but never used. Use /*@unused@*/ in front of
4497 declaration to suppress message.
4500 void * matches pointers to abstract types, casting ok (dangerous)
4501 Categories: typeequivalence, abstract
4504 A pointer to void is cast to a pointer to an abstract type (or vice
4508 warn when command line sets flag in abnormal way
4512 Command line sets flag in abnormal way
4515 warn when a traditional lint comment is used
4516 Categories: syncomments, suppress
4519 A traditional lint comment is used. Some traditional lint comments are
4520 interpreted by Splint to enable easier checking of legacy code. It is
4521 preferable to replace these comments with the suggested Splint
4525 global variable used in modifies clause is not listed in globals list
4526 Categories: globals, modification
4529 A global variable is used in the modifies clause, but it not listed in
4530 the globals list. The variable will be added to the globals list.
4532 warnmissingglobsnoglobs
4533 global variable used in modifies clause in a function with no globals list
4534 Categories: globals, modification
4537 A global variable is used in the modifies clause, but the function has no
4538 globals list. The variable will be added to the globals list.
4541 a POSIX header is included, but the POSIX library is not used
4542 Categories: libraries, ansi
4545 Header name matches a POSIX header, but the POSIX library is not
4549 warn when there are problems with reading the initialization files
4553 There was a problem reading an initialization file
4556 warn when the unix library is used
4557 Categories: libraries, ansi
4560 Unix library may not be compatible with all platforms
4563 warn when declaration marked with warn is used
4567 Declaration marked with warn clause is used (can be suppresed by more
4571 show standard library filename
4572 Categories: libraries, initializations
4577 the body of a while statement is not a block
4578 Category: controlflow
4581 While body is a single statement, not a compound block.
4584 a while statement has no body
4585 Category: controlflow
4588 While statement has no body.
4591 assume all while loops execute at least once
4592 Categories: controlflow, memory
4597 treat 0 as a boolean
4598 Categories: typeequivalence, booleans
4603 tread 0 as a pointer
4604 Categories: typeequivalence, pointers
4612 ===================================
4614 A possibly null pointer is misused (sets nullderef, nullpass, nullref,
4615 nullassign, and nullstate).
4617 A possibly null pointer is dereferenced. Value is either the result of a
4618 function which may return null (in which case, code should check it is not
4619 null), or a global, parameter or structure field declared with the null
4622 A possibly null pointer is passed as a parameter corresponding to a formal
4623 parameter with no /*@null@*/ annotation. If NULL may be used for this
4624 parameter, add a /*@null@*/ annotation to the function parameter
4627 Function returns a possibly null pointer, but is not declared using
4628 /*@null@*/ annotation of result. If function may return NULL, add
4629 /*@null@*/ annotation to the return value declaration.
4631 A possibly null pointer is reachable from a parameter or global variable
4632 that is not declared using a /*@null@*/ annotation.
4633 nullassign: <M:-+++>
4634 A reference with no null annotation is assigned or initialized to NULL. Use
4635 /*@null@*/ to declare the reference as a possibly null pointer.
4638 ===================================
4640 An rvalue is used that may not be initialized to a value on some execution
4644 ===================================
4645 mustdefine: <M:-+++>
4646 An out parameter or global is not defined before control is transferred.
4648 No field of a union is defined. Generally, one field of a union is expected
4651 Storage derivable from a parameter, return value or global is not defined.
4652 Use /*@out@*/ to denote passed or returned storage which need not be
4656 ===================================
4657 fullinitblock: <P:+>
4658 Initializer does not set every field in the structure.
4659 initallelements: <P:+>
4660 Initializer does not define all elements of a declared array.
4662 Initializer block contains more elements than the size of a declared array.
4664 Pointer parameters to unspecified functions may be implicit out parameters.
4667 ===================================
4669 A function, variable or constant is redefined with a different type.
4670 matchfields: <M:-+++>
4671 A struct, union or enum type is redefined with inconsistent fields or
4675 ===================================
4677 A function type is dereferenced. The ANSI standard allows this because of
4678 implicit conversion of function designators, however the dereference is
4682 ===================================
4683 realcompare: <M:-+++>
4684 Two real (float, double, or long double) values are compared directly using
4685 a C primitive. This may produce unexpected results since floating point
4686 representations are inexact. Instead, compare the difference to FLT_EPSILON
4688 unsignedcompare: <M:-+++>
4689 An unsigned value is used in a comparison with zero in a way that is either
4692 Pointer arithmetic using pointer and integer.
4693 nullptrarith: <M:--++>
4694 Pointer arithmetic using a possibly null pointer and integer.
4695 ptrcompare: <M:-+++>
4696 A pointer is compared to a number.
4698 A primitive operation does not type check strictly.
4699 bitwisesigned: <M:---+>
4700 An operand to a bitwise operator is not an unsigned values. This may have
4701 unexpected results depending on the signed representations.
4702 shiftnegative: <M:-+++>
4703 The right operand to a shift operator may be negative (behavior undefined).
4704 shiftimplementation: <M:-+++>
4705 The left operand to a shift operator may be negative (behavior is
4706 implementation-defined).
4707 sizeoftype: <M:---+>
4708 Operand of sizeof operator is a type. (Safer to use expression, int *x =
4709 sizeof (*x); instead of sizeof (int).)
4710 sizeofformalarray: <P:+>
4711 Operand of a sizeof operator is a function parameter declared as an array.
4712 The value of sizeof will be the size of a pointer to the element type, not
4713 the number of elements in the array.
4716 ===================================
4717 fixedformalarray: <P:+>
4718 A formal parameter is declared as an array with size. The size of the array
4719 is ignored in this context, since the array formal parameter is treated as a
4721 incompletetype: <P:+>
4722 A formal parameter is declared with an incomplete type.
4724 A formal parameter is declared as an array. This can be confusing, since a
4725 formal array parameter is treated as a pointer.
4728 ===================================
4729 booltype <string> [lltX_bool]: <P:->
4730 Set name of boolean type (default bool).
4731 boolfalse <string> [FALSE]: <P:->
4732 Set name of boolean false (default FALSE).
4733 booltrue <string> [TRUE]: <P:->
4734 Set name of boolean true (default TRUE).
4736 Use the -booltype, -boolfalse and -booltrue flags to change the name of the
4737 default boolean type.
4738 boolcompare: <M:-+++>
4739 Two bool values are compared directly using a C primitive. This may produce
4740 unexpected results since all non-zero values are considered TRUE, so
4741 different TRUE values may not be equal. The file bool.h (included in
4742 splint/lib) provides bool_equal for safe bool comparisons.
4744 The operand of a boolean operator is not a boolean. Use +ptrnegate to allow
4745 ! to be used on pointers.
4747 The operand of ! operator is a pointer.
4749 The condition test is an assignment expression. Probably, you mean to use ==
4750 instead of =. If an assignment is intended, add an extra parentheses nesting
4751 (e.g., if ((a = b)) ...) to suppress this message.
4753 Test expression type is not boolean.
4756 ===================================
4757 predboolint: <M:-+++>
4758 Test expression type is not boolean or int.
4761 ===================================
4762 predboolptr: <M:--++>
4763 Test expression type is not boolean.
4764 predboolothers: <M:++++>
4765 Test expression type is not boolean.
4768 ===================================
4770 An abstraction barrier is broken. If necessary, use /*@access <type>@*/ to
4771 allow access to an abstract type.
4773 Assume user type definitions are abstract (unless /*@concrete@*/ is used).
4775 The representation of an abstract type defined in <M>.<x> is accessible
4776 anywhere in a file named <M>.<y>.
4778 The representation of an abstract type named <t> is accessible anywhere in a
4781 The representation of an abstract type named <t> is accessible in the
4782 definition of a function or constant named <t>_<name>
4784 The representation of an abstract type named <t> is accessible in the
4785 definition of a function or constant named <t><Name>
4786 accessczechoslovak: <P:->
4787 The representation of an abstract type named <t> is accessible in the
4788 definition of a function or constant named <t>_<name> or <t><Name>
4790 Sets accessmodule, accessfile and accessczech
4792 LCL semantics requires that a mutable type exhibits sharing semantics. In
4793 order for objects to be shared a indirection is necessary in the
4794 representation. A mutable type may be represented by a pointer or an
4795 abstract mutable type. Handles into static data are fine, too, but will
4796 generate this error message unless it is suppressed.
4799 ===================================
4800 mustfreefresh: <M:-+++>
4801 A memory leak has been detected. Storage allocated locally is not released
4802 before the last reference to it is lost.
4803 mustfreeonly: <M:-+++>
4804 A memory leak has been detected. Only-qualified storage is not released
4805 before the last reference to it is lost.
4807 A memory leak has been detected.
4808 usereleased: <M:-+++>
4809 Memory is used after it has been released (either by passing as an only
4810 param or assigning to an only global).
4811 strictusereleased: <M:---+>
4812 Memory (through fetch) is used after it may have been released (either by
4813 passing as an only param or assigning to an only global).
4814 compdestroy: <M:-+++>
4815 A storage leak due to incomplete deallocation of a structure or deep pointer
4816 is suspected. Unshared storage that is reachable from a reference that is
4817 being deallocated has not yet been deallocated. Splint assumes when an
4818 object is passed as an out only void pointer that the outer object will be
4819 deallocated, but the inner objects will not.
4820 strictdestroy: <M:---+>
4821 Report complete destruction errors for array elements that may have been
4824 When an element is fetched from an array, Splint analysis is not able to
4825 determine if the same element is reused. If +deparrays, Splint will mark
4826 local storage assigned from array fetches as dependent.
4827 branchstate: <M:-+++>
4828 The state of a variable is different depending on which branch is taken.
4829 This means no annotation can sensibly be applied to the storage.
4830 strictbranchstate: <M:---+>
4831 The state of a variable through an array fetch is different depending on
4832 which branch is taken. This means no annotation can sensibly be applied to
4835 Sets all dynamic memory checking flags (memimplicit, mustfree, mustdefine,
4836 mustnotalias, null, memtrans).
4837 compmempass: <M:-+++>
4838 Storage derivable from a parameter does not match the alias kind expected
4839 for the formal parameter.
4841 A stack reference is pointed to by an external reference when the function
4842 returns. The stack-allocated storage is destroyed after the call, leaving a
4845 Memory is transferred in a way that violates annotations.
4846 dependenttrans: <M:-+++>
4847 Dependent storage is transferred to a non-dependent reference.
4848 newreftrans: <M:-+++>
4849 A new reference is transferred to a reference counted reference.
4851 The only reference to this storage is transferred to another reference
4852 (e.g., by returning it) that does not have the only annotation. This may
4853 lead to a memory leak, since the new reference is not necessarily released.
4854 onlyunqglobaltrans: <M:--++>
4855 The only reference to this storage is transferred to another reference that
4856 does not have an aliasing annotation. This may lead to a memory leak, since
4857 the new reference is not necessarily released.
4858 ownedtrans: <M:-+++>
4859 The owned reference to this storage is transferred to another reference
4860 (e.g., by returning it) that does not have the owned annotation. This may
4861 lead to a memory leak, since the new reference is not necessarily released.
4862 freshtrans: <M:-+++>
4863 Fresh storage (newly allocated in this function) is transferred in a way
4864 that the obligation to release storage is not propagated. Use the
4865 /*@only@*/ annotation to indicate the a return value is the only reference
4866 to the returned storage.
4867 sharedtrans: <M:-+++>
4868 Shared storage is transferred to a non-shared reference. The other reference
4869 may release storage needed by this reference.
4871 Temp storage (associated with a formal parameter) is transferred to a
4872 non-temporary reference. The storage may be released or new aliases created.
4874 storage is transferred to a non-temporary reference after being passed as
4875 keep parameter. The storage may be released or new aliases created.
4877 Keep storage is transferred inconsistently --- either in a way that may add
4878 a new alias to it, or release it.
4879 immediatetrans: <M:-+++>
4880 An immediate address (result of & operator) is transferred inconsistently.
4881 refcounttrans: <M:-+++>
4882 Reference counted storage is transferred in a way that may not be consistent
4883 with the reference count.
4884 statictrans: <M:-+++>
4885 Static storage is transferred in an inconsistent way.
4886 unqualifiedtrans: <M:-+++>
4887 Unqualified storage is transferred in an inconsistent way.
4888 staticinittrans: <M:--++>
4889 Static storage is used as an initial value in an inconsistent way.
4890 unqualifiedinittrans: <M:--++>
4891 Unqualified storage is used as an initial value in an inconsistent way.
4892 readonlytrans: <M:--++>
4893 A read-only string literal is assigned to a non-observer reference.
4894 passunknown: <M:---->
4895 Passing a value as an un-annotated parameter clears its annotation.
4896 readonlystrings: <M:-+++>
4897 String literals are read-only. An error is reported if a string literal may
4898 be modified or released.
4900 Memory errors for unqualified storage.
4902 Assume unannotated parameter is temp.
4903 allimponly: <S><P:->
4904 Sets globimponly, retimponly, structimponly, specglobimponly, specretimponly
4905 and specstructimponly.
4906 codeimponly: <S><P:->
4907 Sets globimponly, retimponly and structimponly.
4908 specimponly: <S><P:->
4909 Sets specglobimponly, specretimponly and specstructimponly.
4911 Assume unannotated global storage is only.
4913 Assume unannotated returned storage is only.
4914 structimponly: <P:+>
4915 Assume unannotated structure field is only.
4916 specglobimponly: <P:->
4917 Assume unannotated global storage is only.
4918 specretimponly: <P:->
4919 Assume unannotated returned storage is only.
4920 specstructimponly: <P:->
4921 Assume unannotated structure field is only.
4924 ===================================
4925 aliasunique: <M:-+++>
4926 A unique or only parameter is aliased by some other parameter or visible
4928 mayaliasunique: <M:-+++>
4929 A unique or only parameter may be aliased by some other parameter or visible
4931 mustnotalias: <M:-+++>
4932 An alias has been added to a temp-qualifier parameter or global that is
4933 visible externally when the function returns. If the aliasing is needed, use
4934 the /*@shared@*/ annotation to indicate that new aliases to the parameter
4937 The returned value shares storage with a parameter or global. If a parameter
4938 is to be returned, use the returned qualifier. If the result is not
4939 modified, use the observer qualifier on the result type. Otherwise, exposed
4940 can be used, but limited checking is done.
4942 A global variable aliases externally-visible state when the function
4944 checkstrictglobalias: <M:-+++>
4945 A global variable aliases externally-visible state when the function
4947 checkedglobalias: <M:-+++>
4948 A global variable aliases externally-visible state when the function
4950 checkmodglobalias: <M:-+++>
4951 A global variable aliases externally-visible state when the function
4953 uncheckedglobalias: <M:--++>
4954 A global variable aliases externally-visible state when the function
4958 ===================================
4959 exposetrans: <M:-+++>
4960 Exposed storage is transferred to a non-exposed, non-observer reference.
4961 observertrans: <M:-+++>
4962 Observer storage is transferred to a non-observer reference.
4965 ===================================
4967 The internal representation of an abstract type is visible to the caller.
4968 This means clients may have access to a pointer into the abstract
4971 The return value shares storage with an instance of an abstract type. This
4972 means clients may have access to a pointer into the abstract representation.
4973 Use the observer qualifier to return exposed storage that may not be
4974 modified by the client. Use the exposed qualifier to return modifiable (but
4975 not deallocatable) exposed storage (dangerous).
4976 assignexpose: <M:--++>
4977 Storage internal to the representation of an abstract type is assigned to an
4978 external pointer. This means clients may have access to a pointer into the
4979 abstract representation. If the external pointer is a parameter, the exposed
4980 qualifier can be used to allow the assignment, however, this is considered
4981 dangerous programming practice.
4982 castexpose: <M:--++>
4983 Storage internal to the representation of an abstract type is exposed
4984 through a type cast. This means clients may have access to a pointer into
4985 the abstract representation.
4988 ===================================
4989 redundantsharequal: <M:--++>
4990 A declaration of an immutable object uses a redundant observer qualifier.
4991 misplacedsharequal: <M:-+++>
4992 A declaration of an unsharable object uses a sharing annotation.
4995 ===================================
4997 An externally-visible object is modified by a function, but not listed in
4998 its modifies clause.
5000 An object listed in the modifies clause is not modified by the
5001 implementation of the function. The modification may not be detected if it
5002 is done through a call to an unspecified function.
5004 Storage declared with observer is possibly modified. Observer storage may
5006 modobserveruncon: <M:---+>
5007 Storage declared with observer may be modified through a call to an
5008 unconstrained function.
5009 modinternalstrict: <M:---+>
5010 A function that modifies internalState is called from a function that does
5011 not list internalState in its modifies clause
5012 modfilesys: <M:---+>
5013 Report undocumented file system modifications (applies to unspecified
5014 functions if modnomods is set).
5016 Modification in unspecified functions (sets modnomods, modglobunspec and
5017 modstrictglobsunspec).
5019 An externally-visible object is modified by a function with no
5020 /*@modifies@*/ comment. The /*@modifies ... @*/ control comment can be used
5021 to give a modifies list for an unspecified function.
5023 An unconstrained function is called in a function body where modifications
5024 are checked. Since the unconstrained function may modify anything, there may
5025 be undetected modifications in the checked function.
5026 modunconnomods: <M:---+>
5027 An unconstrained function is called in a function body where modifications
5028 are checked. Since the unconstrained function may modify anything, there may
5029 be undetected modifications in the checked function.
5030 globsimpmodsnothing: <M:--++>
5031 An implicit modifies nothing clause is assumed for a function declared with
5032 a globals list but not modifies clause.
5033 modsimpnoglobs: <M:---->
5034 An implicit empty globals list is assumed for a function declared with a
5035 modifies clause but no globals list.
5038 ===================================
5040 A global variable does not satisfy its annotations when control is
5043 A checked global variable is used in the function, but not listed in its
5044 globals clause. By default, only globals specified in .lcl files are
5045 checked. To check all globals, use +allglobals. To check globals selectively
5046 use /*@checked@*/ in the global declaration.
5048 A global variable listed in the function's globals list is not used in the
5049 body of the function.
5050 internalglobs: <M:---+>
5051 A called function uses internal state, but the globals list for the function
5052 being checked does not include internalState
5053 internalglobsnoglobs: <M:---+>
5054 A called function uses internal state, but the function being checked has no
5056 warnmissingglobs: <M:---+>
5057 A global variable is used in the modifies clause, but it not listed in the
5058 globals list. The variable will be added to the globals list.
5059 warnmissingglobsnoglobs: <M:---+>
5060 A global variable is used in the modifies clause, but the function has no
5061 globals list. The variable will be added to the globals list.
5062 globnoglobs: <M:---+>
5063 A specified global variable is used in the function, but not listed in its
5064 globals list. Without +globnoglobs, only globals declared with
5065 /*@checkedstrict@*/ will produce use errors in functions without globals
5066 lists. The /*@globals ... @*/ control comment can be used to give a globals
5067 list for an unspecified function.
5069 Report use and modification errors for globals not annotated with unchecked.
5070 checkstrictglobs: <M:++++>
5071 Report use and modification errors for checkedstrict globals.
5072 impcheckedspecglobs: <M:-+++>
5073 Assume checked qualifier for unqualified global declarations in .lcl files.
5074 impcheckmodspecglobs: <M:---->
5075 Assume checkmod qualifier for unqualified global declarations in .lcl files.
5076 impcheckedstrictspecglobs: <M:---+>
5077 Assume checkmod qualifier for unqualified global declarations in .lcl files.
5078 impcheckedglobs: <M:---->
5079 Assume checked qualifier for unqualified global declarations.
5080 impcheckmodglobs: <M:---->
5081 Assume checkmod qualifier for unqualified global declarations.
5082 impcheckedstrictglobs: <M:---+>
5083 Assume checkedstrict qualifier for unqualified global declarations.
5084 impcheckedstatics: <M:---->
5085 Assume checked qualifier for unqualified file static declarations.
5086 impcheckmodstatics: <M:---->
5087 Assume checkmod qualifier for unqualified file static declarations.
5088 impcheckmodinternals: <M:--++>
5089 Assume checkmod qualifier for unqualified local static declarations (for
5090 internal state modifications).
5091 impcheckedstrictstatics: <M:---+>
5092 Assume checkedstrict qualifier for unqualified file static declarations.
5094 A checked global variable is modified by the function, but not listed in its
5096 modglobsnomods: <M:---+>
5097 A checked global variable is modified by the function, but not listed in its
5099 modstrictglobsnomods: <M:---+>
5100 A checked global variable is modified by the function, but not listed in its
5102 modglobsunchecked: <M:---+>
5103 An unchecked global variable is modified by the function, but not listed in
5104 its modifies clause.
5107 ===================================
5109 There is a path through a function declared to return a value on which there
5110 is no return statement. This means the execution may fall through without
5111 returning a meaningful result to the caller.
5113 Empty return in function declared to return value.
5115 Loop predicate always exits.
5117 Assume all loops execute at least once (sets forloopexec, whileloopexec and
5120 Assume all for loops execute at least once.
5121 whileloopexec: <P:->
5122 Assume all while loops execute at least once.
5124 Assume all iterator loops execute at least once.
5125 obviousloopexec: <P:+>
5126 Assume loop that can be determined to always execute always does.
5129 ===================================
5131 Code has unspecified behavior. Order of evaluation of function parameters or
5132 subexpressions is not defined, so if a value is used and modified in
5133 different places not separated by a sequence point constraining evaluation
5134 order, then the result of the expression is unspecified.
5135 evalorderuncon: <M:---+>
5136 Code involving a call to function with no modifies or globals clause may
5137 have undefined or implementation-dependent behavior (Splint assumes the
5138 unconstrained call may modify any reachable state or use any global). Add a
5139 specification for the function.
5142 ===================================
5144 This appears to be an infinite loop. Nothing in the body of the loop or the
5145 loop test modifies the value of the loop test. Perhaps the specification of
5146 a function called in the loop body is missing a modification.
5147 infloopsuncon: <M:--++>
5148 This appears to be an infinite loop. Nothing in the body of the loop or the
5149 loop test modifies the value of the loop test. There may be a modification
5150 through a call to an unconstrained function, or an unconstrained function in
5151 the loop test may use a global variable modified by the loop body.
5153 Execution falls through from the previous case.
5155 Not all values in an enumeration are present as cases in the switch.
5157 The first statement after a switch is not a case.
5158 duplicatecases: <P:+>
5159 Duplicate cases in switch.
5161 A break statement appears inside the body of a nested while, for or switch
5162 statement. Sets looploopbreak, loopswitchbreak, switchloopbreak,
5163 switchswitchbreak, and looploopcontinue.
5164 looploopbreak: <M:--++>
5165 A break statement appears inside the body of a nested while or for
5166 statement. This is perfectly reasonable code, but check that the break is
5167 intended to break only the inner loop. The break statement may be preceded
5168 by /*@innerbreak@*/ to suppress the message for this break only.
5169 switchloopbreak: <M:--++>
5170 A break statement appears inside the body of a while or for statement within
5171 a switch. This is perfectly reasonable code, but check that the break is
5172 intended to break only the inner loop. The break statement may be preceded
5173 by /*@loopbreak@*/ to suppress the message for this break only.
5174 loopswitchbreak: <M:---+>
5175 A break statement appears inside a switch statement within a while or for
5176 loop. This is perfectly reasonable code, but check that the break is
5177 intended to break only the inner loop. The break statement may be preceded
5178 by /*@switchbreak@*/ to suppress the message for this break only.
5179 switchswitchbreak: <M:---+>
5180 A break statement appears inside a switch statement within another switch
5181 statement. This is perfectly reasonable code, but check that the break is
5182 intended to break only the inner switch. The break statement may be preceded
5183 by /*@innerbreak@*/ to suppress the message for this break only.
5184 looploopcontinue: <M:---+>
5185 A continue statement appears inside a loop within a loop. This is perfectly
5186 reasonable code, but check that the continue is intended to continue only
5187 the inner loop. The continue statement may be preceded by
5188 /*@innercontinue@*/ to suppress the message for this continue only.
5189 whileempty: <M:--++>
5190 While statement has no body.
5191 whileblock: <M:---+>
5192 While body is a single statement, not a compound block.
5194 For statement has no body.
5196 Loop body is a single statement, not a compound block.
5198 If statement has no body.
5200 If body is a single statement, not a compound block.
5202 An if, while or for statement has no body (sets ifempty, whileempty and
5205 Body is a single statement, not a compound block.
5206 elseifcomplete: <M:---+>
5207 There is no final else following an else if construct.
5208 unreachable: <M:-+++>
5209 This code will never be reached on any possible execution.
5212 ===================================
5214 Statement has no visible effect --- no values are modified.
5215 noeffectuncon: <M:---+>
5216 Statement has no visible effect --- no values are modified. It may modify
5217 something through a call to an unconstrained function.
5220 ===================================
5222 Result returned by function call is not used. If this is intended, cast
5223 result to (void) to eliminate message.
5224 retvalother: <M:++++>
5225 Result returned by function call is not used. If this is intended, can cast
5226 result to (void) to eliminate message.
5227 retvalbool: <M:-+++>
5228 Result returned by function call is not used. If this is intended, can cast
5229 result to (void) to eliminate message.
5231 Result returned by function call is not used. If this is intended, can cast
5232 result to (void) to eliminate message.
5235 ===================================
5236 nullterminated: <M:---->
5237 A possibly non-nullterminated string/memory is used/referenced as a
5240 Memory read or write may be out of bounds of allocated storage.
5241 boundsread: <M:---->
5242 A memory read references memory beyond the allocated storage.
5243 boundswrite: <M:---->
5244 A memory write may write to an address beyond the allocated buffer.
5246 Display function post conditions.
5247 redundantconstraints: <M:---->
5248 Display seemingly redundant constraints
5250 The function implementation may not satisfy a post condition given in an
5252 implictconstraint: <M:---->
5253 Generate implicit constraints for functions.
5254 orconstraint: <M:---->
5255 Use limited OR expressions to resolve constraints.
5256 nullterminated: <M:---->
5257 A user annotated non-nullterminated buffer is used/referenced as a
5259 showconstraintparens: <M:---->
5260 Display parentheses around constraint terms.
5261 showconstraintlocation: <M:---->
5262 Display location for every constraint generated.
5265 ===================================
5266 mts <filename>: <G><P:->
5267 Load meta state declaration and corresponding xh file.
5268 statetransfer: <M:++++>
5269 Transfer violates user-defined state rules.
5270 statemerge: <M:++++>
5271 Control path merge violates user-defined state merge rules.
5274 ===================================
5275 macroredef: <M:-+++>
5276 A macro is defined in more than one place.
5277 macrounrecog: <M:-+++>
5278 An unrecognized identifier appears in a macro. If the identifier is defined
5279 before the macro is used, then this is okay.
5280 macroconstdecl: <M:-+++>
5281 Macro constant has no declaration. Use /*@constant ...@*/ to declare the
5284 A macro is defined in a way that may cause syntactic problems. If the macro
5285 returns a value, use commas to separate expressions;
5286 otherwise, use do { <macro body> } while (FALSE) construct.
5287 macroempty: <M:---+>
5288 A macro definition has no body.
5289 macroparams: <M:-+++>
5290 A macro parameter is not used exactly once in all possible invocations of
5291 the macro. To behave like a function, each macro parameter must be used
5292 exactly once on all invocations of the macro so that parameters with
5293 side-effects are evaluated exactly once. Use /*@sef@*/ to denote parameters
5294 that must be side-effect free.
5295 macroreturn: <M:---->
5296 The body of a macro declared as a function uses a return statement. This
5297 exhibits behavior that could not be implemented by a function.
5298 macroassign: <M:-+++>
5299 A macro parameter is used as the left side of an assignment expression. This
5300 exhibits behavior that could not be implemented by a function.
5301 macroparens: <M:-+++>
5302 A macro parameter is used without parentheses. This could be dangerous if
5303 the macro is invoked with a complex expression and precedence rules will
5304 change the evaluation inside the macro.
5306 Argument checking cannot be done well for macros without prototypes or
5307 specifications, since the types of the arguments are unknown.
5308 macrofcndecl: <M:-+++>
5309 Function macro has no declaration.
5311 An actual parameter corresponding to a sef parameter may have a side-effect.
5313 An actual parameter corresponding to a sef parameter involves a call to a
5314 procedure with no modifies clause that may have a side-effect.
5316 Every non-parameterized macro (not preceded by /*@notfunction@*/) is checked
5319 Every parameterized macro (not preceded by /*@notfunction@*/) is checked as
5322 All macros (not preceded by /*@notfunction@*/) are checked as functions or
5323 constants depending on whether or not they have parameter lists.
5325 Every macro declared in the load library is checked.
5327 Every macro declared a specification file is checked.
5328 macromatchname: <M:++++>
5329 A iter or constant macro is defined using a different name from the one used
5330 in the previous syntactic comment
5331 nextlinemacros: <P:+>
5332 A constant or iter declaration is not immediately followed by a macro
5336 ===================================
5338 Iter is not balanced with end_<iter>.
5340 Iter yield parameter is inappropriate.
5342 An iterator has been declared with no parameters annotated with yield. This
5343 may be what you want, if the iterator is meant to do something a fixed
5344 number of times, but returns no information to the calling context.
5345 Probably, a parameter is missing the yield annotation to indicate that it is
5346 assigned a value in the calling context.
5349 ===================================
5351 Controls name checking without changing other settings.
5353 Name is not consistent with Czech naming convention.
5355 Function or iterator name is not consistent with Czech naming convention.
5357 Variable name is not consistent with Czech naming convention.
5359 Expanded macro name is not consistent with Czech naming convention.
5361 Constant name is not consistent with Czech naming convention.
5363 Type name is not consistent with Czech naming convention. Czech type names
5364 must not use the underscore character.
5366 Name is not consistent with Slovak naming convention.
5368 Function or iterator name is not consistent with Slovak naming convention.
5370 Expanded macro name is not consistent with Slovak naming convention.
5372 Variable name is not consistent with Slovak naming convention.
5374 Constant name is not consistent with Slovak naming convention.
5376 Type name is not consistent with Slovak naming convention. Slovak type names
5377 may not include uppercase letters.
5378 czechoslovak: <S><P:->
5379 Name is not consistent with either Czech or Slovak naming convention.
5380 czechoslovakfcns: <P:->
5381 Function name is not consistent with Czechoslovak naming convention.
5382 czechoslovakmacros: <P:->
5383 Expanded macro name is not consistent with Czechoslovak naming convention.
5384 czechoslovakvars: <P:->
5385 Variable name is not consistent with Czechoslovak naming convention.
5386 czechoslovakconsts: <P:->
5387 Constant name is not consistent with Czechoslovak naming convention.
5388 czechoslovaktypes: <P:->
5389 Type name is not consistent with Czechoslovak naming convention.
5390 Czechoslovak type names may not include uppercase letters or the underscore
5392 macrovarprefix <string> [m_]: <-><P:+>
5393 A variable declared in a macro body does not start with the macrovarprefix.
5394 macrovarprefixexclude: <P:+>
5395 A variable declared outside a macro body starts with the macrovarprefix.
5396 tagprefix <string>: <-><P:->
5397 A tag identifier does not start with the tagprefix.
5398 tagprefixexclude: <P:->
5399 An identifier that is not a tag starts with the tagprefix.
5400 enumprefix <string>: <-><P:->
5401 An enum member does not start with the enumprefix.
5402 enumprefixexclude: <P:->
5403 An identifier that is not an enum member starts with the enumprefix.
5404 filestaticprefix <string>: <-><P:->
5405 A file-static identifier does not start with the filestaticprefix.
5406 filestaticprefixexclude: <P:->
5407 An identifier that is not file static starts with the filestaticprefix.
5408 globalprefix <string>: <-><P:->
5409 A global variable does not start with the globalprefix
5410 globalprefixexclude: <P:->
5411 An identifier that is not a global variable starts with the globalprefix.
5412 typeprefix <string>: <-><P:->
5413 A user-defined type does not start with the typeprefix
5414 typeprefixexclude: <P:->
5415 An identifier that is not a type name starts with the typeprefix.
5416 externalprefix <string>: <-><P:->
5417 An external identifier does not start with the externalprefix
5418 externalprefixexclude: <P:->
5419 An identifier that is not external starts with the externalprefix.
5420 localprefix <string>: <-><P:->
5421 A local variable does not start with the localprefix
5422 localprefixexclude: <P:->
5423 An identifier that is not a local variable starts with the localprefix.
5424 uncheckedmacroprefix <string>: <-><P:->
5425 An unchecked macro name does not start with the uncheckedmacroprefix
5426 uncheckedmacroprefixexclude: <P:->
5427 An identifier that is not the name of an unchecked macro starts with the
5428 uncheckedmacroprefix.
5429 constprefix <string>: <-><P:->
5430 A constant does not start with the constantprefix
5431 constprefixexclude: <P:->
5432 An identifier that is not a constant starts with the constantprefix.
5433 iterprefix <string>: <-><P:->
5434 An iter does not start with the iterator prefix
5435 iterprefixexclude: <P:->
5436 An identifier that is not a iter starts with the iterprefix.
5437 protoparamprefix <string>: <-><P:->
5438 A parameter name in a function prototype declaration does not start with the
5439 declaration parameter prefix
5440 isoreserved: <M:--++>
5441 External name is reserved for system use by ISO C99 standard.
5443 External name is a C++ keyword or reserved word. This could lead to problems
5444 if the code is compiled with a C++ compiler.
5445 isoreservedinternal: <M:---+>
5446 Internal name is reserved for system in ISO C99 standard (this should not be
5447 necessary unless you are worried about C library implementations that
5448 violate the standard and use macros).
5449 distinctexternalnames: <P:->
5450 An external name is not distinguishable from another external name using the
5451 number of significant characters. According to ANSI Standard (3.1), an
5452 implementation may only consider the first 6 characters significant, and
5453 ignore alphabetical case distinctions (ISO C99 requires 31). The
5454 +externalnamelen <n> flag may be used to change the number of significant
5455 characters, and -externalnamecaseinsensitive to make alphabetical case
5456 significant in external names.
5457 externalnamelen <number> [31]: <S><P:->
5458 Sets the number of significant characters in an external name (default is 6
5459 for old ANSI89 limit, C99 requires 31). Sets +distinctexternalnames.
5460 externalnamecaseinsensitive: <S><P:+>
5461 Make alphabetic case insignificant in external names. By ANSI89 standard,
5462 case need not be significant in an external name. If +distinctexternalnames
5463 is not set, sets +distinctexternalnames with unlimited external name length.
5464 distinctinternalnames: <P:->
5465 An internal name is not distinguishable from another internal name using the
5466 number of significant characters. According to ANSI89 Standard (3.1), an
5467 implementation may only consider the first 31 characters significant (ISO
5468 C99 specified 63). The +internalnamelen <n> flag changes the number of
5469 significant characters, -internalnamecaseinsensitive to makes alphabetical
5470 case significant, and +internalnamelookalike to make similar-looking
5471 characters non-distinct.
5472 internalnamelen <number> [63]: <S><P:->
5473 Sets the number of significant characters in an internal name (ANSI89
5474 default is 31.) Sets +distinctinternalnames.
5475 internalnamecaseinsensitive: <S><P:->
5476 Set whether case is significant an internal names (-internalnamecaseinsensiti
5477 ve means case is significant). By ANSI89 default, case is not significant.
5478 If +distinctinternalnames is not set, sets +distinctinternalnames with
5479 unlimited internal name length.
5480 internalnamelookalike: <S><P:->
5481 Set whether similar looking characters (e.g., "1" and "l") match in internal
5483 protoparamname: <M:---+>
5484 A parameter in a function prototype has a name. This is dangerous, since a
5485 macro definition could be visible here.
5486 protoparammatch: <M:--++>
5487 A parameter in a function definition does not have the same name as the
5488 corresponding in the declaration of the function after removing the
5490 protoparamprefixexclude: <P:->
5491 An identifier that is not a parameter name in a function prototype starts
5492 with the protoparamprefix.
5495 ===================================
5497 An external declaration not used in any source file.
5498 exportlocal: <M:-+++>
5499 A declaration is exported, but not used outside this module. Declaration can
5500 use static qualifier.
5501 exportheader: <M:--++>
5502 A declaration is exported, but does not appear in a header file.
5503 exportheadervar: <M:--++>
5504 A variable declaration is exported, but does not appear in a header file.
5505 (Used with exportheader.)
5507 A field is present in a structure type but never used. Use /*@unused@*/ in
5508 front of field declaration to suppress message.
5509 enummemuse: <M:-+++>
5510 A member of an enum type is never used.
5512 A constant is declared but not used. Use unused in the constant declaration
5513 to suppress message.
5515 A function is declared but not used. Use /*@unused@*/ in front of function
5516 header to suppress message.
5518 A function parameter is not used in the body of the function. If the
5519 argument is needed for type compatibility or future plans, use /*@unused@*/
5520 in the argument declaration.
5522 A type is declared but not used. Use /*@unused@*/ in front of typedef to
5525 A variable is declared but never used. Use /*@unused@*/ in front of
5526 declaration to suppress message.
5527 unusedspecial: <M:---+>
5528 Unused declaration in special file (corresponding to .l or .y file).
5531 ===================================
5533 A function or variable is declared, but not defined in any source code file.
5535 A function or variable is declared in an .lcl file, but not defined in any
5538 A function or variable is declared in an .lcl file, but not declared in any
5542 ===================================
5544 There is a new declaration that is not declared in a loaded library or
5545 earlier file. (Use this flag to check for consistency against a library.)
5548 ===================================
5550 There is information in the specification that is not duplicated in
5551 syntactic comments. Normally, this is not an error, but it may be useful to
5552 detect it to make sure checking incomplete systems without the
5553 specifications will still use this information.
5556 ===================================
5558 Do not load standard library.
5560 Library based on the ISO standard library specification is used.
5562 Stricter version of the standard library is used. (The default library is
5563 standard.lcd; strict library is strict.lcd.)
5565 UNIX version of the standard library is used.
5566 unixstrictlib: <G><P:->
5567 strict version of the UNIX library is used.
5569 POSIX version of the standard library is used.
5570 posixstrictlib: <G><P:->
5571 POSIX version of the strict standard library is used.
5573 Show standard library filename.
5574 warnposixheaders: <P:+>
5575 Header name matches a POSIX header, but the POSIX library is not selected.
5577 Unix library may not be compatible with all platforms
5579 Header <varargs.h> is not part of ANSI Standard. Should use <stdarg.h>
5581 dump <filename>: <G><P:->
5582 Save state for merging (default suffix .lcd).
5583 load <filename>: <G><P:->
5584 Load state from dump file (default suffix .lcd).
5587 ===================================
5588 singleinclude: <G><P:->
5589 When checking multiple files, each header file is processed only once. This
5590 may change the meaning of the code, if the same header file is included in
5591 different contexts (e.g., the header file includes #if directives and the
5592 values are different when it is included in different places.)
5593 neverinclude: <G><P:->
5594 Ignore header includes. Only works if relevant information is loaded from a
5596 skipsysheaders: <G><P:->
5597 Do not include header files in system directories (set by -sysdirs)
5600 ===================================
5601 gnuextensions: <P:+>
5602 ANSI C does not allow some language features supported by gcc and other
5603 compilers. Use +gnuextensions to allow some of these extensions.
5606 ===================================
5608 A function declaration does not have a parameter list.
5610 Function definition is in old style syntax. Standard prototype syntax is
5614 ===================================
5616 The function main does not match the expected type.
5618 The argument to exit should be 0, EXIT_SUCCESS or EXIT_FAILURE
5621 ===================================
5623 An outer declaration is shadowed by the local declaration.
5624 incondefslib: <M:-+++>
5625 A function, variable or constant previously defined in a library is
5626 redefined with a different type.
5628 A function, variable or constant defined in the library is redefined with a
5630 nestedextern: <M:-+++>
5631 An extern declaration is used inside a function scope.
5633 A function or variable is declared in more than one place. This is not
5634 necessarily a problem, since the declarations are consistent.
5636 A function or variable is redefined. One of the declarations should use
5639 A variable declaration has no explicit type. The type is implicitly int.
5642 ===================================
5643 tmpdir <directory> [/tmp/]: <G><P:->
5644 Set directory for writing temp files.
5645 larchpath <path> [.:/usr/local/share/splint/lib:/af9/drl7x/reTmp/LCLintDev/lib:]
5647 Set path for searching for library files (overrides LARCH_PATH environment
5649 lclimportdir <directory> [.:/usr/local/share/splint/imports:/af9/drl7x/reTmp/LCL
5650 intDev/imports]: <G><P:->
5651 Set directory to search for LCL import files (overrides LCLIMPORTDIR).
5652 sysdirs <path> [/usr/]: <G><P:->
5653 Set directories for system files (default /usr/include). Separate
5654 directories with path separator (colons in Unix, semi-colons in Windows).
5655 Flag settings propagate to files in a system directory. If -sysdirerrors is
5656 set, no errors are reported for files in system directories..
5657 skipansiheaders: <P:+>
5658 Prevent inclusion of header files in a system directory with names that
5659 match standard ANSI headers. The symbolic information in the standard
5660 library is used instead. Flag in effect only if a library including the
5661 ANSI library is loaded. The ANSI headers are:
5662 assert, ctype, errno, float, limits, locale, math, setjmp, signal, stdarg,
5663 stddef, stdio, stdlib, strings, string, time, and wchar..
5664 skipposixheaders: <P:+>
5665 Prevent inclusion of header files in a system directory with names that
5666 match standard POSIX headers. The symbolic information in the posix library
5667 is used instead. The POSIX headers are:
5668 dirent, fcntl, grp, pwd, termios, sys/stat, sys/times, sys/types,
5669 sys/utsname, sys/wait, unistd, and utime..
5670 sysdirerrors: <M:---+>
5671 Report errors in files in system directories (set by -sysdirs).
5672 sysdirexpandmacros: <P:+>
5673 Expand macros in system directories regardless of other settings, except for
5674 macros corresponding to names defined in a load library.
5675 I<directory>: <G><P:->
5676 Add to C include path.
5677 S<directory>: <G><P:->
5681 ===================================
5683 A variable, function or type is exported, but not specified.
5685 A function is exported, but not specified.
5686 exportmacro: <M:---+>
5687 A macro is exported, but not specified.
5688 exporttype: <M:---+>
5689 A type is exported, but not specified.
5691 A variable is exported, but not specified.
5692 exportconst: <M:---+>
5693 A constant is exported, but not specified.
5694 exportiter: <M:---+>
5695 A constant is exported, but not specified.
5698 ===================================
5699 linelen <number> [80]: <P:->
5700 Set length of messages (number of chars).
5701 indentspaces <number> [3]: <P:->
5702 Set number of spaces to indent sub-messages.
5704 Show column number where error is found.
5705 parenfileformat: <P:->
5706 Show column number where error is found.
5708 Show name of function containing error.
5710 When a library function is declared with multiple possible type, the
5711 alternate types are shown only if +showallconjs.
5714 ===================================
5716 Make all alternate types implicit (useful for making system libraries.
5719 ===================================
5720 expect <number> [0]: <G><P:->
5721 Expect <int> code errors.
5722 lclexpect <number> [0]: <G><P:->
5723 Expect <int> spec errors.
5724 partial: <-><S><P:->
5725 Check as partial system (-specundef, -declundef, -exportlocal, don't check
5726 macros in headers without corresponding .c files).
5729 ===================================
5733 Generate .lcs files.
5736 ===================================
5738 Command line sets flag in abnormal way
5740 There was a problem reading an initialization file
5742 A flag is not recognized or used in an incorrect way
5743 fileextensions: <P:+>
5744 Warn when command line file does not have a recognized extension.
5749 ===================================
5750 f <filename>: <G><P:->
5751 Read an options file (instead of loading default ~/.splintc)
5752 i <filename>: <G><P:->
5753 Set LCL initilization file.
5755 Do not read the default options file (~/.splintrc)
5756 commentchar <character> [@]: <P:->
5757 Set the marker character for syntactic comments. Comments beginning with
5758 /*<char> are interpreted by Splint, where <char> is the comment marker
5762 ===================================
5763 controlnestdepth <number> [63]: <M:---+>
5764 Maximum number of control levels exceeded.
5765 stringliterallen <number> [4095]: <M:---+>
5766 Maximum length of string literal exceeded.
5767 numstructfields <number> [1023]: <M:---+>
5768 Maximum number of fields in a struct or union exceeded.
5769 numenummembers <number> [1023]: <M:---+>
5770 Limit on maximum number of members of an enum is exceeded.
5771 includenest <number> [63]: <M:--++>
5772 Maximum number of nested #include files exceeded.
5773 ansi89limits: <S><P:->
5774 Check for violations of standard limits (controlnestdepth, stringliterallen,
5775 includenest, numstructfields, numenummembers) based on ANSI89 standard.
5776 iso99limits: <S><P:->
5777 Check for violations of standard limits (controlnestdepth, stringliterallen,
5778 includenest, numstructfields, numenummembers) based on ISO99 standard.
5781 ===================================
5782 D<initializer>: <G><P:->
5783 Passed to pre-processor.
5784 U<initializer>: <G><P:->
5785 Passed to pre-processor.
5786 unrecogdirective: <P:+>
5787 Pre-processor directive is not recognized.
5790 ===================================
5792 The number of errors detected does not match number in /*@i<n>@*/..
5793 limit <number> [-1]: <P:->
5794 Limit <int> consecutive repeated errors.
5797 ===================================
5799 Code cannot be parsed. For help on parse errors, see splint -help
5802 Try to recover from parse error. It really means try - this doesn't usually
5805 Preprocessing error.
5808 ===================================
5810 Types are incompatible.
5811 stringliteraltoolong: <P:+>
5812 A string literal is assigned to a char array too small to hold it.
5813 stringliteralnoroom: <M:-+++>
5814 A string literal is assigned to a char array that is not big enough to hold
5815 the null terminator.
5816 stringliteralsmaller: <M:--++>
5817 A string literal is assigned to a char array that smaller than the string
5819 enummembers: <M:---->
5820 Type of initial values for enum members must be int.
5822 Type of parameter is not consistent with corresponding code in format
5824 formatconst: <M:-+++>
5825 Format parameter is not known at compile-time. This can lead to security
5826 vulnerabilities because the arguments cannot be type checked.
5828 Format code in a format string is not valid.
5831 ===================================
5832 forwarddecl: <M:+--->
5833 Forward declarations of pointers to abstract representation match abstract
5835 voidabstract: <M:+--->
5836 A pointer to void is cast to a pointer to an abstract type (or vice versa).
5838 A pointer to a function is cast to (or used as) a pointer to void (or vice
5841 To allow char types to index arrays, use +charindex.
5843 To allow enum types to index arrays, use +enumindex.
5845 To make bool and int types equivalent, use +boolint.
5847 To make char and int types equivalent, use +charint.
5849 To make enum and int types equivalent, use +enumint.
5850 floatdouble: <M:+--->
5851 To make float and double types equivalent, use +floatdouble.
5852 ignorequals: <M:---->
5853 To ignore type qualifiers in type comparisons use +ignorequals.
5854 duplicatequals: <P:+>
5855 Duplicate type qualifiers not supported by ISO standard.
5856 ignoresigns: <M:---->
5857 To ignore signs in type comparisons use +ignoresigns
5858 numliteral: <M:++-->
5859 An int literal is used as any numeric type (including float and long long).
5860 Use +numliteral to allow int literals to be used as any numeric type.
5861 charintliteral: <M:+--->
5862 A character constant is used as an int. Use +charintliteral to allow
5863 character constants to be used as ints. (This is safe since the actual type
5864 of a char constant is int.)
5865 relaxquals: <M:++-->
5866 To allow qualifier mismatches that are not dangerous, use +relaxquals.
5867 relaxtypes: <M:---->
5868 To allow all numeric types to match, use +relaxtypes.
5869 charunsignedchar: <M:+--->
5870 To allow char and unsigned char types to match use +charunsignedchar.
5871 matchanyintegral: <M:---->
5872 To allow arbitrary integral types to match any integral type, use
5874 longunsignedintegral: <M:+--->
5875 To allow arbitrary integral types to match long unsigned, use
5876 +longunsignedintegral.
5877 longintegral: <M:---->
5878 To allow arbitrary integral types to match long unsigned, use +longintegral.
5879 longunsignedunsignedintegral: <M:+--->
5880 To allow arbitrary unsigned integral types to match long unsigned, use
5881 +longunsignedunsignedintegral.
5882 longsignedintegral: <M:---->
5883 To allow arbitrary signed integral types to match long unsigned, use
5884 +longsignedintegral.
5886 Tread 0 as a pointer.
5888 Treat 0 as a boolean.
5891 ===================================
5892 repeatunrecog: <P:->
5893 Identifier used in code has not been declared. (Message repeated for future
5896 Identifier used in code has not been declared. (Message repeated for future
5897 uses in this file.) Use +gnuextensions to make Splint recognize some
5898 keywords that are gnu extensions.
5900 Identifier used in code has not been declared.
5903 ===================================
5904 annotationerror: <P:+>
5905 A declaration uses an invalid annotation.
5907 A syntactic comment is used inconsistently.
5910 ===================================
5912 Declaration marked with warn clause is used (can be suppresed by more
5914 bufferoverflow: <M:-+++>
5915 Use of function that may lead to buffer overflow.
5916 bufferoverflowhigh: <M:++++>
5917 Use of function that may lead to buffer overflow.
5918 implementationoptional: <M:--++>
5919 Use of a declarator that is implementation optional, not required by ISO99.
5921 Use of a declarator that is marked as a legacy entry in the Unix Standard.
5922 multithreaded: <M:--++>
5923 Non-reentrant function should not be used in multithreaded code.
5924 portability: <M:--++>
5925 Use of function that may have implementation-dependent behavior.
5927 Call to function restricted to superusers.
5929 Possible time of check, time of use vulnerability.
5930 unixstandard: <M:---->
5931 Use of function that need not be provided by UNIX implementations
5934 ===================================
5935 its4mostrisky: <S><P:->
5936 Security vulnerability classified as most risky in its4 database.
5937 its4veryrisky: <S><P:->
5938 Security vulnerability classified as very risky in its4 database.
5940 Security vulnerability classified as risky in its4 database.
5941 its4moderate: <S><P:->
5942 Security vulnerability classified as moderate risk in its4 database.
5944 Security vulnerability classified as risky in its4 database.
5947 ===================================
5949 Ignore all stylized comments.
5951 Ignore access comments.
5952 unrecogcomments: <P:+>
5953 Word after a stylized comment marker does not correspond to a stylized
5955 unrecogflagcomments: <P:+>
5956 Semantic comment attempts to set a flag that is not recognized.
5957 tmpcomments: <M:---->
5958 Interpret t comments (ignore errors in lines marked with /*@t<n>@*/.
5960 Interpret traditional lint comments (/*FALLTHROUGH*/, /*NOTREACHED*/).
5961 warnlintcomments: <M:-+++>
5962 A traditional lint comment is used. Some traditional lint comments are
5963 interpreted by Splint to enable easier checking of legacy code. It is
5964 preferable to replace these comments with the suggested Splint alternative.
5967 ===================================
5968 continuecomment: <P:->
5969 A line continuation marker (\) appears inside a comment on the same line as
5970 the comment close. Preprocessors should handle this correctly, but it causes
5971 problems for some preprocessors.
5972 slashslashcomment: <P:->
5973 A // comment is used. ISO C99 allows // comments, but earlier standards did
5976 A comment open sequence (/*) appears within a comment. This usually means
5977 an earlier comment was not closed.
5980 ===================================
5982 Suppress herald and error count.
5984 Send error messages to standard error (instead of standard out).
5986 Show summary of all errors reported and suppressed.
5988 Show file names are they are processed.
5990 Display lines processed and time.
5992 Display time distribution.
5993 showalluses: <G><P:->
5994 Show sorted list of uses of all globals.
5997 ===================================
5999 Provide a hint the first time a particular warning appears
6001 Provide a hint for every warning
6004 ===================================
6005 bugslimit <number> [3]: <P:->
6006 Set maximum number of bugs detected before giving up.
6007 debugfcnconstraint: <M:---->
6008 Perform buffer overflow checking even if the errors would be surpressed.
6009 grammar: <-><S><P:->
6012 Do not delete temporary files.
6014 Do not pre-process input files.
6015 showsourceloc: <-><P:->
6016 Display the source code location where a warning is produced.
andersk / splint.git / blob