Created new html version of the manual by manually editing the html of the new html...

diff --git a/doc/faq.txt b/doc/faq.txt
index 05c26782df46e9784f1978cb936c6fe8e070fe47..f52de36e2e558d791a292a6d07a803aa9de5a7de 100644 (file)
--- a/doc/faq.txt
+++ b/doc/faq.txt
@@ -1,154 +1,153 @@
-What is the difference between Splint and LCLint?
-
-Before 2002, Splint was known as LCLint. Splint 3.0 is the successor to LCLint 2.5.
-
-LCLint was originally named for LCL, the Larch C Interface Language and lint, a well-known C program checking tool. Because our tool has diverged from LCL, and our focus now is on secure programming, it was renamed Splint. Splint's name has (at least) three interpretations: specifications lint, secure programming lint, and first aid for programmers. Its also easier to pronounce than LCLint.
-
-What is the Splint logo?
-
-Thomas Jefferson's Serpentine Walls at the University of Virginia. The walls are one brick thick, but because of their design are both strong and aesthetic. Like a secure program, secure walls depend on sturdy bricks, solid construction, and elegant and principled design.
-
-Can I include Splint in my software distribution?
-
-Yes. Splint is licensed under the GNU General Public License. You may redistributed it as you wish so long as credits and pointers to www.splint.org are not changed or removed. Splint may be included in commercial distributions, and is included in several Linux and freeware CDs. If you redistribute Splint, please let us know by sending a message to splint@cs.virginia.edu.
-
-Can we use your software in our company?  (We are not a GNU organization.)
-
-Yes, splint is GPL-licensed.  Anyone may use it.  If you want to
-redistribute it, check the license for details or contact us.
-
-Does Splint handle C++?
-
-No. Splint handles ISO C99 (and some gcc extensions if +gnuextensions is used). We don't have the resources (or the research justification) to build a C++ front end, but if you are interested in building a C++ front end the source code is available, and I will certainly be willing to help.
-
-I downloaded the Splint tgz file but can't figure out how to extract it.  There is no 'z' option on the tar on my system.
-
-Check to see if there is GNU tar on your system, it is usually invoked by the command gtar or gnutar.  GNU tar supports the -z option.
-
-You can also unzip the file then untar it.  Do: gunzip filename.tar.gz to unzip then tar -xvf filename.tar
-
-I want to use Splint in win2000.  How do I do that?
-
-See www.splint.org for information on Splint.
-http://www.splint.org/win32.html for Windows instructions.
-
-I have installed Splint for Windows 2000.  Where should I put the ".splintrc" file?
-
- For Win32, Splint looks for splint.rc instead of .splintrc due to the DOS
-filename problems.  It will look first in the current directory, then in
-your home directory.  See the Splint manual for more information.
-
-Which compilers does Splint support?
-
-It is independent from your compiler.
-
-How does Splint handle const?
-
-Splint doesn't interpret const (at all).  See the manual section on
-modifies checking (http://www.splint.org/manual/html/sec7.html).
-
-Why do I get a warning when multiplying different integer types?  The C standard says this is ok.  Why is this wrong?
-
-There are lots of things that the C spec allows and defines clearly, that 
-Splint will provide warnings for.  It's not a question of it being "wrong",
-it's a matter of it being likely to reveal a programming mistake.
-
-The C standard says that what I'm doing is okay. Why does Splint give me a warning?
-
-See the previous question.
-
-Splint complains if I ignore the return value of scanf but not printf?
-
-This is just a strategic decision --- we view ignoring the result of a
-scanf to be more likely to reveal a problem with the code than ignoring
-the result of a printf, even though strict programmers will want to check
-printf also.
-
-If you want stricter checking use the flags  +ansistrictlib, +posixstrictlib, +unixstrictlib to select the strict versions of these libraries.
-
-I develop code on an embedded system with a compiler that uses nonstandard key words and data types.  I would like run Splint on my code but these nonstandard keywords cause parse errors.  What should I do?
-
-You can often use -D to solve this problem.
-
-If you just want to ignore a keyword, you can add
-
--Dnonstandardkeyword=
-
-to make the preprocessor eliminate the keyword, where nonstandardkeyword is the name of the keyword.  Similarly, you can use
--Dspecialtype=int
-to make a custom type parse as an int.
-
-How can I get Splint to recognize directory trees and local source include directories?  I've tried putting them in my path but it doesn't seem to look beyond the current directory.
-
-You can use -I to set the include path like you would with a compiler.
-
-I heard that we will get lot of parse errors when we run this tool first time. Hence we need to modify source code. Is it correct ?
-
-Usually not, but Splint doesn't support all C99 extensions.
-
-I heard that Splint can generate some spurious errors ( not genuine errors).  Is it correct ?
-
-Yes, please see www.splint.org for details.
-
-When I build Splint I get the following error:
-
- Checking for...
- Checking manual...
-cmx   > / Checking tests2.2...
- Checking tests2.4...
- Checking tests2.5...
- Checking db1...
- 0a1,2
- > /cmx/tools/make -e clean
- > /cmx/tools/make -e check
- *** FAIL ***
- Checking db2...
- 0a1,/tools/make -e clean
- > /cmx/tools/make -e check
- *** FAIL ***
- Checking db3...
-
-Should I be worried?
- 
-Those diffs look harmless.  It is likely that your make is set up slightly differently than ours.
-
-I just installed Splint on a new machine.  I get a bunch of errors during building when the test suite is run.  When I look through the results, it seems like Splint is not reporting any errors in the code it analyzes.  What is going on?
-
-One possibility is that the installation directory where the test suite is
-running is on the system path (hence, splint won't report errors if
--sysdirerrors is set, as it is by default).  Try adding +sysdirerrors to
-the command line for the test suite to see if that is the problem, or installing Splint in a different directory not in the system path.
-
-
-I get parse errors when I try to run Splint on code like #define MACROdebug(...) blahblah .  Can I use variadic macros in Splint?
-
-Sorry, Splint doesn't yet support variadic macros. We hope to fix this in a future release.
-
-I use realloc in my code.  How can I get Splint in check this code more effectively?
-
-realloc has complicated semantics that make it difficult to use correctly.  Make sure that you understand realloc and that you need to use it.
-
-If you decide to use realloc, we recommend that you wrapper it.  The document Using Wrapper Functions explains how to do this.  That document is included in the Splint documentation and is also available at:
-HTTP://INSERT_A_VALID_URL_WHEN_THE_document_is_ready.
-
-I think I've found a bug in Splint what should I do?
-
-See http://www.splint.org/bugs.html for a list of known bugs and instructions on reporting bugs.
-
-Splint tells me that there is a bug and I should report it.  What information should I send?
-
-Ideally we would like enough code to reproduce the problem.  Small snipits of code which trigger the bug are the best but more code is also acceptable.
-
-If we're not able to reproduce the problem, then we are unlikely to be able to patch Splint.  However, we would still appreciate hearing about the bug and may be able to at least to offer you advice on working around the problem.
-
-My question isn't answered here.  How can I get more information about Splint?
-
-First check the Splint manual and the mailing list archives.
-
-The Splint manual is available at: http://www.splint.org/manual/
-The mailing list archives are at:
-http://www.mail-archive.com/lclint-interest%40virginia.edu/
-
-If you're still unable to find the information to answer your question, you can try posting the question to the splint-discuss mailing list (see http://www.splint.org/lists.html)
-
-You can also email us at splint@splint.org.
+What is the difference between Splint and LCLint?\r
+\r
+Before 2002, Splint was known as LCLint. Splint 3.0 is the successor to LCLint 2.5.\r
+\r
+LCLint was originally named for LCL, the Larch C Interface Language and lint, a well-known C program checking tool. Because our tool has diverged from LCL, and our focus now is on secure programming, it was renamed Splint. Splint's name has (at least) three interpretations: specifications lint, secure programming lint, and first aid for programmers. It's also easier to pronounce than LCLint.\r
+\r
+What is the Splint logo?\r
+\r
+Thomas Jefferson's Serpentine Walls at the University of Virginia. The walls are one brick thick, but because of their design are both strong and aesthetic. Like a secure program, secure walls depend on sturdy bricks, solid construction, and elegant and principled design.\r
+\r
+Can I include Splint in my software distribution?\r
+\r
+Yes. Splint is licensed under the GNU General Public License. You may redistribute it as you wish so long as credits and pointers to www.splint.org are not changed or removed. Splint may be included in commercial distributions, and is included in several Linux and freeware CDs. If you redistribute Splint, please let us know by sending a message to splint@cs.virginia.edu.\r
+\r
+Can we use your software in our company?  (We are not a GNU organization.)\r
+\r
+Yes, splint is GPL-licensed.  Anyone may use it.  If you want to\r
+redistribute it, check the license for details or contact us.\r
+\r
+Does Splint handle C++?\r
+\r
+No. Splint handles ISO C99 (and some gcc extensions if +gnuextensions is used). We don't have the resources (or the research justification) to build a C++ front end, but if you are interested in building a C++ front end the source code is available, and I will certainly be willing to help.\r
+\r
+I downloaded the Splint .tgz file but can't figure out how to extract it.  There is no 'z' option on the tar on my system.\r
+\r
+Check to see if there is GNU tar on your system, it is usually invoked by the command gtar or gnutar.  GNU tar supports the -z option.\r
+\r
+You can also unzip the file then untar it.  Do: gunzip filename.tar.gz to unzip then tar -xvf filename.tar\r
+\r
+I want to use Splint in win2000.  How do I do that?\r
+\r
+See www.splint.org for information on Splint.\r
+http://www.splint.org/win32.html for Windows instructions.\r
+\r
+I have installed Splint for Windows 2000.  Where should I put the ".splintrc" file?\r
+\r
+ For Win32, Splint looks for splint.rc instead of .splintrc due to the DOS\r
+filename problems.  It will look first in the current directory, then in\r
+your home directory.  See the Splint manual for more information.\r
+\r
+Which compilers does Splint support?\r
+\r
+It is independent from your compiler.\r
+\r
+How does Splint handle const?\r
+\r
+Splint doesn't interpret const (at all).  See the manual section on\r
+modifies checking (http://www.splint.org/manual/html/sec7.html).\r
+\r
+Why do I get a warning when multiplying different integer types?  The C standard says this is ok.  Why is this wrong?\r
+\r
+There are lots of things that the C spec allows and defines clearly, that \r
+Splint will provide warnings for.  It's not a question of it being "wrong",\r
+it's a matter of it being likely to reveal a programming mistake.\r
+\r
+The C standard says that what I'm doing is okay. Why does Splint give me a warning?\r
+\r
+See the previous question.\r
+\r
+Splint complains if I ignore the return value of scanf but not printf?\r
+\r
+This is just a strategic decision --- we view ignoring the result of a\r
+scanf to be more likely to reveal a problem with the code than ignoring\r
+the result of a printf, even though strict programmers will want to check\r
+printf also.\r
+\r
+If you want stricter checking, use the flags  +ansistrictlib, +posixstrictlib, +unixstrictlib to select the strict versions of these libraries.\r
+\r
+I develop code on an embedded system with a compiler that uses nonstandard key words and data types.  I would like to run Splint on my code but these nonstandard keywords cause parse errors.  What should I do?\r
+\r
+You can often use -D to solve this problem.\r
+\r
+If you just want to ignore a keyword, you can add\r
+\r
+-Dnonstandardkeyword=\r
+\r
+to make the preprocessor eliminate the keyword, where nonstandardkeyword is the name of the keyword.  Similarly, you can use\r
+-Dspecialtype=int\r
+to make a custom type parse as an int.\r
+\r
+How can I get Splint to recognize directory trees and local source include directories?  I've tried putting them in my path but it doesn't seem to look beyond the current directory.\r
+\r
+You can use -I to set the include path like you would with a compiler.\r
+\r
+I heard that we will get lot of parse errors when we run this tool first time. Hence we need to modify source code. Is it correct ?\r
+\r
+Usually not, but Splint doesn't support all C99 extensions.\r
+\r
+I heard that Splint can generate some spurious errors ( not genuine errors).  Is it correct ?\r
+\r
+Yes, please see www.splint.org for details.\r
+\r
+When I build Splint I get the following error:\r
+\r
+ Checking for...\r
+ Checking manual...\r
+cmx   > / Checking tests2.2...\r
+ Checking tests2.4...\r
+ Checking tests2.5...\r
+ Checking db1...\r
+ 0a1,2\r
+ > /cmx/tools/make -e clean\r
+ > /cmx/tools/make -e check\r
+ *** FAIL ***\r
+ Checking db2...\r
+ 0a1,/tools/make -e clean\r
+ > /cmx/tools/make -e check\r
+ *** FAIL ***\r
+ Checking db3...\r
+\r
+Should I be worried?\r
+ \r
+Those diffs look harmless.  It is likely that your make is set up slightly differently than ours.\r
+\r
+I just installed Splint on a new machine.  I get a bunch of errors during building when the test suite is run.  When I look through the results, it seems like Splint is not reporting any errors in the code it analyzes.  What is going on?\r
+\r
+One possibility is that the installation directory where the test suite is\r
+running is on the system path (hence, splint won't report errors if\r
+-sysdirerrors is set, as it is by default).  Try adding +sysdirerrors to\r
+the command line for the test suite to see if that is the problem, or installing Splint in a different directory not in the system path.\r
+\r
+I get parse errors when I try to run Splint on code like #define MACROdebug(...) blahblah .  Can I use variadic macros in Splint?\r
+\r
+Sorry, Splint doesn't yet support variadic macros. We hope to fix this in a future release.\r
+\r
+I use realloc in my code.  How can I get Splint in check this code more effectively?\r
+\r
+realloc has complicated semantics that make it difficult to use correctly.  Make sure that you understand realloc and that you really need to use it.\r
+\r
+If you decide to use realloc, we recommend that you wrapper it.  The document Using Wrapper Functions explains how to do this.  That document is included in the Splint documentation and is also available at:\r
+http://www.splint.org/documentation/realloc.htm\r
+\r
+I think I've found a bug in Splint.  What should I do?\r
+\r
+See http://www.splint.org/bugs.html for a list of known bugs and instructions on reporting bugs.\r
+\r
+Splint tells me that there is a bug and I should report it.  What information should I send?\r
+\r
+Ideally we would like enough code to reproduce the problem.  Small snippets of code which trigger the bug are the best but more code is also acceptable.\r
+\r
+If we're not able to reproduce the problem, then we are unlikely to be able to patch Splint.  However, we would still appreciate hearing about the bug and may be able to at least to offer you advice on working around the problem.\r
+\r
+My question isn't answered here.  How can I get more information about Splint?\r
+\r
+First check the Splint manual and the mailing list archives.\r
+\r
+The Splint manual is available at: http://www.splint.org/manual/\r
+The mailing list archives are at:\r
+http://www.mail-archive.com/lclint-interest%40virginia.edu/\r
+\r
+If you're still unable to find the information to answer your question, you can try posting the question to the splint-discuss mailing list (see http://www.splint.org/lists.html)\r
+\r
+You can also email us at splint@splint.org.\r

diff --git a/doc/html/footer.html b/doc/html/footer.html
new file mode 100755 (executable)
index 0000000..9bdcb62
--- /dev/null
+++ b/doc/html/footer.html
@@ -0,0 +1,91 @@
+</blockquote>
+
+<table border="0" rules="none" bgcolor="#FFFFFF" width="95%" align=center cellpadding=0 cellspacing=0>
+
+<tr valign=top>
+<td colspan=2 bgcolor="darkblue"></td>
+<tr valign=top>
+<td colspan=2 bgcolor="darkblue"></td>
+<tr valign=top>
+<td colspan=2 bgcolor="white"></td>
+</tr>
+<tr valign=top>
+<td width=135 >
+<a href="http://www.splint.org"><img src="http://www.splint.org/glowingwall-narrows.jpg"
+width=132 height=65 border=0 alt=""></a>
+</td>
+<td>
+<table cellpadding=0 cellspacing=0 width="100%">
+<tr>
+<td colspan=2 bgcolor="slate"></td>
+</tr>
+<tr>
+<td>
+<font color="darkblue" face="arial,helvetica"><a href="http://www.splint.org/"><b>Splint</b> - Secure Programming Lint</a></font>
+</td>
+<td align=right>
+<font face="arial,helvetica,sans-serif"><font color="darkblue">
+<font size=-1>
+<a href="mailto:info@splint.org">info@splint.org</a></font>
+</font></font>
+</td>
+</tr>
+
+<tr>
+<td>
+<font face="arial,helvetica,sans-serif" size=-1>
+<a
+href="http://www.splint.org/download.html">Download</a>
+- 
+<A
+HREF="http://www.splint.org/documentation/">Documentation</a>
+-
+<a href="http://www.splint.org/manual/">Manual</a>
+-
+<a
+href="http://www.splint.org/links.html">Links</a><br>
+
+<a
+href="http://www.splint.org/source.html">Source</a>
+- 
+<A
+HREF="http://www.splint.org/linux.html">Linux</a>
+-
+<a href="http://www.splint.org/pubs.html">Publications</a>
+-
+<a
+href="http://www.splint.org/talks.html">Talks</a><br>
+
+</font>
+
+</td>
+<td align=right valign=top>
+
+<font face="arial,helvetica,sans-serif" size=-1>
+<a
+href="http://www.splint.org/bugs.html">Reporting
+Bugs</a> -
+<a
+href="http://www.splint.org/lists.html">Mailing
+Lists</a> &nbsp;&nbsp;<IMG src="http://sourceforge.net/sflogo.php?group_id=9538" width="0" height="0" alt="">
+
+&nbsp;&nbsp;
+<a
+href="http://www.splint.org/sponsors.html">Sponsors</a>
+-
+<a
+href="http://www.splint.org/credits.html">Credits</a>
+</font>
+</td>
+</tr>
+
+</table>
+
+</td>
+</tr>
+</table>
+
+</body>
+</html>
+
+

diff --git a/doc/html/header.html b/doc/html/header.html
new file mode 100755 (executable)
index 0000000..38ea981
--- /dev/null
+++ b/doc/html/header.html
@@ -0,0 +1,77 @@
+<table border="0" rules="none" bgcolor="#FFFFFF" width="95%" align=center cellpadding=0 cellspacing=0>
+<tr>
+<td colspan=2 bgcolor="#FFFFFF"></td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="#FFFFFF"></td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="#FFFFFF"></td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="#FFFFFF"></td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="#FFFFFF"></td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="#FFFFFF"></td>
+</tr>
+<tr>
+<td>
+<font color="darkblue" face="arial,helvetica"><a href="http://www.splint.org/"><b>Splint</b> - Secure Programming Lint</a><br></font>
+</td>
+<td align=right>
+<font face="arial,helvetica,sans-serif"><font color="darkblue">
+<font size=-1>
+<a href="mailto:info@splint.org">info@splint.org</a></font>
+</font></font>
+</td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="darkblue"></td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="darkblue"></td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="white"></td>
+</tr>
+<tr>
+<td colspan=2 bgcolor="slate"></td>
+</tr>
+<tr>
+<td>
+<font face="arial,helvetica,sans-serif" size=-1>
+<a
+href="http://www.splint.org/download.html">Download</a>
+- 
+<A
+HREF="http://www.splint.org/documentation/">Documentation</a>
+-
+<a href="http://www.splint.org/manual/">Manual</a>
+-
+<a
+href="http://www.splint.org/links.html">Links</a>
+</font>
+</td>
+<td align=right>
+<font face="arial,helvetica,sans-serif" size=-1>
+<a
+href="http://www.splint.org/bugs.html">Reporting
+Bugs</a> -
+<a
+href="http://www.splint.org/lists.html">Mailing
+Lists</a> &nbsp;&nbsp;&nbsp;&nbsp;
+<a
+href="http://www.splint.org/sponsors.html">Sponsors</a>
+-
+<a
+href="http://www.splint.org/credits.html">Credits</a>
+</font>
+</td>
+</tr>
+</table>
+
+<p>
+<blockquote>

diff --git a/doc/html/manual.htm b/doc/html/manual.htm
new file mode 100644 (file)
index 0000000..970207f
--- /dev/null
+++ b/doc/html/manual.htm
@@ -0,0 +1,18939 @@
+<html>
+<head>
+<meta content=
+"HTML Tidy for Solaris (vers 1st March 2003), see www.w3.org"
+      name="generator">
+<link rel="stylesheet" type="text/css" href=
+"../manual.css" title="style1">
+<title>Splint Manual</title>
+<style type="text/css">
+<!--
+ /* Font Definitions */
+ @font-face
+        {font-family:Helvetica;
+        panose-1:2 11 5 4 2 2 2 2 2 4;}
+@font-face
+        {font-family:Courier;
+        panose-1:2 7 4 9 2 2 5 2 4 4;}
+@font-face
+        {font-family:"Tms Rmn";
+        panose-1:2 2 6 3 4 5 5 2 3 4;}
+@font-face
+        {font-family:Helv;
+        panose-1:2 11 6 4 2 2 2 3 2 4;}
+@font-face
+        {font-family:"New York";
+        panose-1:2 4 5 3 6 5 6 2 3 4;}
+@font-face
+        {font-family:System;
+        panose-1:0 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Wingdings;
+        panose-1:5 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"MS Mincho";
+        panose-1:2 2 6 9 4 2 5 8 3 4;}
+@font-face
+        {font-family:Batang;
+        panose-1:2 3 6 0 0 1 1 1 1 1;}
+@font-face
+        {font-family:SimSun;
+        panose-1:2 1 6 0 3 1 1 1 1 1;}
+@font-face
+        {font-family:PMingLiU;
+        panose-1:2 1 6 1 0 1 1 1 1 1;}
+@font-face
+        {font-family:"MS Gothic";
+        panose-1:2 11 6 9 7 2 5 8 2 4;}
+@font-face
+        {font-family:Dotum;
+        panose-1:2 11 6 0 0 1 1 1 1 1;}
+@font-face
+        {font-family:SimHei;
+        panose-1:2 1 6 0 3 1 1 1 1 1;}
+@font-face
+        {font-family:MingLiU;
+        panose-1:2 1 6 9 0 1 1 1 1 1;}
+@font-face
+        {font-family:Mincho;
+        panose-1:2 2 6 9 4 3 5 8 3 5;}
+@font-face
+        {font-family:Gulim;
+        panose-1:2 11 6 0 0 1 1 1 1 1;}
+@font-face
+        {font-family:Century;
+        panose-1:2 4 6 3 5 7 5 2 3 3;}
+@font-face
+        {font-family:"Angsana New";
+        panose-1:2 2 6 3 5 4 5 2 3 4;}
+@font-face
+        {font-family:"Cordia New";
+        panose-1:2 11 3 4 2 2 2 2 2 4;}
+@font-face
+        {font-family:Mangal;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Latha;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Sylfaen;
+        panose-1:1 10 5 2 5 3 6 3 3 3;}
+@font-face
+        {font-family:Vrinda;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Raavi;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Shruti;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Sendnya;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Gautami;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Tunga;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"Estrangella Edessa";
+        panose-1:0 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"Arial Unicode MS";
+        panose-1:0 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Tahoma;
+        panose-1:2 11 6 4 3 5 4 4 2 4;}
+@font-face
+        {font-family:"Book Antiqua";
+        panose-1:2 4 6 2 5 3 5 3 3 4;}
+@font-face
+        {font-family:"Arial Narrow";
+        panose-1:2 11 5 6 2 2 2 3 2 4;}
+@font-face
+        {font-family:Times;
+        panose-1:0 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Marlett;
+        panose-1:0 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"News Gothic MT";
+        panose-1:2 11 5 4 2 2 3 2 2 4;}
+@font-face
+        {font-family:"Lucida Sans Unicode";
+        panose-1:2 11 6 2 3 5 4 2 2 4;}
+@font-face
+        {font-family:"Century Gothic";
+        panose-1:2 11 5 2 2 2 2 2 2 4;}
+@font-face
+        {font-family:"Abadi MT Condensed Light";
+        panose-1:2 11 3 6 3 1 1 1 1 3;}
+@font-face
+        {font-family:"Matisse ITC";
+        panose-1:4 4 4 3 3 13 2 2 7 4;}
+@font-face
+        {font-family:Westminster;
+        panose-1:4 4 5 6 3 15 2 2 7 2;}
+@font-face
+        {font-family:"Lucida Console";
+        panose-1:2 11 6 9 4 5 4 2 2 4;}
+@font-face
+        {font-family:"Arial Black";
+        panose-1:2 11 10 4 2 1 2 2 2 4;}
+@font-face
+        {font-family:"Comic Sans MS";
+        panose-1:3 15 7 2 3 3 2 2 2 4;}
+@font-face
+        {font-family:Verdana;
+        panose-1:2 11 6 4 3 5 4 4 2 4;}
+@font-face
+        {font-family:Webdings;
+        panose-1:5 3 1 2 1 5 9 6 7 3;}
+@font-face
+        {font-family:"Verdana Ref";
+        panose-1:2 11 6 4 3 5 4 4 2 4;}
+@font-face
+        {font-family:"Georgia Ref";
+        panose-1:2 4 5 2 5 4 5 2 3 3;}
+@font-face
+        {font-family:RefSpecialty;
+        panose-1:2 0 5 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"MS Reference 1";
+        panose-1:5 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"MS Reference 2";
+        panose-1:0 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:Money;
+        panose-1:0 0 4 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"Mediascape OSD Icon";
+        panose-1:2 11 6 3 5 3 2 2 2 4;}
+@font-face
+        {font-family:Pronto;
+        panose-1:2 11 7 3 3 0 0 0 0 7;}
+@font-face
+        {font-family:"Agency FB";
+        panose-1:0 1 6 6 4 0 0 4 0 3;}
+@font-face
+        {font-family:Algerian;
+        panose-1:4 2 7 5 4 10 2 6 7 2;}
+@font-face
+        {font-family:"Arial Rounded MT Bold";
+        panose-1:2 15 7 4 3 5 4 3 2 4;}
+@font-face
+        {font-family:"Baskerville Old Face";
+        panose-1:2 2 6 2 8 5 5 2 3 3;}
+@font-face
+        {font-family:"Bauhaus 93";
+        panose-1:4 3 9 5 2 11 2 2 12 2;}
+@font-face
+        {font-family:"Bell MT";
+        panose-1:2 2 5 3 6 3 5 2 3 3;}
+@font-face
+        {font-family:"Berlin Sans FB";
+        panose-1:2 14 6 2 2 5 2 2 3 6;}
+@font-face
+        {font-family:"Bernard MT Condensed";
+        panose-1:2 5 8 6 6 9 5 2 4 4;}
+@font-face
+        {font-family:"Blackadder ITC";
+        panose-1:4 2 5 5 5 16 7 2 13 2;}
+@font-face
+        {font-family:"Bookman Old Style";
+        panose-1:2 5 6 4 5 5 5 2 2 4;}
+@font-face
+        {font-family:"Bradley Hand ITC";
+        panose-1:3 7 4 2 5 3 2 3 2 3;}
+@font-face
+        {font-family:"Britannic Bold";
+        panose-1:2 11 9 3 6 7 3 2 2 4;}
+@font-face
+        {font-family:Broadway;
+        panose-1:4 4 9 5 8 11 2 2 5 2;}
+@font-face
+        {font-family:"Brush Script MT";
+        panose-1:3 6 8 2 4 4 6 7 3 4;}
+@font-face
+        {font-family:"Californian FB";
+        panose-1:2 7 4 3 6 8 11 3 2 4;}
+@font-face
+        {font-family:"Calisto MT";
+        panose-1:2 4 6 3 5 5 5 3 3 4;}
+@font-face
+        {font-family:Castellar;
+        panose-1:2 10 4 2 6 4 6 1 3 1;}
+@font-face
+        {font-family:Centaur;
+        panose-1:2 3 5 4 5 2 5 2 3 4;}
+@font-face
+        {font-family:"Century Schoolbook";
+        panose-1:2 4 6 4 5 5 5 2 3 4;}
+@font-face
+        {font-family:Chiller;
+        panose-1:4 2 4 4 3 16 7 2 6 2;}
+@font-face
+        {font-family:"Colonna MT";
+        panose-1:4 2 8 5 6 2 2 3 2 3;}
+@font-face
+        {font-family:"Cooper Black";
+        panose-1:2 8 9 4 4 3 11 2 4 4;}
+@font-face
+        {font-family:"Copperplate Gothic Bold";
+        panose-1:2 14 7 5 2 2 6 2 4 4;}
+@font-face
+        {font-family:"Copperplate Gothic Light";
+        panose-1:2 14 5 7 2 2 6 2 4 4;}
+@font-face
+        {font-family:"Curlz MT";
+        panose-1:4 4 4 4 5 7 2 2 2 2;}
+@font-face
+        {font-family:"Edwardian Script ITC";
+        panose-1:3 3 3 2 4 7 7 13 8 4;}
+@font-face
+        {font-family:Elephant;
+        panose-1:2 2 9 4 9 5 5 2 3 3;}
+@font-face
+        {font-family:"Engravers MT";
+        panose-1:2 9 7 7 8 5 5 2 3 4;}
+@font-face
+        {font-family:"Eras Bold ITC";
+        panose-1:2 11 9 7 3 5 4 2 2 4;}
+@font-face
+        {font-family:"Eras Demi ITC";
+        panose-1:2 11 8 5 3 5 4 2 8 4;}
+@font-face
+        {font-family:"Eras Light ITC";
+        panose-1:2 11 4 2 3 5 4 2 8 4;}
+@font-face
+        {font-family:"Eras Medium ITC";
+        panose-1:2 11 6 2 3 5 4 2 8 4;}
+@font-face
+        {font-family:"Felix Titling";
+        panose-1:4 6 5 5 6 2 2 2 10 4;}
+@font-face
+        {font-family:"Footlight MT Light";
+        panose-1:2 4 6 2 6 3 10 2 3 4;}
+@font-face
+        {font-family:Forte;
+        panose-1:3 6 9 2 4 5 2 7 2 3;}
+@font-face
+        {font-family:"Franklin Gothic Book";
+        panose-1:2 11 5 3 2 1 2 2 2 4;}
+@font-face
+        {font-family:"Franklin Gothic Demi";
+        panose-1:2 11 7 3 2 1 2 2 2 4;}
+@font-face
+        {font-family:"Franklin Gothic Demi Cond";
+        panose-1:2 11 7 6 3 4 2 2 2 4;}
+@font-face
+        {font-family:"Franklin Gothic Heavy";
+        panose-1:2 11 9 3 2 1 2 2 2 4;}
+@font-face
+        {font-family:"Franklin Gothic Medium";
+        panose-1:2 11 6 3 2 1 2 2 2 4;}
+@font-face
+        {font-family:"Franklin Gothic Medium Cond";
+        panose-1:2 11 6 6 3 4 2 2 2 4;}
+@font-face
+        {font-family:"Freestyle Script";
+        panose-1:3 8 4 2 3 2 5 11 4 4;}
+@font-face
+        {font-family:"French Script MT";
+        panose-1:3 2 4 2 4 6 7 4 6 5;}
+@font-face
+        {font-family:Garamond;
+        panose-1:2 2 4 4 3 3 1 1 8 3;}
+@font-face
+        {font-family:Gigi;
+        panose-1:4 4 5 4 6 16 7 2 13 2;}
+@font-face
+        {font-family:"Gill Sans MT";
+        panose-1:2 11 5 2 2 1 4 2 2 3;}
+@font-face
+        {font-family:"Gill Sans MT Condensed";
+        panose-1:2 11 5 6 2 1 4 2 2 3;}
+@font-face
+        {font-family:"Gill Sans Ultra Bold";
+        panose-1:2 11 10 2 2 1 4 2 2 3;}
+@font-face
+        {font-family:"Gill Sans Ultra Bold Condensed";
+        panose-1:2 11 10 6 2 1 4 2 2 3;}
+@font-face
+        {font-family:"Gill Sans MT Ext Condensed Bold";
+        panose-1:2 11 9 2 2 1 4 2 2 3;}
+@font-face
+        {font-family:"Gloucester MT Extra Condensed";
+        panose-1:2 3 8 8 2 6 1 1 1 1;}
+@font-face
+        {font-family:"Goudy Old Style";
+        panose-1:2 2 5 2 5 3 5 2 3 3;}
+@font-face
+        {font-family:"Goudy Stout";
+        panose-1:2 2 9 4 7 3 11 2 4 1;}
+@font-face
+        {font-family:Haettenschweiler;
+        panose-1:2 11 7 6 4 9 2 6 2 4;}
+@font-face
+        {font-family:"Harlow Solid Italic";
+        panose-1:4 3 6 4 2 15 2 2 13 2;}
+@font-face
+        {font-family:Harrington;
+        panose-1:4 4 5 5 5 10 2 2 7 2;}
+@font-face
+        {font-family:"High Tower Text";
+        panose-1:2 4 5 2 5 5 6 3 3 3;}
+@font-face
+        {font-family:"Imprint MT Shadow";
+        panose-1:4 2 6 5 6 3 3 3 2 2;}
+@font-face
+        {font-family:Jokerman;
+        panose-1:4 9 6 5 6 13 6 2 7 2;}
+@font-face
+        {font-family:"Juice ITC";
+        panose-1:4 4 4 3 4 10 2 2 2 2;}
+@font-face
+        {font-family:"Kristen ITC";
+        panose-1:3 5 5 2 4 2 2 3 2 2;}
+@font-face
+        {font-family:"Kunstler Script";
+        panose-1:3 3 4 2 2 6 7 13 13 6;}
+@font-face
+        {font-family:"Lucida Bright";
+        panose-1:2 4 6 2 5 5 5 2 3 4;}
+@font-face
+        {font-family:"Lucida Calligraphy";
+        panose-1:3 1 1 1 1 1 1 1 1 1;}
+@font-face
+        {font-family:"Lucida Fax";
+        panose-1:2 6 6 2 5 5 5 2 2 4;}
+@font-face
+        {font-family:"Lucida Handwriting";
+        panose-1:3 1 1 1 1 1 1 1 1 1;}
+@font-face
+        {font-family:"Lucida Sans";
+        panose-1:2 11 6 2 3 5 4 2 2 4;}
+@font-face
+        {font-family:"Lucida Sans Typewriter";
+        panose-1:2 11 5 9 3 5 4 3 2 4;}
+@font-face
+        {font-family:Magneto;
+        panose-1:4 3 8 5 5 8 2 2 13 2;}
+@font-face
+        {font-family:"Maiandra GD";
+        panose-1:2 14 5 2 3 3 8 2 2 4;}
+@font-face
+        {font-family:"Matura MT Script Capitals";
+        panose-1:3 2 8 2 6 6 2 7 2 2;}
+@font-face
+        {font-family:Mistral;
+        panose-1:3 9 7 2 3 4 7 2 4 3;}
+@font-face
+        {font-family:"Modern No\. 20";
+        panose-1:2 7 7 4 7 5 5 2 3 3;}
+@font-face
+        {font-family:"Niagara Engraved";
+        panose-1:4 2 5 2 7 7 3 3 2 2;}
+@font-face
+        {font-family:"Niagara Solid";
+        panose-1:4 2 5 2 7 7 2 2 2 2;}
+@font-face
+        {font-family:"OCR A Extended";
+        panose-1:2 1 5 9 2 1 2 1 3 3;}
+@font-face
+        {font-family:"Old English Text MT";
+        panose-1:3 4 9 2 4 5 8 3 8 6;}
+@font-face
+        {font-family:Onyx;
+        panose-1:4 5 6 2 8 7 2 2 2 3;}
+@font-face
+        {font-family:"Palace Script MT";
+        panose-1:3 3 3 2 2 6 7 12 11 5;}
+@font-face
+        {font-family:Papyrus;
+        panose-1:3 7 5 2 6 5 2 3 2 5;}
+@font-face
+        {font-family:Parchment;
+        panose-1:3 4 6 2 4 7 8 4 8 4;}
+@font-face
+        {font-family:Perpetua;
+        panose-1:2 2 5 2 6 4 1 2 3 3;}
+@font-face
+        {font-family:"Perpetua Titling MT";
+        panose-1:2 2 5 2 6 5 5 2 8 4;}
+@font-face
+        {font-family:Playbill;
+        panose-1:4 5 6 3 10 6 2 2 2 2;}
+@font-face
+        {font-family:"Poor Richard";
+        panose-1:2 8 5 2 5 5 5 2 7 2;}
+@font-face
+        {font-family:Pristina;
+        panose-1:3 6 4 2 4 4 6 8 2 4;}
+@font-face
+        {font-family:"Rage Italic";
+        panose-1:3 7 5 2 4 5 7 7 3 4;}
+@font-face
+        {font-family:Ravie;
+        panose-1:4 4 8 5 5 8 9 2 6 2;}
+@font-face
+        {font-family:Rockwell;
+        panose-1:2 6 6 3 2 2 5 2 4 3;}
+@font-face
+        {font-family:"Rockwell Condensed";
+        panose-1:2 6 6 3 5 4 5 2 1 4;}
+@font-face
+        {font-family:"Rockwell Extra Bold";
+        panose-1:2 6 9 3 4 5 5 2 4 3;}
+@font-face
+        {font-family:"Informal Roman";
+        panose-1:3 6 4 2 3 4 6 11 2 4;}
+@font-face
+        {font-family:"Script MT Bold";
+        panose-1:3 4 6 2 4 6 7 8 9 4;}
+@font-face
+        {font-family:"Showcard Gothic";
+        panose-1:4 2 9 4 2 1 2 2 6 4;}
+@font-face
+        {font-family:"Snap ITC";
+        panose-1:4 4 10 7 6 10 2 2 2 2;}
+@font-face
+        {font-family:Stencil;
+        panose-1:4 4 9 5 13 8 2 2 4 4;}
+@font-face
+        {font-family:"Tempus Sans ITC";
+        panose-1:4 2 4 4 3 13 7 2 2 2;}
+@font-face
+        {font-family:"Trebuchet MS";
+        panose-1:2 11 6 3 2 2 2 2 2 4;}
+@font-face
+        {font-family:"Tw Cen MT";
+        panose-1:2 11 6 2 2 1 4 2 6 3;}
+@font-face
+        {font-family:"Tw Cen MT Condensed";
+        panose-1:2 11 6 6 2 1 4 2 2 3;}
+@font-face
+        {font-family:"Viner Hand ITC";
+        panose-1:3 7 5 2 3 5 2 2 2 3;}
+@font-face
+        {font-family:Vivaldi;
+        panose-1:3 2 6 2 5 5 6 9 8 4;}
+@font-face
+        {font-family:"Vladimir Script";
+        panose-1:3 5 4 2 4 4 7 7 3 5;}
+@font-face
+        {font-family:"Wide Latin";
+        panose-1:2 10 10 7 5 5 5 2 4 4;}
+@font-face
+        {font-family:"Wingdings 2";
+        panose-1:5 2 1 2 1 5 7 7 7 7;}
+@font-face
+        {font-family:"Wingdings 3";
+        panose-1:5 4 1 2 1 8 7 7 7 7;}
+@font-face
+        {font-family:"Berlin Sans FB Demi";
+        panose-1:2 14 8 2 2 5 2 2 3 6;}
+@font-face
+        {font-family:"Tw Cen MT Condensed Extra Bold";
+        panose-1:2 11 8 3 2 0 0 0 0 4;}
+@font-face
+        {font-family:"Almanac MT";
+        panose-1:5 1 1 1 1 1 1 1 1 1;}
+@font-face
+        {font-family:"Beesknees ITC";
+        panose-1:4 4 10 5 5 13 2 2 5 2;}
+@font-face
+        {font-family:"Holidays MT";
+        panose-1:5 1 1 1 1 1 1 1 1 1;}
+@font-face
+        {font-family:"Monotype Sorts";
+        panose-1:1 1 6 1 1 1 1 1 1 1;}
+@font-face
+        {font-family:"Monotype Sorts 2";
+        panose-1:5 2 1 2 1 2 8 2 8 8;}
+@font-face
+        {font-family:"Pepita MT";
+        panose-1:3 6 4 2 4 5 2 7 8 4;}
+@font-face
+        {font-family:"Vacation MT";
+        panose-1:5 1 1 1 1 1 1 1 1 1;}
+@font-face
+        {font-family:"Map Symbols";
+        panose-1:0 5 1 2 1 7 6 2 5 7;}
+@font-face
+        {font-family:"Bookshelf Symbol 3";
+        panose-1:5 5 1 2 1 7 6 2 5 7;}
+@font-face
+        {font-family:Georgia;
+        panose-1:2 4 5 2 5 4 5 2 3 3;}
+@font-face
+        {font-family:"MS Outlook";
+        panose-1:5 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"Berling Antiqua";
+        panose-1:2 2 6 2 6 4 5 3 4 2;}
+@font-face
+        {font-family:Bookdings;
+        panose-1:5 0 0 0 0 0 0 0 0 0;}
+@font-face
+        {font-family:"Frutiger Linotype";
+        panose-1:2 11 6 4 3 5 4 4 2 4;}
+@font-face
+        {font-family:"Andale Mono";
+        panose-1:2 11 5 9 0 0 0 0 0 4;}
+@font-face
+        {font-family:Impact;
+        panose-1:2 11 8 6 3 9 2 5 2 4;}
+@font-face
+        {font-family:"Monotype Corsiva";
+        panose-1:3 1 1 1 1 2 1 1 1 1;}
+@font-face
+        {font-family:"MT Extra";
+        panose-1:5 5 1 2 1 2 5 2 2 2;}
+@font-face
+        {font-family:ProgramTwo;
+        panose-1:0 0 0 0 0 0 0 0 0 0;}
+ /* Style Definitions */
+ p.MsoNormal, li.MsoNormal, div.MsoNormal
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+h1
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        page-break-before:always;
+        page-break-after:avoid;
+        font-size:16.0pt;
+        font-family:"Times New Roman";}
+h2
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        page-break-after:avoid;
+        font-size:14.0pt;
+        font-family:"Times New Roman";}
+h3
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        page-break-after:avoid;
+        font-size:12.0pt;
+        font-family:"Times New Roman";}
+h4
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        page-break-after:avoid;
+        font-size:12.0pt;
+        font-family:"Times New Roman";}
+h5
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        font-size:11.0pt;
+        font-family:"Times New Roman";
+        font-weight:normal;}
+h6
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        font-size:11.0pt;
+        font-family:"Times New Roman";
+        font-weight:normal;
+        font-style:italic;}
+p.MsoHeading7, li.MsoHeading7, div.MsoHeading7
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        page-break-before:always;
+        page-break-after:avoid;
+        font-size:16.0pt;
+        font-family:"Times New Roman";
+        font-weight:bold;}
+p.MsoHeading8, li.MsoHeading8, div.MsoHeading8
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        page-break-after:avoid;
+        font-size:14.0pt;
+        font-family:"Times New Roman";
+        font-weight:bold;}
+p.MsoHeading9, li.MsoHeading9, div.MsoHeading9
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        text-indent:0in;
+        page-break-after:avoid;
+        font-size:12.0pt;
+        font-family:"Times New Roman";
+        font-weight:bold;}
+p.MsoIndex1, li.MsoIndex1, div.MsoIndex1
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:10.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndex2, li.MsoIndex2, div.MsoIndex2
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:20.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndex3, li.MsoIndex3, div.MsoIndex3
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:30.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndex4, li.MsoIndex4, div.MsoIndex4
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:40.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndex5, li.MsoIndex5, div.MsoIndex5
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:50.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndex6, li.MsoIndex6, div.MsoIndex6
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:60.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndex7, li.MsoIndex7, div.MsoIndex7
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:70.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndex8, li.MsoIndex8, div.MsoIndex8
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:80.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndex9, li.MsoIndex9, div.MsoIndex9
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:1.25in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-10.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoToc1, li.MsoToc1, div.MsoToc1
+        {margin-top:9.0pt;
+        margin-right:0in;
+        margin-bottom:4.0pt;
+        margin-left:0in;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";
+        font-weight:bold;}
+p.MsoToc2, li.MsoToc2, div.MsoToc2
+        {margin-top:4.0pt;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:.15in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoToc3, li.MsoToc3, div.MsoToc3
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:22.3pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoToc4, li.MsoToc4, div.MsoToc4
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:30.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoToc5, li.MsoToc5, div.MsoToc5
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:40.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoToc6, li.MsoToc6, div.MsoToc6
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:50.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoToc7, li.MsoToc7, div.MsoToc7
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:60.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoToc8, li.MsoToc8, div.MsoToc8
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:70.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoToc9, li.MsoToc9, div.MsoToc9
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:80.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:10.0pt;
+        font-family:"Times New Roman";}
+p.MsoCommentText, li.MsoCommentText, div.MsoCommentText
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:20.0pt;
+        font-family:"Times New Roman";}
+p.MsoHeader, li.MsoHeader, div.MsoHeader
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";
+        font-weight:bold;
+        font-style:italic;}
+p.MsoFooter, li.MsoFooter, div.MsoFooter
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:20.0pt;
+        font-family:"Times New Roman";}
+p.MsoIndexHeading, li.MsoIndexHeading, div.MsoIndexHeading
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoCaption, li.MsoCaption, div.MsoCaption
+        {margin-top:6.0pt;
+        margin-right:0in;
+        margin-bottom:6.0pt;
+        margin-left:0in;
+        text-align:center;
+        font-size:10.0pt;
+        font-family:"Times New Roman";
+        font-weight:bold;}
+p.MsoTof, li.MsoTof, div.MsoTof
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:22.0pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-22.0pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+span.MsoFootnoteReference
+        {vertical-align:super;}
+span.MsoPageNumber
+        {vertical-align:baseline;}
+p.MsoListBullet, li.MsoListBullet, div.MsoListBullet
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:12.95pt;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        text-indent:-12.95pt;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.MsoTitle, li.MsoTitle, div.MsoTitle
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:center;
+        font-size:16.0pt;
+        font-family:Arial;
+        font-weight:bold;}
+p.MsoSubtitle, li.MsoSubtitle, div.MsoSubtitle
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:center;
+        font-size:12.0pt;
+        font-family:Arial;}
+p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
+        {margin:0in;
+        margin-bottom:.0001pt;
+        line-height:200%;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+pre
+        {margin:0in;
+        margin-bottom:.0001pt;
+        font-size:10.0pt;
+        font-family:"Courier New";}
+p.TextFontCX, li.TextFontCX, div.TextFontCX
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.Appendix, li.Appendix, div.Appendix
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        page-break-after:avoid;
+        font-size:14.0pt;
+        font-family:"Times New Roman";
+        font-weight:bold;}
+p.Heading10, li.Heading10, div.Heading10
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        page-break-after:avoid;
+        font-size:12.0pt;
+        font-family:"Times New Roman";
+        letter-spacing:-.4pt;
+        font-weight:bold;}
+p.Heading11, li.Heading11, div.Heading11
+        {margin-top:12.0pt;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:justify;
+        page-break-after:avoid;
+        font-size:11.0pt;
+        font-family:"Times New Roman";
+        letter-spacing:-.4pt;
+        font-weight:bold;
+        font-style:italic;}
+span.Flag
+        {font-family:Tahoma;
+        }
+span.Annot
+        {font-family:Tahoma;
+        }
+span.PlainText
+        {font-family:"Courier New";}
+span.Keyword
+        {font-family:"Courier New";
+        }
+span.Line
+        {font-family:Arial;
+        font-style:italic;}
+span.implicit
+        {font-family:"Courier New";
+        color:gray;
+        font-style:italic;}
+span.HeadingNote
+        {font-family:"Times New Roman";
+        font-style:italic;}
+p.Author, li.Author, div.Author
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:3.0pt;
+        margin-left:0in;
+        text-align:center;
+        font-size:14.0pt;
+        font-family:Arial;
+        font-style:italic;}
+p.Verbatim, li.Verbatim, div.Verbatim
+        {margin:0in;
+        margin-bottom:.0001pt;
+        font-size:10.0pt;
+        font-family:"Courier New";
+        text-align:left}
+p.lclintrun, li.lclintrun, div.lclintrun
+        {margin:0in;
+        margin-bottom:.0001pt;
+        font-size:11.0pt;
+        font-family:"Arial Narrow";}
+p.IndentText, li.IndentText, div.IndentText
+        {margin-top:0in;
+        margin-right:.2in;
+        margin-bottom:0in;
+        margin-left:.2in;
+        margin-bottom:.0001pt;
+        text-align:left;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.beforelist, li.beforelist, div.beforelist
+        {margin-top:0in;
+        margin-right:0in;
+        margin-bottom:6.0pt;
+        margin-left:0in;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.example, li.example, div.example
+        {margin-top:6.0pt;
+        margin-right:.2in;
+        margin-bottom:6.0pt;
+        margin-left:.2in;
+        font-size:9.5pt;
+        font-family:"Courier New";
+        text-align=left}
+p.skiplist, li.skiplist, div.skiplist
+        {margin-top:6.0pt;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.afterlist, li.afterlist, div.afterlist
+        {margin-top:6.0pt;
+        margin-right:0in;
+        margin-bottom:0in;
+        margin-left:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.betweenlists, li.betweenlists, div.betweenlists
+        {margin-top:6.0pt;
+        margin-right:0in;
+        margin-bottom:6.0pt;
+        margin-left:0in;
+        text-align:justify;
+        font-size:11.0pt;
+        font-family:"Times New Roman";}
+p.indentbefore, li.indentbefore, div.indentbefore
+        {margin-top:0in;
+        margin-right:.2in;
+        margin-bottom:6.0pt;
+        margin-left:.2in;
+        font-size:11.0pt;
+        text-align:left;
+        font-family:"Times New Roman";}
+p.indentbefore0, li.indentbefore0, div.indentbefore0
+        {margin-top:0in;
+        margin-right:.2in;
+        margin-bottom:6.0pt;
+        margin-left:.2in;
+        font-size:11.0pt;
+        text-align:left;
+        font-family:"Times New Roman";}
+span.CodeText
+        {font-family:Arial;
+        }
+p.Sidebar, li.Sidebar, div.Sidebar
+        {margin:0in;
+        margin-bottom:.0001pt;
+        font-size:9.0pt;
+        font-family:"Times New Roman";}
+p.URL, li.URL, div.URL
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:10.0pt;
+        font-family:Arial;}
+span.StyleKeywordBold
+        {font-family:"Courier New";
+        color:white;
+        font-weight:bold;}
+p.ProgramName, li.ProgramName, div.ProgramName
+        {margin:0in;
+        margin-bottom:.0001pt;
+        text-align:justify;
+        font-size:10.0pt;
+        font-family:Arial;}
+span.Style1
+        {font-family:"Courier New";}
+span.ProgramNameChar
+        {font-family:Arial;}
+span.ProgramCode
+        {font-family:ProgramTwo;
+        }
+p.fileName, li.fileName, div.fileName
+        {margin-top:0in;
+        margin-right:.2in;
+        margin-bottom:0in;
+        margin-left:.2in;
+        margin-bottom:.0001pt;
+        font-size:10.0pt;
+        font-family:Arial;}
+p.FileName0, li.FileName0, div.FileName0
+        {margin-top:0in;
+        margin-right:.2in;
+        margin-bottom:0in;
+        margin-left:.2in;
+        margin-bottom:.0001pt;
+        font-size:10.0pt;
+        font-family:Arial;}
+span.FileNameChar
+        {font-family:Arial;}
+ins
+        {text-decoration:none;}
+span.msoIns
+        {text-decoration:underline;}
+span.msoDel
+        {text-decoration:line-through;
+        color:red;}
+ /* Page Definitions */
+ @page Section1
+        {size:8.5in 11.0in;
+        margin:1.0in 1.25in .75in 1.25in;}
+div.Section1
+        {page:Section1;}
+@page Section2
+        {size:8.5in 11.0in;
+        margin:1.0in 1.25in 1.0in 99.35pt;}
+div.Section2
+        {page:Section2;}
+@page Section3
+        {size:8.5in 11.0in;
+        margin:1.0in 1.25in 1.0in 99.35pt;}
+div.Section3
+        {page:Section3;}
+@page Section4
+        {size:8.5in 11.0in;
+        margin:1.0in 1.25in 1.0in 99.0pt;}
+div.Section4
+        {page:Section4;}
+@page Section5
+        {size:8.5in 11.0in;
+        margin:1.0in 1.25in 1.0in 1.25in;}
+div.Section5
+        {page:Section5;}
+@page Section6
+        {size:8.5in 11.0in;
+        margin:1.0in 1.25in 1.0in 1.25in;}
+div.Section6
+        {page:Section6;}
+@page Section7
+        {size:8.5in 11.0in;
+        margin:1.0in 1.25in 1.0in 1.25in;}
+div.Section7
+        {page:Section7;}
+@page Section8
+        {size:8.5in 11.0in;
+        margin:1.0in 1.25in 1.0in 1.25in;}
+div.Section8
+        {page:Section8;}
+ /* List Definitions */
+ ol
+        {margin-bottom:0in;}
+ul
+        {margin-bottom:0in;}
+-->
+</style>
+</head>
+<body>
+<!--#include virtual="header.html"-->
+<div class="Section1">
+<p class="MsoTitle"><img width="189" height="219" src=
+"manual-301_files/image001.jpg" hspace="12"><a name=
+"_Ref533872469"></a></p>
+<p class="MsoTitle"><a name="_Ref483663680"></a><span class=
+"MsoCommentReference"><span style=
+'font-size:20.0pt'>&nbsp;</span></span></p>
+<p class="MsoTitle"><span class=
+      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
+&nbsp;</span></span></p>
+<p class="MsoTitle"><span class=
+      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
+&nbsp;</span></span></p>
+<p class="MsoTitle"><span class=
+      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
+&nbsp;</span></span></p>
+<p class="MsoTitle"><span class=
+      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
+Splint Manual</span></span></p>
+<p class="MsoTitle"><span class=
+      "MsoCommentReference"><span style='font-size:26.0pt; font-family:"Book Antiqua"'>
+&nbsp;</span></span></p>
+<p class="MsoSubtitle"><span class=
+"MsoCommentReference"><span style=
+'font-size: 18.0pt;font-family:"Book Antiqua"'>Version
+3.0.1.7</span></span></p>
+<p class="MsoSubtitle"><span class=
+"MsoCommentReference"><span style=
+'font-size: 18.0pt;font-family:"Book Antiqua"'>17 March
+2003</span></span></p>
+<p class="MsoSubtitle"><span class=
+"MsoCommentReference"><span style=
+'font-size: 15.5pt'>&nbsp;</span></span></p>
+<p class="MsoSubtitle"><span class=
+"MsoCommentReference"><span style=
+'font-size: 15.5pt'>&nbsp;</span></span></p>
+<p class="MsoSubtitle"><span class=
+"MsoCommentReference"><span style=
+'font-size: 15.5pt'>&nbsp;</span></span></p>
+<p class="MsoNormal"><span class=
+      "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
+&nbsp;</span></span></p>
+<p class="MsoNormal"><span class=
+      "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
+&nbsp;</span></span></p>
+<p class="MsoNormal"><span class=
+      "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
+&nbsp;</span></span></p>
+<p class="MsoNormal"><span class=
+      "MsoCommentReference"><span style='font-size:14.0pt; font-family:"Book Antiqua"'>
+&nbsp;</span></span></p>
+<p class="TextFontCX"><span class=
+      "MsoCommentReference"><span style='font-size:15.5pt'>&nbsp;</span></span></p>
+<p class="TextFontCX" align="right" style=
+'margin-right: -58.5pt;text-align:right'><img width="364"
+     height="181" src="manual-301_files/image002.gif" align="left"
+     hspace="12" alt="Text Box: &#13;
+     Secure Programming Group&#13;
+University of Virginia &#13;
+Department of Computer Science&#13;
+&#13;
+     "></p>
+<p class="TextFontCX" style=
+'margin-left:28.35pt; text-indent:-14.15pt'><span class=
+"MsoCommentReference"><span style=
+'font-size: 15.5pt'>&nbsp;</span></span></p>
+<p class="TextFontCX" align="right" style=
+'margin-right: 9.0pt;text-align:right'><span class=
+"MsoCommentReference"><i><span style=
+'font-size:14.0pt'>&nbsp;</span></i></span></p></div>
+<span class="MsoCommentReference"><b><i><span style=
+'font-size:14.0pt;font-family: Arial'><br clear="all" style=
+'page-break-before:auto'></span></i></b></span> 
+<div class="Section2"><span class=
+      "MsoCommentReference"><span style='font-size: 15.5pt;font-family:"Times New Roman"'>
+<br clear="all" style='page-break-before: always'></span></span> 
+<p class="TextFontCX"><span class=
+"MsoCommentReference"><b><span style=
+'font-size:14.0pt;font-family:Arial'>&nbsp;</span></b></span></p>
+<h4 style='margin-left:0in;text-indent:0in'><span class=
+"MsoCommentReference"><span style=
+'font-size:14.0pt'>Authors</span></span></h4>
+<p class="TextFontCX">This manual was written by David Evans,
+except for Section 9 and Appendix B which were written by David
+Larochelle and David Evans.</p>
+<h4 style='margin-left:0in;text-indent:0in'><span class=
+"MsoCommentReference"><span style=
+'font-size:14.0pt'>Credits</span></span></h4>
+<p class="TextFontCX">Splint is developed and maintained by the
+Secure Programming Group at the University of Virginia Department
+of Computer Science.&nbsp; David Evans is the project leader and
+the primary developer of Splint.&nbsp; David Larochelle developed
+the memory bounds checking.&nbsp; University of Virginia students
+Chris Barker, David Friedman, Mike Lanouette and Hien Phan all
+contributed significantly to the development of Splint.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint is the successor to LCLint, a tool
+originally developed as a joint research project between the
+Massachusetts Institute of Technology and Digital Equipment
+Corporation&#8217;s System Research Center.&nbsp; David Evans was
+the primary designed and developer of LCLint.&nbsp; John Guttag and
+Jim Horning had the original idea for a static checking tool for
+detecting inconsistencies between LCL specifications and their C
+implementations.&nbsp; They provided valuable advice on its
+functionality and design and were instrumental in its
+development.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint incorporates the original LCL checker
+developed by Yang Meng Tan.&nbsp; This was built on the DECspec
+Project (Joe Wild, Gary Feldman, Steve Garland, and Bill
+McKeeman).&nbsp; The LSL checker used by LCLint was developed by
+Steve Garland.&nbsp; The original C grammar for LCLint was provided
+by Nate Osgood.&nbsp; This work has also benefited greatly from
+discussions with Mike Burrows, David Friedman, Stephen Garland,
+Colin Godfrey, Steve Harrison, Yanlin Huang, Daniel Jackson, John
+Knight, David Larochelle, Angelika Leeb, Ulana Legedza, Gary
+McGraw, Anya Pogosyants, Avneesh Saxena, Seejo Sebastine, Navneet
+Singh, Raymie Stata, Yang Meng Tan, and Mark Vandevoorde.&nbsp; I
+especially thank Angelika Leeb for many constructive comments on
+improving an early version of this document, Raymie Stata and Mark
+Vandevoorde for technical assistance, and Dorothy Curtis, Paco
+Hope, Scott Ruffner, Christina Jackson, David Ladd, and Jessica
+Greer for systems assistance.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Much of Splint&#8217;s development has been
+driven by feedback from users in academia and industry.&nbsp; Many
+more people than I can mention here have made contributions by
+suggesting improvements, reporting bugs, porting early versions of
+Splint to other platforms.&nbsp; Particularly heroic contributions
+have been made by Nelson Beebe, Eric Bloodworth, Jutta Degener,
+Rick Farnbach, Chris Flatters, Huver Hu, Alexander Mai, John Gerard
+Malecki, Thomas G. McWilliams, Michael Meskes, Richard
+O&#8217;Keefe, Jens Schweikhardt, Albert L. Ting and Jim Zelenka.
+Martin &#8220;Herbert&#8221; Dietze and Mike Smith performed
+valiantly in producing the original Win32 and OS2 ports.&nbsp; Tim
+Van Holder produced the <span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>automake</span></span>
+and <span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial; color:windowtext'>autoconf</span></span>
+distribution.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint research at the University of Virginia
+is currently funded in part by a grant from the NASA Langley
+Research Center, an NSF CAREER Award for swarm programming, and an
+NSF CCLI Award for using analysis to teach software
+engineering.&nbsp; David Larochelle is funded by a USENIX student
+research grant.&nbsp;&nbsp; <span style=
+'font-size:20.0pt'>&nbsp;</span></p></div>
+<span class="MsoCommentReference"><span style=
+'font-size:15.5pt;font-family:"Times New Roman"'><br clear="all"
+style='page-break-before:right'></span></span> 
+<div class="Section3">
+<p class="MsoToc1" align="center" style='text-align:center'>
+<span class="MsoCommentReference"><span style=
+'font-size:15.5pt'>Contents</span></span></p>
+<p class="MsoToc1">1<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#operation>Operation</a>................................................................................................................
+11</p>
+<p class="MsoToc2">1.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Warnings.............................................................................................................
+11</p>
+<p class="MsoToc2">1.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Flags....................................................................................................................
+12</p>
+<p class="MsoToc2">1.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Stylized
+Comments...............................................................................................
+12</p>
+<p class="MsoToc3">1.3.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Annotations...................................................................................................
+13</p>
+<p class="MsoToc3">1.3.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Setting
+Flags..................................................................................................
+13</p>
+<p class="MsoToc1">2<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#null>Null
+Dereferences</a>...................................................................................................
+14</p>
+<p class="MsoToc3">2.1.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Predicate
+Functions........................................................................................
+14</p>
+<p class="MsoToc3">2.1.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Notnull
+Annotations........................................................................................
+15</p>
+<p class="MsoToc3">2.1.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Relaxing Null
+Checking..................................................................................
+15</p>
+<p class="MsoToc1">3<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#undefined>
+Undefined
+Values</a>....................................................................................................
+17</p>
+<p class="MsoToc3">3.1.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Undefined
+Parameters...................................................................................
+17</p>
+<p class="MsoToc3">3.1.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Relaxing
+Checking.........................................................................................
+18</p>
+<p class="MsoToc3">3.1.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Partially
+Defined
+Structures............................................................................
+18</p>
+<p class="MsoToc1">4<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#types>
+Types</a>.......................................................................................................................
+19</p>
+<p class="MsoToc2">4.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Built in C
+Types....................................................................................................
+19</p>
+<p class="MsoToc3">4.1.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Characters....................................................................................................
+19</p>
+<p class="MsoToc3">4.1.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Enumerators..................................................................................................
+19</p>
+<p class="MsoToc3">4.1.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Numeric
+Types..............................................................................................
+19</p>
+<p class="MsoToc3">4.1.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Arbitrary
+Integral
+Types.................................................................................
+19</p>
+<p class="MsoToc2">4.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Boolean
+Types.....................................................................................................
+20</p>
+<p class="MsoToc2">4.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Abstract
+Types.....................................................................................................
+21</p>
+<p class="MsoToc3">4.3.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Controlling
+Access.........................................................................................
+22</p>
+<p class="MsoToc3">4.3.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Mutability......................................................................................................
+23</p>
+<p class="MsoToc2">4.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Polymorphism.......................................................................................................
+24</p>
+<p class="MsoToc1">5<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#memory>
+Memory
+Management</a>............................................................................................
+25</p>
+<p class="MsoToc2">5.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Storage
+Model......................................................................................................
+25</p>
+<p class="MsoToc2">5.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Deallocation
+Errors...............................................................................................
+26</p>
+<p class="MsoToc3">5.2.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Unshared
+References....................................................................................
+26</p>
+<p class="MsoToc3">5.2.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Temporary
+Parameters..................................................................................
+27</p>
+<p class="MsoToc3">5.2.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Owned and
+Dependent
+References.................................................................
+27</p>
+<p class="MsoToc3">5.2.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Keep
+Parameters...........................................................................................
+28</p>
+<p class="MsoToc3">5.2.5<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Shared
+References........................................................................................
+28</p>
+<p class="MsoToc3">5.2.6<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Stack
+References..........................................................................................
+28</p>
+<p class="MsoToc3">5.2.7<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Inner
+Storage.................................................................................................
+28</p>
+<p class="MsoToc2">5.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Implicit Memory
+Annotations.................................................................................
+29</p>
+<p class="MsoToc2">5.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Reference
+Counting..............................................................................................
+30</p>
+<p class="MsoToc1">6<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#sharing>
+Sharing</a>....................................................................................................................
+31</p>
+<p class="MsoToc2">6.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Aliasing................................................................................................................
+31</p>
+<p class="MsoToc3">6.1.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Unique
+Parameters........................................................................................
+31</p>
+<p class="MsoToc3">6.1.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Returned
+Parameters.....................................................................................
+31</p>
+<p class="MsoToc2">6.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Exposure..............................................................................................................
+32</p>
+<p class="MsoToc3">6.2.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Read-Only
+Storage........................................................................................
+32</p>
+<p class="MsoToc3">6.2.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Exposed
+Storage............................................................................................
+33</p>
+<p class="MsoToc1">7<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#function>
+Function
+Interfaces</a>.................................................................................................
+35</p>
+<p class="MsoToc2">7.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Modifications........................................................................................................
+35</p>
+<p class="MsoToc3">7.1.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> State
+Modifications........................................................................................
+36</p>
+<p class="MsoToc3">7.1.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Missing Modifies
+Clauses...............................................................................
+36</p>
+<p class="MsoToc2">7.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Global
+Variables...................................................................................................
+37</p>
+<p class="MsoToc3">7.2.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Controlling
+Globals
+Checking..........................................................................
+37</p>
+<p class="MsoToc3">7.2.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Definition
+State..............................................................................................
+38</p>
+<p class="MsoToc2">7.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Declaration
+Consistency........................................................................................
+38</p>
+<p class="MsoToc2">7.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> State
+Clauses.......................................................................................................
+39</p>
+<p class="MsoToc2">7.5<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Requires and
+Ensures
+Clauses...............................................................................
+41</p>
+<p class="MsoToc1">8<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#control>
+Control
+Flow</a>...........................................................................................................
+43</p>
+<p class="MsoToc2">8.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Execution.............................................................................................................
+43</p>
+<p class="MsoToc2">8.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Undefined
+Behavior..............................................................................................
+44</p>
+<p class="MsoToc2">8.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Problematic
+Control
+Structures..............................................................................
+45</p>
+<p class="MsoToc3">8.3.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Likely Infinite
+Loops......................................................................................
+45</p>
+<p class="MsoToc3">8.3.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Switches.......................................................................................................
+46</p>
+<p class="MsoToc3">8.3.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Deep
+Breaks.................................................................................................
+46</p>
+<p class="MsoToc3">8.3.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Loop and If
+Bodies........................................................................................
+47</p>
+<p class="MsoToc3">8.3.5<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Complete
+Logic.............................................................................................
+47</p>
+<p class="MsoToc2">8.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Suspicious
+Statements...........................................................................................
+47</p>
+<p class="MsoToc3">8.4.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Statements with
+No
+Effects............................................................................
+47</p>
+<p class="MsoToc3">8.4.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Ignored Return
+Values...................................................................................
+48</p>
+<p class="MsoToc1">9<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#buffer>
+Buffer
+Sizes</a>.............................................................................................................
+49</p>
+<p class="MsoToc2">9.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Checking
+Accesses..............................................................................................
+49</p>
+<p class="MsoToc2">9.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span> Annotating
+Buffer
+Sizes........................................................................................
+49</p>
+<p class="MsoToc2">9.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Warnings.............................................................................................................
+50</p>
+<p class="MsoToc1">10<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#extensible>
+Extensible
+Checking</a>............................................................................................
+52</p>
+<p class="MsoToc2">10.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Defining
+Attributes............................................................................................
+52</p>
+<p class="MsoToc2">10.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Annotations......................................................................................................
+54</p>
+<p class="MsoToc2">10.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Example...........................................................................................................
+54</p>
+<p class="MsoToc1">11<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#macros>
+Macros</a>..................................................................................................................
+55</p>
+<p class="MsoToc2">11.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Constant
+Macros...............................................................................................
+55</p>
+<p class="MsoToc2">11.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Function-like
+Macros.........................................................................................
+55</p>
+<p class="MsoToc3">11.2.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> Side
+Effect Free
+Parameters.......................................................................
+56</p>
+<p class="MsoToc2">11.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Controlling Macro
+Checking...............................................................................
+57</p>
+<p class="MsoToc2">11.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Iterators...........................................................................................................
+58</p>
+<p class="MsoToc3">11.4.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Defining
+Iterators.......................................................................................
+58</p>
+<p class="MsoToc3">11.4.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Using
+Iterators...........................................................................................
+58</p>
+<p class="MsoToc1">12<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#naming>
+Naming
+Conventions</a>............................................................................................
+60</p>
+<p class="MsoToc2">12.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Type-Based Naming
+Conventions......................................................................
+60</p>
+<p class="MsoToc3">12.1.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Czech
+Names.............................................................................................
+60</p>
+<p class="MsoToc3">12.1.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Slovak
+Names............................................................................................
+61</p>
+<p class="MsoToc3">12.1.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Czechoslovak
+Names..................................................................................
+61</p>
+<p class="MsoToc2">12.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Namespace
+Prefixes.........................................................................................
+61</p>
+<p class="MsoToc2">12.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Naming
+Restrictions..........................................................................................
+63</p>
+<p class="MsoToc3">12.3.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Reserved
+Names........................................................................................
+63</p>
+<p class="MsoToc3">12.3.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Distinct
+Names...........................................................................................
+63</p>
+<p class="MsoToc1">13<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#completeness>
+Completeness</a>.......................................................................................................
+65</p>
+<p class="MsoToc2">13.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Unused
+Declarations.........................................................................................
+65</p>
+<p class="MsoToc2">13.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Complete
+Programs...........................................................................................
+65</p>
+<p class="MsoToc3">13.2.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Unnecessarily External
+Names....................................................................
+65</p>
+<p class="MsoToc3">13.2.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Declarations Missing from
+Headers.............................................................
+65</p>
+<p class="MsoToc1">14<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a href=#libraries>
+Libraries and Header File
+Inclusion</a>....................................................................
+66</p>
+<p class="MsoToc2">14.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Standard
+Libraries.............................................................................................
+66</p>
+<p class="MsoToc3">14.1.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> ISO
+Standard
+Library..................................................................................
+66</p>
+<p class="MsoToc3">14.1.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+POSIX
+Library...........................................................................................
+66</p>
+<p class="MsoToc3">14.1.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> UNIX
+Library............................................................................................
+66</p>
+<p class="MsoToc3">14.1.4<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Strict
+Libraries............................................................................................
+66</p>
+<p class="MsoToc2">14.2<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Generating
+Libraries..........................................................................................
+67</p>
+<p class="MsoToc3">14.2.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Generating the Standard
+Libraries................................................................
+67</p>
+<p class="MsoToc2">14.3<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Header File
+Inclusion.........................................................................................
+68</p>
+<p class="MsoToc3">14.3.1<span style=
+'font-size:12.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Preprocessing
+Constants.............................................................................
+68</p>
+<p class="MsoToc1">Appendix A<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
+<a href=#availability>
+Availability</a>...............................................................................................
+71</p>
+<p class="MsoToc1">Appendix B<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
+<a href=#flags>
+Flags</a>........................................................................................................
+72</p>
+<p class="MsoToc2">Global
+Flags...................................................................................................................
+72</p>
+<p class="MsoToc3">
+Help..........................................................................................................................
+72</p>
+<p class="MsoToc3">
+Initialization................................................................................................................
+72</p>
+<p class="MsoToc3">
+Pre-processor............................................................................................................
+73</p>
+<p class="MsoToc3">
+Libraries....................................................................................................................
+73</p>
+<p class="MsoToc3">
+Output.......................................................................................................................
+74</p>
+<p class="MsoToc3">Expected
+Errors.........................................................................................................
+75</p>
+<p class="MsoToc2">Message
+Format............................................................................................................
+75</p>
+<p class="MsoToc2">Mode Selector
+Flags.......................................................................................................
+75</p>
+<p class="MsoToc2">Checking
+Flags...............................................................................................................
+76</p>
+<p class="MsoToc3">
+Key...........................................................................................................................
+76</p>
+<p class="MsoToc3">
+Types........................................................................................................................
+76</p>
+<p class="MsoToc3">Function
+Interfaces.....................................................................................................
+79</p>
+<p class="MsoToc3">Memory
+Management................................................................................................
+81</p>
+<p class="MsoToc3">
+Sharing......................................................................................................................
+84</p>
+<p class="MsoToc3">Use Before Definition <i>(Section
+3)</i>...............................................................................
+85</p>
+<p class="MsoToc3">Null Dereferences <i>(Section
+2)</i>....................................................................................
+85</p>
+<p class="MsoToc3">Macros <i>(Section
+7)</i>....................................................................................................
+85</p>
+<p class="MsoToc3">
+Iterators.....................................................................................................................
+86</p>
+<p class="MsoToc3">Naming
+Conventions...................................................................................................
+86</p>
+<p class="MsoToc3">Other
+Checks.............................................................................................................
+90</p>
+<p class="MsoToc2">Flag Name
+Abbreviations................................................................................................
+95</p>
+<p class="MsoToc1">Appendix C<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
+<a href=#annotations>
+Annotations</a>.............................................................................................
+97</p>
+<p class="MsoToc3">Suppressing
+Warnings.................................................................................................
+97</p>
+<p class="MsoToc2">Syntactic
+Annotations.....................................................................................................
+97</p>
+<p class="MsoToc3">
+Functions...................................................................................................................
+97</p>
+<p class="MsoToc3">Iterators (Section
+11.4)...............................................................................................
+98</p>
+<p class="MsoToc3">Constants (Section
+11.1).............................................................................................
+98</p>
+<p class="MsoToc3">Alternate Types (Section
+4.4)......................................................................................
+98</p>
+<p class="MsoToc3">Declarator
+Annotations...............................................................................................
+98</p>
+<p class="MsoToc3">Type
+Access..............................................................................................................
+98</p>
+<p class="MsoToc3">Macro
+Expansion......................................................................................................
+101</p>
+<p class="MsoToc3">Arbitrary Integral
+Types............................................................................................
+102</p>
+<p class="MsoToc3">Traditional Lint
+Comments........................................................................................
+102</p>
+<p class="MsoToc2">Metastate
+Definitions....................................................................................................
+103</p>
+<p class="MsoToc1">Appendix D<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
+<a href=#specifications>
+Specifications<a/>.........................................................................................
+104</p>
+<p class="MsoToc3">Specification
+Flags....................................................................................................
+104</p>
+<p class="MsoToc1">
+Appendix E<span style=
+'font-size:12.0pt;font-weight:normal'>&nbsp;&nbsp;&nbsp;</span>
+<a href=#annotated>
+Annotated
+Bibliography</a>........................................................................
+107</p>
+
+<p class="TextFontCX">&nbsp;</p></div>
+<span class="MsoCommentReference"><b><i><span style=
+'font-size:15.5pt;font-family: "Times New Roman";text-transform:uppercase'>
+<br clear="all" style=
+'page-break-before: right'></span></i></b></span> 
+<div class="Section4">
+<p class="TextFontCX"><span style=
+'font-size:16.0pt'>&nbsp;</span></p>
+<p class="MsoNormal" align="center" style='text-align:center'>
+<b><span style='font-size:16.0pt'>Splint User&#8217;s
+Manual</span></b></p>
+<p class="MsoNormal" align="center" style='text-align:center'>
+&nbsp;</p>
+<p class="MsoNormal" align="center" style='text-align:center'>
+Version 3.0.1</p>
+<p class="MsoNormal" align="center" style='text-align:center'>7
+January 2002</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint<a href="#_ftn1" name="_ftnref1"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:11.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>
+   is a tool for statically checking C programs for security
+   vulnerabilities and programming mistakes.&nbsp; Splint does many
+   of the traditional lint checks including unused declarations,
+   type inconsistencies, use before definition, unreachable code,
+   ignored return values, execution paths with no return, likely
+   infinite loops, and fall through cases.&nbsp; More powerful
+   checks are made possible by additional information given in
+   source code annotations.&nbsp; Annotations&nbsp;are stylized
+   comments that document assumptions about functions, variables,
+   parameters and types.&nbsp; In addition to the checks
+   specifically enabled by annotations, many of the traditional
+   lint checks are improved by exploiting this additional
+   information.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">As more effort is put into annotating
+programs, better checking results. A representational
+effort-benefit curve for using Splint is shown in Figure 1.&nbsp;
+Splint is designed to be flexible and allow programmers to select
+appropriate points on the effort-benefit curve for particular
+projects.&nbsp; As different checks are turned on and more
+information is given in code annotations the number of bugs that
+can be detected increases dramatically.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">Problems detected by Splint include:</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Dereferencing a possibly null pointer (Section 2);</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Using possibly undefined storage or returning storage that is not
+properly defined (Section&nbsp;3);</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Type mismatches, with greater precision and flexibility than
+provided by C compilers (Section 4.1&#8211;4.2);</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Violations of information hiding&nbsp;(Section 4.3);</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Memory management errors including uses of dangling references and
+memory leaks&nbsp; (Section 5);</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Dangerous aliasing (Section 6);</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Modifications and global variable uses that are inconsistent with
+specified interfaces (Section 7);</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Problematic control flow such as likely infinite loops (Section
+8.3.1), fall through cases or incomplete switches (Section 8.3.2),
+and suspicious statements (Section 8.4);</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Buffer overflow vulnerabilities (Section 9);</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Dangerous macro implementations or invocations (Section 11);
+and</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Violations of customized naming conventions.&nbsp; (Section
+12).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="MsoCaption">&nbsp;</p>
+<center><img width="572" height="350" src=
+"manual-301_files/image003.gif">
+<center><br>
+<br>
+ 
+<p class="MsoCaption"><a name="_Toc534824605"></a><a name=
+"_Ref534821281">Figure</a> 1.&nbsp; Typical Effort-Benefit
+Curve</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint checking can be customized to select
+what classes of errors are reported using command line flags and
+stylized comments in the code.&nbsp; In addition, users can define
+new annotations&nbsp;and associated checks to extend Splint&#8217;s
+checking or to enforce application specific properties (Section
+10).</p>
+<p class="TextFontCX"><a name="_Ref343085763"></a><a name=
+"_Ref343065516">&nbsp;</a></p>
+<p class="TextFontCX"><b>About This Document</b></p>
+<p class="TextFontCX">This document is a guide to using
+Splint.&nbsp; Section 1 explains how to run Splint, interpret
+messages and control checking.&nbsp; Sections 2&#8211;13 describe
+particular checks done by Splint.&nbsp; There are some minor
+dependencies between sections, but in general they can be read in
+any order.&nbsp; Section 14 covers issues involving libraries and
+header file inclusion important for running Splint on large
+systems.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">This document does not describe technical
+details of the checking.&nbsp; For technical background and
+analysis of Splint&#8217;s effectiveness in practice, see the
+papers available at <a href=
+      "http://www.splint.org/"><span style='font-size:10.0pt;font-family:Arial'>
+http://www.splint.org</span></a>.&nbsp;</p>
+<center>
+<table cellspacing="0" cellpadding="0" hspace="0" width="80%"
+       style="border-collapse: collapse" bordercolor="#111111">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="right" style='text-align:right'>
+<a name="_Ref349497354"></a><a name=
+      "_Ref348079997"><i><span style='font-size:9.0pt'>Since human
+      beings themselves are not fully debugged yet, there will be
+      bugs in your code no matter what you do.</span></i></a></p>
+<p class="TextFontCX" align="right" style=
+'margin-left:4.5pt;text-align:right'><span style=
+'font-size:9.0pt'>Chris Mason,</span><i><span style=
+'font-size:9.0pt'>Zero-defects&nbsp; memo</span></i>
+      <span style='font-size:9.0pt'>(quoted in <i>Microsoft
+      Secrets</i>, Cusumano and
+      Selby)</span></p></td></tr></table></center>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"Section1"></a><a name="_Toc534974932"></a><a name=
+"_Ref348785755">1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="operation" name="operation"> Operation</a></h1>
+<p class="TextFontCX">Splint is invoked by listing files to be
+checked.&nbsp; Initialization files, command line flags, and
+stylized comments may be used to customize checking globally and
+locally.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The best way to learn to use Splint, of
+course, is to actually use it (if you don&#8217;t already have
+Splint installed on your system, see Appendix A). &nbsp;Before you
+read much further in this document, I recommend finding a small C
+program.&nbsp; Then, try running:</p>
+<p class="example" align="left">splint *.c</p>
+<center>
+<center>
+<p class="TextFontCX">For the most C programs, this will produce a
+large number of warnings.&nbsp; To turn off reporting for some of
+the warnings, try:<a name="_Ref347468509"></a><a name=
+"_Ref345591726"></a><a name="_Ref345568136"></a><a name=
+"_Ref345515100"></a><a name="_Ref345497041"></a><a name=
+"_Ref345435155"></a><a name="_Ref345257971"></a><a name=
+"_Ref344916723"></a><a name="_Ref344907348"></a><a name=
+"_Ref344891202"></a><a name="_Toc344355397"></a></p>
+<p class="example" align="left">splint -weak *.c</p>
+<center>
+<center>
+<p class="TextFontCX">The <span class="Flag"><span style=
+'font-size:10.0pt'>-weak</span></span> flag is a mode flag that
+sets many checking parameters to select weaker checking than is
+done in the default mode.&nbsp; Other Splint flags will be
+introduced in the following sections; a complete list is given in
+Appendix B.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974933"></a><a name="_Toc344355435">1.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Warnings</a></h2>
+<p class="beforelist">A typical warning message is:</p>
+<p class="IndentText" align="left" style="margin-bottom: 0.0003pt">
+<span style='font-size:10.0pt;font-family:Arial'>sample.c: (in
+function faucet)</span></p>
+<p class="IndentText" align="left"><span style=
+'font-size:10.0pt;font-family:Arial'>sample.c:11:12</span><span style='font-size:10.0pt; font-family:Arial'>
+: Fresh storage x not released before return</span></p>
+<p class="IndentText" align="left"><span style=
+'font-size:10.0pt;font-family:Arial'>&nbsp; A memory leak has been
+detected. Storage allocated locally is not released</span></p>
+<p class="IndentText" align="left"><span style=
+'font-size:10.0pt;font-family:Arial'>&nbsp; before the last
+reference to it is lost. (Use -mustfreefresh to inhibit</span></p>
+<p class="IndentText" align="left"><span style=
+'font-size:10.0pt;font-family:Arial'>&nbsp; warning)</span></p>
+<p class="IndentText" align="left"><span style=
+'font-size:10.0pt;font-family:Arial'>&nbsp;&nbsp; sample.c:5:47:
+Fresh storage x allocated</span></p>
+<center>
+<center>
+<p class="afterlist">The first line gives the name of the function
+in which the error is found.&nbsp; This is printed before the first
+message reported for a function.&nbsp; The second line is the text
+of the message.&nbsp; This message reports a memory
+leak&#8212;storage allocated in a function is not deallocated
+before the function returns.&nbsp; The file name, line and column
+number where the error is located precedes the text.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The next line is a hint giving more
+information about the suspected error, including information on how
+the warning message may be suppressed.&nbsp; For this message,
+using the <span class="Flag"><span style=
+'font-size:10.0pt'>&#8209;mustfreefresh</span></span>&nbsp;flag
+would prevent this warning from being reported.&nbsp; This flag can
+be set at the command line, or more precisely just around the code
+point in question by using annotations (see Section 1.3.2).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The final line of the message gives
+additional location information.&nbsp; For this message, it tells
+where the leaking storage was allocated.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">The generic message format is (parts enclosed
+in square brackets are optional):</p>
+<p class="Verbatim" align="left"><span style=
+'font-family:Arial'>&nbsp; [&lt;file&gt;:&lt;line&gt; (in
+&lt;context&gt;)]</span></p>
+<p class="Verbatim" align="left"><span style=
+'font-family:Arial'>&nbsp;
+&lt;file&gt;:&lt;line&gt;[,&lt;column&gt;]:
+<i>message</i></span></p>
+<p class="Verbatim" align="left"><span style=
+'font-family:Arial'>&nbsp;&nbsp;&nbsp;&nbsp;
+[<i>hint</i>]</span></p>
+<p class="Verbatim" align="left"><span style=
+'font-family:Arial'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+&lt;file&gt;:&lt;line&gt;,&lt;column&gt;: <i>extra location
+information, if appropriate</i></span></p>
+<center>
+<center>
+<p class="afterlist">Users can customize the format and content of
+messages printed by Splint.&nbsp; The function context is not
+printed if <span class="Flag"><span style=
+'font-size:10.0pt'>-showfunc</span></span>&nbsp;is used.&nbsp;
+Column numbers are not printed if <span class=
+      "Flag"><span style='font-size:10.0pt'>&#8209;showcol</span></span>&nbsp;is
+      used.&nbsp; The <span class="Flag"><span style=
+      'font-size:10.0pt'>+parenfileformat</span></span>&nbsp;flag
+      can be used to generate file locations in the format
+      recognized by Microsoft Visual Studio.&nbsp; If <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>+parenfileformat</span></span> is set, the
+      line number follows the file name in parentheses (e.g.,
+      <span class="PlainText"><span style=
+      'font-size:10.0pt;font-family:Arial'>sample.c(11)</span></span>.)&nbsp;
+      Messages are split&nbsp;into lines of length less than the
+      value set using <span class="Flag"><span style=
+      'font-size:10.0pt'>-linelen
+      <i>&lt;number&gt;</i></span></span>.&nbsp; The default line
+      length is 80 characters.&nbsp; Splint attempts to split lines
+      in a sensible place as near to the line length limit as
+      possible.&nbsp;</p>
+<p class="afterlist" style='margin-top:0in'>&nbsp;</p>
+<p class="afterlist" style='margin-top:0in'>The <span class=
+"Flag"><span style=
+'font-size:10.0pt'>&#8209;hints</span></span>&nbsp;prevents any
+hints from being printed.&nbsp; Normally, a hint is given only the
+first time a class of error is reported.&nbsp; To have Splint print
+a hint for every message regardless, use <span class=
+"Flag"><span style=
+'font-size:10.0pt'>+forcehints</span></span>.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974934"></a><a name="_Ref348343333"></a><a name=
+"_Ref348343330"></a><a name="_Ref348092990"></a><a name=
+"_Ref344882148"></a><a name="_Ref344870278"></a><a name=
+"_Toc344355436">1.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Flags</a></h2>
+<p class="TextFontCX">So that many programming styles can be
+supported, Splint provides several hundred flags for controlling
+checking and message reporting.&nbsp; Some of the flags are
+introduced in the body of this document.&nbsp; Appendix B describes
+every flag.&nbsp; Modes and shortcut flags are provided for setting
+many flags at once.&nbsp; Individual flags can override the mode
+settings.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Flags are preceded by <span class=
+"Flag"><span style='font-size:10.0pt'>+</span></span> or
+<span class="Flag"><span style=
+'font-size:10.0pt'>-</span></span>.&nbsp; When a flag is preceded
+by <span class="Flag"><span style=
+'font-size:10.0pt'>+</span></span> we say it is <i>on</i>; when it
+is preceded by <span class="Flag"><span style=
+'font-size:10.0pt'>-</span></span> it is <i>off</i>. The precise
+meaning of on and off depends on the type of flag.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Flag"><span style=
+'font-size:10.0pt'>+</span></span>/<span class=
+      "Flag"><span style='font-size:10.0pt'>-</span></span> flag
+      settings are used for consistency and clarity, but contradict
+      standard UNIX usage and it is easy to accidentally use the
+      wrong one.&nbsp; To reduce the likelihood of using the wrong
+      flag, Splint issues warnings when a flag is set in an unusual
+      way.&nbsp; Warnings are issued when a flag is redundantly set
+      to the value it already had (these errors are not reported if
+      the flag is set using a stylized comment), if a mode flag or
+      special flag is set after a more specific flag that will be
+      set by the general flag was already set, if value flags are
+      given unreasonable values, of if flags are set in an
+      inconsistent way. &nbsp;The <span class="Flag"><span style=
+      'font-size: 10.0pt'>-warnflags</span></span>&nbsp;flag
+      suppresses these warnings.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Default flag settings will be read from
+<span class="Keyword"><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>~/.splintrc</span></span>&nbsp;if
+it is readable.&nbsp; If there is a <span class=
+"Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span>&nbsp;file
+in the working directory, settings in this file will be read next
+and its settings will override those in <span class=
+"Keyword"><span style=
+'font-size:10.0pt;font-family:Arial; color:windowtext'>~/.splintrc</span></span>.&nbsp;
+Command-line flags override settings in either file.&nbsp; The
+syntax of the <span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span>&nbsp;file
+is the same as that of command-line flags, except that flags may be
+on separate lines and the <span class="CodeText"><span style=
+'font-size:10.0pt'>#</span></span> character may be used to
+indicate that the remainder of the line is a comment. The
+<span class="Flag"><span style=
+'font-size:10.0pt'>-nof</span></span> flag prevents the
+      <span class="Keyword"><span style=
+      'font-size:10.0pt;font-family: Arial;color:windowtext'>~/.splintrc</span></span>&nbsp;file
+      from being loaded.&nbsp; The <span class="Flag"><span style=
+      'font-size:10.0pt'>-f</span></span> <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'><i>&lt;filename&gt;</i></span></span> flag
+      loads options from <i>filename</i>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">To make flag names more readable, hyphens
+(<span class="Flag"><span style=
+'font-size:10.0pt'>-</span></span>), underscores
+      (<span class="Flag"><span style=
+      'font-size:10.0pt'>_</span></span>) and spaces in flags at
+      the command line are ignored.&nbsp; Hence, <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>warnflags</span></span>, <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>warn-flags</span></span> and <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>warn_flags</span></span> all select the
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>warnflags</span></span> option.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974935"></a><a name="_Toc344355442"></a><a name=
+"_Ref343086686">1.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Stylized Comments</a></h2>
+<p class="TextFontCX">Stylized comments are used to provide extra
+information about a type, variable or function interface to improve
+checking, or to control flag settings locally.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">All stylized comments begin with
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>/*@</span></span> and are closed by the
+      end of the comment.&nbsp; The role of the <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>@</span></span>&nbsp;may be played by any
+      printable character.&nbsp; Use <span class=
+      "Flag"><span style='font-size:10.0pt'>-commentchar</span></span><span class="Flag">
+<span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;char&gt;</i></span></span> to
+select a different stylized comment marker.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974936">1.3.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Annotations</a></h3>
+<p class="TextFontCX">Annotations are stylized comments that follow
+a definite syntax.&nbsp; Although they are comments, they may only
+be used in fixed grammatical contexts (e.g., like a type
+qualifier).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Sections 2&#8211;6&#173; describe
+annotations&nbsp;for expressing assumptions about variables,
+parameters, return values, structure fields and
+type&nbsp;definitions.&nbsp; For example, <span class=
+"Annot"><span style='font-size:10.0pt'>/*@null@*/</span></span> is
+used to express an assumption that a parameter may be NULL.&nbsp;
+Section 7 describes annotations for describing function
+interfaces.&nbsp; Other annotations are described in later sections
+and Section 10 describes mechanisms users can employ to define new
+annotations.&nbsp; A summary of annotations is found in Appendix
+C.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Some annotations, known as control comments,
+may appear between any two tokens in a C program (unlike regular C
+comments, control comments should not be used within a single token
+as they introduce new separators in the code).&nbsp; Syntactically,
+they are no different from standard comments.&nbsp; Control
+comments are used to provide source-level control of Splint
+checking.&nbsp; They may be used to suppress spurious messages, set
+flags, and control checking locally in other ways.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974937"></a><a name="_Ref534648584">1.3.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Setting Flags</a></h3>
+<p class="TextFontCX">Most flags (all except those characterized as
+&#8220;global&#8221; in Appendix B) can be set locally using
+control comments.&nbsp; A control comment can set flags locally to
+override the command line settings.&nbsp; The original flag
+settings are restored before processing the next file. The syntax
+for setting flags in control comments is the same as that of the
+command line, except that flags may also be preceded by
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>=</span></span> to restore their setting
+      to the original command-line value.&nbsp; For instance,</p>
+<p class="example"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@+charint</span></span> <span class=
+"Annot"><span style=
+'font-size:10.0pt'>-modifies</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt'>=showfunc</span></span><span class=
+"Annot"><span style='font-size:10.0pt'>@*/</span></span></p>
+<p class="TextFontCX">sets <span class="Flag"><span style=
+'font-size:10.0pt'>charint</span></span>&nbsp;on (this makes
+<span class="CodeText"><span style=
+'font-size:10.0pt'>char</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>int</span></span>
+indistinguishable types), sets <span class=
+      "Flag"><span style='font-size:10.0pt'>modifies</span></span>
+      off (this prevents reporting of modification errors), and
+      sets <span class="Flag"><span style=
+      'font-size:10.0pt'>showfunc</span></span>&nbsp;to its
+      original setting (this controls&nbsp; whether or not the name
+      of a function <a name="_Toc344355449">is displayed before a
+      message).</a><a name="_Ref348845205"></a><a name=
+      "_Ref348845200"></a> <a name="_Ref348785779"></a></p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974938"></a><a name="_Ref534641443"></a><a name=
+"_Ref534093860"></a><a name="_Ref534050017"></a><a name=
+"_Ref534008843">2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="null" name="null">Null Dereferences</a></a></h1>
+<p class="TextFontCX">A common cause of program failures is when a
+null&nbsp;pointer is dereferenced.&nbsp; Splint detects these
+errors by distinguishing possibly <span class=
+"CodeText"><span style='font-size:10.0pt'>NULL</span></span>
+pointers at interface boundaries.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>null</span></span> annotation is used to
+indicate that a pointer value may be <span class=
+"CodeText"><span style='font-size:10.0pt'>NULL</span></span>.&nbsp;
+A pointer declared with no <span class="Annot"><span style=
+'font-size:10.0pt'>null</span></span> annotation, may not be
+<span class="CodeText"><span style=
+'font-size:10.0pt'>NULL</span></span>.&nbsp; If null checking is
+turned on (controlled by <span class="Flag"><span style=
+'font-size:10.0pt'>null</span></span>), Splint will report an error
+when a possibly null pointer is passed as a parameter, returned as
+a result, or assigned to an external reference with no
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span> qualifier.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">If a pointer is declared with the
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span> annotation, the code
+      must check that it is not <span class="CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span> on all paths leading to
+      a dereference of the pointer (or the pointer being returned
+      or passed as a value with no <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span> annotation).&nbsp;
+      Dereferences of possibly null pointers may be protected by
+      conditional statements or <span class="CodeText"><span style=
+      'font-size:10.0pt'>assert</span></span>ions (to see how
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>assert</span></span> is declared see
+      Section 8.1) that check the pointer is not <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Consider two implementations of
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>firstChar</span></span> in Figure 2. For
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>firstChar1</span></span>, Splint reports
+      an error since the pointer that is dereferenced is declared
+      with a <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span>&nbsp;annotation.&nbsp;
+      For <span class="CodeText"><span style=
+      'font-size:10.0pt'>firstChar2</span></span>, no error is
+      reported since the true branch of the <span class=
+      "CodeText"><span style='font-size:10.0pt'>s ==
+      NULL</span></span> if statement returns, so the dereference
+      of <span class="CodeText"><span style=
+      'font-size:10.0pt'>s</span></span> is only reached if
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>s</span></span> is not <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'width:207.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>null.c</span></b></span></p></td>
+<td valign="top" style=
+'width:220.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:207.0pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>char firstChar1
+(/*@null@*/ char *s)</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>{<br></span>
+<span class="Line"><span style=
+'font-size:8.0pt'>3</span></span><span style=
+'font-size:9.0pt'>&nbsp; return *s;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>char firstChar2
+(/*@null@*/ char *s)</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;&nbsp; if
+(s == NULL) return &#8216;\0&#8217;;<br></span> <span class=
+"Line"><span style=
+      'font-size:8.0pt'>9</span></span><span style='font-size:9.0pt'>&nbsp;
+      return *s;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
+<td valign="top" style=
+'width:220.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint null.c</p>
+<p class="lclintrun">Splint 3.0.1</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">null.c: (in function firstChar1)</p>
+<p class="lclintrun">null.c:3:11: Dereference of possibly null
+pointer s: *s</p>
+<p class="lclintrun">&nbsp;&nbsp; null.c:1:35: Storage s may become
+null</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">Finished checking --- 1 code warning found</p>
+<p class="TextFontCX">&nbsp;</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       style="border-collapse: collapse" bordercolor="#111111">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:6.5pt;padding-right: 9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Ref534981289"></a><a name=
+"_Toc534824606"></a><a name="_Ref534981293">Figure 2</a>.&nbsp;
+Null Checking</p>
+<p class="MsoNormal" align="left" style=
+'margin-top:0in;margin-right:26.55pt; margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-align:left; background:white'>
+<span style='font-size:10.0pt'>Output from running Splint is
+displayed in</span> <span style=
+'font-size:10.0pt;font-family:"Arial Narrow"'>sans-serif</span>
+<span style='font-size:10.0pt'>font.&nbsp; The command line is
+preceded by</span> <span style=
+'font-size:10.0pt;font-family:Arial'>&gt;</span><span style=
+'font-size: 10.0pt'>, the rest is output from Splint.&nbsp;
+Explanations added to the code or splint output are shown in
+<i>italics</i>. Code shown in the figures in this document is
+available from the splint web site,</span> <span style=
+'font-size:10.0pt;font-family:Arial'>http://www.splint.org</span><span style='font-size:10.0pt'>
+.&nbsp; No error is reported for line 9, since the dereference is
+reached only if</span> <span class="CodeText"><span style=
+'font-size:10.0pt'>s</span></span> <span style=
+'font-size:10.0pt'>is non-null.&nbsp; For most of the figures, the
+options</span> <span class="Flag"><span style=
+'font-size:9.0pt'>-linelen 55 -hints &#8211;showcol</span></span>
+<span style='font-size:10.0pt'>were used to produce condensed
+output, and</span> <span class="Flag"><span style=
+'font-size:9.0pt'>&#8211;exportlocal</span></span>
+      <span style='font-size:10.0pt'>to inhibit warnings about
+      exported
+      declarations.&nbsp;</span></p></td></tr></table></center>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974939"></a><a name="_Ref344185475">2.1.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Predicate Functions</a></h3>
+<p class="TextFontCX">Another way to protect null dereference, is
+to declare a function using <span class="Annot"><span style=
+'font-size:10.0pt'>nullwhentrue</span></span> or <span class=
+"Annot"><span style=
+'font-size:10.0pt'>falsewhennull</span></span>(these annotations
+where originally <span class="Annot"><span style=
+'font-size:10.0pt'>falsenull</span></span> and <span class=
+"Annot"><span style='font-size:10.0pt'>truenull</span></span>, but
+were renamed to clarify the logical asymmetry; <span class=
+"Annot"><span style='font-size:10.0pt'>falsenull</span></span> and
+<span class="Annot"><span style=
+'font-size:10.0pt'>truenull</span></span> may still be used) and
+call the function in a conditional statement before the
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span>-annotated pointer is
+      dereferenced.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">If a function annotated with
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>nullwhentrue</span></span> returns true it
+      means its first passed parameter is <span class=
+      "CodeText"><span style='font-size:10.0pt'>NULL</span></span>.
+      If it returns false, the parameter is not <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.&nbsp; Note that it may
+      return true for a parameter that is not <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.&nbsp; A more
+      descriptive name for <span class="Annot"><span style=
+      'font-size:10.0pt'>nullwhentrue</span></span> would be
+      &#8220;if the result is false, the parameter was not
+      null&#8221;. For example, if <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>isNull</span></span> is declared as,</p>
+<p class="example">&nbsp;&nbsp; /*@nullwhentrue@*/ bool isNull
+(/*@null@*/ char *x);</p>
+<p class="beforelist">we could write <span class=
+"CodeText"><span style=
+'font-size: 10.0pt'>firstChar2</span></span>:</p>
+<p class="Verbatim">&nbsp;&nbsp; char firstChar2 (/*@null@*/ char
+*s)</p>
+<p class="Verbatim">&nbsp;&nbsp; {</p>
+<p class="Verbatim" style='margin-left:.5in'>if (isNull (s)) return
+'\0';<br>
+return *s;</p>
+<p class="Verbatim">&nbsp;&nbsp; }</p>
+<p class="afterlist">No error is reported since the dereference of
+<span class="CodeText"><span style=
+'font-size:10.0pt'>s</span></span> is only reached if
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>isNull(s)</span></span> is false, and
+      since <span class="CodeText"><span style=
+      'font-size:10.0pt'>isNull</span></span> is declared with the
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>nullwhentrue</span></span> annotation this
+      means <span class="CodeText"><span style=
+      'font-size:10.0pt'>s</span></span> must not be null.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>falsewhennull</span></span> annotation is not
+quite the logical opposite of <span class=
+      "Annot"><span style='font-size:10.0pt'>nullwhentrue</span></span>.&nbsp;
+      If a function declared with <span class="Annot"><span style=
+      'font-size:10.0pt'>falsewhennull</span></span> returns true,
+      it means its parameter is definitely not <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.&nbsp; If it returns
+      false, the parameter may or may not be <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.&nbsp; That is a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>falsewhennull</span></span> always returns
+      false when passed a <span class="CodeText"><span style=
+      'font-size: 10.0pt'>NULL</span></span> parameter; it may
+      sometimes return false when passed a non-<span class=
+      "CodeText"><span style='font-size:10.0pt'>NULL</span></span>
+      parameter.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">For example, we could define
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>isNonEmpty</span></span> to return true if
+      its parameter is not <span class="CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span> and has least one
+      character before the <span class="CodeText"><span style=
+      'font-size:10.0pt'>NUL</span></span> terminator:</p>
+<p class="Verbatim">&nbsp;&nbsp; /*@falsewhennull@*/ bool
+isNonEmpty (/*@null@*/ char *x)</p>
+<p class="Verbatim">&nbsp;&nbsp; {</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp; return (x != NULL
+&amp;&amp; *x != &#8216;\0&#8217;);</p>
+<p class="Verbatim">&nbsp;&nbsp; }</p>
+<p class="afterlist">Splint does not check that the implementation
+of a function declared with <span class="Annot"><span style=
+'font-size:10.0pt'>nullwhentrue</span></span> or <span class=
+"Annot"><span style='font-size:10.0pt'>falsewhennull</span></span>
+is consistent with its annotation, but assumes the annotation is
+correct when code that calls the function is checked.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974940">2.1.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Notnull Annotations</a></h3>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>notnull</span></span> annotation specifies that
+a declarator is definitely not <span class=
+      "CodeText"><span style='font-size:10.0pt'>NULL</span></span>.&nbsp;
+      By default, this is assumed, but it may be necessary to use
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>notnull</span></span> to override a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span> in a type
+      definition.&nbsp; The <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span> annotation may be used
+      in a type definition to indicate that all instances of the
+      type may be <span class="CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.&nbsp; For declarations
+      of a type declared using <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span>, the <span class=
+      "Annot"><span style='font-size:10.0pt'>null</span></span>
+      annotation in the type definition may be overridden with
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>notnull</span></span>. This is
+      particularly useful for parameters to hidden <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>static</span></span> operations of
+      abstract types (see Section 4.3) where the null test has
+      already been done before the function is called, or function
+      results known to never be <span class="CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.&nbsp; For an abstract
+      type, <span class="Flag"><span style=
+      'font-size:10.0pt'>notnull</span></span> may not be used for
+      parameters to external functions, since clients should not be
+      aware of when the concrete representation may by <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span>.&nbsp; Parameters to
+      static functions in the implementation module, however, may
+      be declared using <span class="Annot"><span style=
+      'font-size:10.0pt'>notnull</span></span>, since they may only
+      be called from places where the representation is
+      accessible.&nbsp; Return values for <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>static</span></span> or external functions
+      may be declared using <span class="Annot"><span style=
+      'font-size:10.0pt'>notnull</span></span>.&nbsp;</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974941"></a><a name="_Ref347853058">2.1.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Relaxing Null Checking</a></h3>
+<p class="TextFontCX">An additional annotation, <span class=
+"Annot"><span style='font-size:10.0pt'>relnull</span></span> may be
+used to relax null checking.&nbsp; No error is reported when a
+<span class="Annot"><span style=
+'font-size:10.0pt'>relnull</span></span> value is dereferenced, or
+when a possibly null value is assigned to an identifier declared
+using <span class="Annot"><span style=
+'font-size:10.0pt'>relnull</span></span>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">This is generally used for structure fields
+that may or may not be null depending on some other
+constraint.&nbsp; Splint does not report and error when
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span> is assigned to a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>relnull</span></span> reference, or when a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>relnull</span></span> reference is
+      dereferenced.&nbsp; It is up to the programmer to ensure that
+      this constraint is satisfied before the pointer is
+      dereferenced.</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref348845237"></a><a name="_Ref347254431"></a><a name=
+"_Ref347169350"></a><a name="_Ref344916590"></a><a name=
+"_Ref344907893"></a><a name="_Toc344355407"></a><a name=
+"_Toc534974942"></a><a name="_Ref534641444"></a><a name=
+"_Ref534093775"></a><a name="_Ref534093769"></a><a name=
+"_Ref534049950">3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="undefined" name="undefined">Undefined Values</a></a></h1>
+<p class="TextFontCX">Like many static checkers, Splint detects
+instances where the value of a location is used before it is
+defined.&nbsp; This analysis is done at the procedural level.&nbsp;
+If there is a path through the procedure that uses a local variable
+before it is defined, a use before definition error is
+reported.&nbsp; The <span class="Flag"><span style=
+'font-size:10.0pt'>usedef</span></span> flag controls use before
+definition checking.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint can do more checking than standard
+checkers though, because the annotations can be used to describe
+what storage must be defined and what storage may be undefined at
+interface points. Unannotated references are expected to be
+completely defined at interface points.&nbsp; This means all
+storage reachable from a global variable, parameter to a function,
+or function return value is defined before and after a function
+call.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974943"></a><a name="_Ref347811030"></a><a name=
+"_Ref347204458">3.1.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Undefined Parameters</a></h3>
+<p class="TextFontCX">Sometimes, function parameters or return
+values are expected to reference undefined or partially defined
+storage.&nbsp; For example, a pointer parameter may be intended
+only as an address to store a result, or a memory allocator may
+return allocated but undefined storage.&nbsp; The
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>out</span></span>&nbsp;annotation denotes
+      a pointer to storage that may be undefined.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint does not report an error when a
+pointer to allocated but undefined storage is passed as an
+<span class="Annot"><span style=
+'font-size:10.0pt'>out</span></span> parameter.&nbsp; Within the
+body of a function, Splint will assume an <span class=
+"Annot"><span style='font-size:10.0pt'>out</span></span> parameter
+is allocated but not necessarily bound to a value, so an error is
+reported if its value is used before it is defined.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint reports an error if storage reachable
+by the caller after the call is not defined when the function
+returns.&nbsp; This can be suppressed by <span class=
+"Flag"><span style=
+'font-size: 10.0pt'>-must-define</span></span>.&nbsp; After a call
+returns, an actual parameter corresponding to an <span class=
+"Annot"><span style='font-size:10.0pt'>out</span></span> parameter
+is assumed to be completely defined.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">When checking unannotated programs, many
+spurious use before definition errors may be reported&nbsp;&nbsp;
+If <span class="Flag"><span style=
+'font-size:10.0pt'>impouts</span></span> is on, no error is
+reported when an incompletely-defined parameter is passed to a
+formal parameter with no definition annotation, and the actual
+parameter is assumed to be defined after the call.&nbsp; The
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*@in@*/</span></span>&nbsp;annotation can be
+used to denote a parameter that must be completely defined, even if
+<span class="Flag"><span style=
+'font-size:10.0pt'>imp-outs</span></span> is on.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>imp-outs</span></span> is off, there is an
+implicit <span class="Annot"><span style=
+'font-size:10.0pt'>in</span></span> annotation on every parameter
+with no definition annotation.</p>
+<p class="TextFontCX">&nbsp;</p>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style='margin-left:.9pt;border-collapse:collapse'>
+<tr>
+<td width="40%" valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>usedef.c</span></b></span></p></td>
+<td valign="top" style=
+'border-top:1.5pt solid black; border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black; background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>extern void</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp; setVal (/*@out@*/ int
+*x);</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>extern int</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp; getVal (/*@in@*/ int
+*x);</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>extern int
+mysteryVal</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp; (int
+*x);</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp;</span></span></p>
+<p class="MsoNormal" align="left" style='text-align:left'>
+<span class="Keyword"><span style=
+'font-size:10.0pt;color:windowtext'>int dumbfunc</span></span></p>
+<p class="MsoNormal" align="left" style='text-align:left'>
+<span class="Keyword"><span style=
+'font-size:10.0pt;color:windowtext'>&nbsp;&nbsp; (/*@out@*/ int *x,
+int i)</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>{</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp; if (i &gt;
+3)</span></span></p>
+<p class="MsoNormal"><span class="Line"><span style=
+'font-size:8.0pt'>11</span></span><span class=
+      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;
+      return *x;</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp; else if (i &gt;
+1)</span></span></p>
+<p class="MsoNormal"><span class="Line"><span style=
+'font-size:8.0pt'>13</span></span><span class=
+      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;
+      return getVal (x);</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp; else if (i ==
+0)</span></span></p>
+<p class="MsoNormal"><span class="Line"><span style=
+'font-size:8.0pt'>15</span></span><span class=
+      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;
+      return mysteryVal (x);</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp; else</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp;&nbsp;&nbsp;
+{</span></span></p>
+<p class="MsoNormal"><span class="Line"><span style=
+'font-size:8.0pt'>18</span></span><span class=
+      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;&nbsp;
+      setVal (x);</span></span></p>
+<p class="MsoNormal"><span class="Line"><span style=
+'font-size:8.0pt'>19</span></span><span class=
+      "Keyword"><span style='font-size:10.0pt;color:windowtext'>&nbsp;&nbsp;&nbsp;
+      return *x;</span></span></p>
+<p class="MsoNormal"><span class="Keyword"><span style=
+'font-size:10.0pt; color:windowtext'>&nbsp;&nbsp;&nbsp;
+}</span></span></p>
+<p class="Verbatim"><span class="Keyword"><span style=
+'color:windowtext'>}</span></span></p></td>
+<td valign="top" style=
+'border-top:medium none;border-left:medium none; border-bottom:1.5pt solid black;border-right:1.5pt solid black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
+<p class="lclintrun">&gt; splint usedef.c</p>
+<p class="lclintrun">usedef.c:11: Value *x used before
+definition</p>
+<p class="lclintrun">usedef.c:13: Passed storage x not completely
+defined</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+(*x is undefined): getVal (x)</p>
+<p class="lclintrun">usedef.c:15: Passed storage x not completely
+defined</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+(*x is undefined): mysteryVal (x)</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">Finished checking --- 3 code warnings</p>
+<p class="TextFontCX"><i>&nbsp;</i></p>
+<p class="IndentText" style=
+'margin-top:0in;margin-right:.85pt;margin-bottom: 0in;margin-left:0in;margin-bottom:.0001pt;page-break-after:avoid'>
+<i>No error is reported for line 18, since the incompletely defined
+storage</i> <span class="CodeText"><span style=
+'font-size:10.0pt'>x</span></span> <i>is passed as an</i>
+<span class="CodeText"><span style=
+'font-size:10.0pt'>out</span></span> <i>parameter.&nbsp; After the
+call,</i> <span class="CodeText"><span style=
+'font-size: 10.0pt'>x</span></span> <i>may be dereferenced,
+since</i> <span class="Annot"><span style=
+'font-size:10.0pt'>setVal</span></span> <i>is assumed to completely
+define its</i> <span class="Annot"><span style=
+'font-size:10.0pt'>out</span></span> <i>parameter.&nbsp; The
+warning for line 15 would not appear if</i> <span class=
+"Flag"><span style='font-size:10.0pt'>+impouts</span></span>
+<i>were used since there is no</i> <span class=
+      "Annot"><span style='font-size:10.0pt'>in</span></span>
+      <i>annotation on the parameter to</i> <span class=
+      "Flag"><span style=
+      'font-size: 10.0pt'>mysteryVal</span></span><i>.</i></p></td></tr></table>
+<div>
+<div align="center">
+<center>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       style="border-collapse: collapse" bordercolor="#111111">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Ref347764461"></a><a name=
+"_Ref347853047"></a><a name="_Toc534824607">Figure 3.&nbsp; Use
+before Definition</a></p></td></tr></table></center></div></div>
+<br clear="all">
+ 
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974944">3.1.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Relaxing Checking</a></h3>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>reldef</span></span>&nbsp;annotation relaxes
+definition checking for a particular declaration.&nbsp; Storage
+declared with a <span class="Annot"><span style=
+'font-size:10.0pt'>reldef</span></span> annotation is assumed to be
+defined when it is used, but no error is reported if it is not
+defined before it is returned or passed as a parameter.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">It is up to the programmer to check
+<span class="Annot"><span style=
+'font-size:10.0pt'>reldef</span></span> fields are used
+correctly.&nbsp;&nbsp; They should be avoided in most cases, but
+may be useful for fields of structures that may or may not be
+defined depending on other constraints.&nbsp;</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974945"></a><a name="_Ref347853043">3.1.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Partially Defined Structures</a></h3>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>partial</span></span> annotation can be used to
+relax checking of structure fields.&nbsp; A structure with
+undefined fields may be passed as a <span class=
+      "Annot"><span style='font-size: 10.0pt'>partial</span></span>
+      parameter or returned as a <span class="Annot"><span style=
+      'font-size:10.0pt'>partial</span></span> result.&nbsp; Inside
+      a function body, no error is reported when the field of a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>partial</span></span> structure is
+      used.&nbsp; After a call, all fields of a structure that is
+      passed as a <span class="Annot"><span style=
+      'font-size:10.0pt'>partial</span></span> parameter are
+      assumed to be completely defined.</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref534977413"></a><a name="_Toc534974946">4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="types" name="types">
+Types</a></a></h1>
+<p class="TextFontCX">Strong type checking&nbsp;often reveals
+programming errors.&nbsp; Splint can check primitive C types more
+strictly and flexibly than typical compilers (4.1) and provides
+support a Boolean type (4.2).&nbsp; In addition, users can define
+abstract types that provide information hiding&nbsp;(0).</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974947"></a><a name="_Ref534642132"></a><a name=
+"_Ref533964147"></a><a name="_Toc344355401">4.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Built in C Types</a></h2>
+<p align="right"><span style='font-size:9.0pt'><i>Two types
+have</i> compatible <i>type if their types are the
+same.</i></span></p>
+<p class="TextFontCX" align="right" style='text-align:right'>
+<span style='font-size:9.0pt'><span style='font-size:9.0pt'>ANSI C,
+3.1.2.6.</span></span></p>
+<p class="Sidebar">&nbsp;</p>
+<br>
+<br>
+ 
+<p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
+Splint supports stricter checking of built in C types.&nbsp; The
+<span class="CodeText"><span style=
+'font-size:10.0pt'>char</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>enum</span></span> types
+can be checked as distinct types, and the different numeric types
+can be type-checked strictly.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974948">4.1.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Characters</a></h3>
+<p class="TextFontCX">The primitive <span class=
+"CodeText"><span style='font-size:10.0pt'>char</span></span> type
+can be type-checked as a distinct type.&nbsp; If <span class=
+"CodeText"><span style='font-size:10.0pt'>char</span></span> is
+used as a distinct type, common errors involving assigning
+<span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span>s to <span class=
+"CodeText"><span style='font-size:10.0pt'>char</span></span>s are
+detected.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Flag"><span style=
+'font-size:10.0pt'>+charint</span></span> flag can be used for
+checking legacy programs where <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> are used
+      interchangeably.&nbsp; If <span class="Flag"><span style=
+      'font-size:10.0pt'>charint</span></span> is on, <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      types indistinguishable from <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>s.&nbsp; To keep
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>char</span></span> and <span class=
+      "Keyword"><span style='font-size:10.0pt'>int</span></span> as
+      distinct types, but allow chars to be used to index arrays,
+      use <span class="Flag"><span style=
+      'font-size:10.0pt'>+charindex</span></span>.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974949">4.1.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Enumerators</a></h3>
+<p class="TextFontCX">Standard C treats user-declared
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>enum</span></span> types just like
+      integers.&nbsp; An arbitrary integral value may be assigned
+      to an <span class="CodeText"><span style=
+      'font-size:10.0pt'>enum</span></span> type, whether or not it
+      was listed as an enumerator member.&nbsp; Splint checks each
+      user-defined <span class="CodeText"><span style=
+      'font-size:10.0pt'>enum</span></span> type as distinct
+      type.&nbsp; An error is reported if a value that is not an
+      enumerator member is assigned to the <span class=
+      "CodeText"><span style='font-size:10.0pt'>enum</span></span>
+      type, or if an <span class="CodeText"><span style=
+      'font-size:10.0pt'>enum</span></span> type is used as an
+      operand to an arithmetic operator.&nbsp; If the <span class=
+      "Flag"><span style='font-size:10.0pt'>enumint</span></span>
+      flag is on, <span class="CodeText"><span style=
+      'font-size:10.0pt'>enum</span></span> and <span class=
+      "CodeText"><span style='font-size:10.0pt'>int</span></span>
+      types may be used interchangeably.&nbsp; Like <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>charindex</span></span>, if the
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>enumindex</span></span> flag is on,
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>enum</span></span> types may be used to
+      index arrays.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974950">4.1.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Numeric Types</a></h3>
+<p class="TextFontCX">Splint reports where numeric types&nbsp;are
+used in dangerous or inconsistent ways.&nbsp; With the strictest
+checking, Splint will report an error anytime numeric types do not
+match exactly.&nbsp; If the <span class="Flag"><span style=
+'font-size:10.0pt'>relax-quals</span></span> flag is on, only those
+inconsistencies that may corrupt values are reported.&nbsp; For
+example, if an <span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span> is assigned to a variable of
+type <span class="CodeText"><span style=
+'font-size: 10.0pt'>long</span></span> (or passed as a
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>long</span></span> formal parameter),
+      Splint will not report an error if <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>relax-quals</span></span> is on since a
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>long</span></span> must have at least
+      enough bits to store an <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> without data loss.&nbsp;
+      On the other hand, an error would be reported if the
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>long</span></span> were assigned to an
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>, since the <span class=
+      "CodeText"><span style='font-size:10.0pt'>int</span></span>
+      type may not have enough bits to store the <span class=
+      "CodeText"><span style='font-size:10.0pt'>long</span></span>
+      value.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Similarly, if a <span class=
+"CodeText"><span style='font-size:10.0pt'>signed</span></span>
+value is assigned to an <span class="CodeText"><span style=
+'font-size:10.0pt'>unsigned</span></span>, Splint will report an
+error since an <span class="CodeText"><span style=
+'font-size:10.0pt'>unsigned</span></span> type cannot represent all
+<span class="CodeText"><span style=
+'font-size:10.0pt'>signed</span></span> values correctly.&nbsp; If
+the <span class="Flag"><span style=
+'font-size:10.0pt'>+ignore-signs</span></span> flag is on, checking
+is relaxed to ignore all sign qualifiers in type comparisons (this
+is not recommended, since it will suppress reporting of real bugs,
+but may be necessary for quickly checking certain legacy
+code).&nbsp;</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974951">4.1.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Arbitrary Integral Types</a></h3>
+<p class="TextFontCX">Some types are declared to be integral types,
+but the concrete type may be implementation dependent.&nbsp; For
+example, the standard library declares the types <span class=
+"CodeText"><span style='font-size:10.0pt'>size_t</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>ptr_diff</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>wchar_t</span></span>,
+but does not constrain their types other than limiting them to
+integral types.&nbsp; Programs may rely on them being integral
+types (e.g., can use <span class="CodeText"><span style=
+'font-size:10.0pt'>+</span></span> operator on two
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>size_t</span></span> operands), but should
+      not rely on a particular representation (e.g., <span class=
+      "CodeText"><span style='font-size: 10.0pt'>long
+      unsigned</span></span>).&nbsp;&nbsp;&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint supports three different kinds of
+arbitrary integral types:</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@integraltype@*/</span></span></p>
+<p class="TextFontCX"><span class="Annot"><font size=
+"2">&nbsp;&nbsp;&nbsp;</font></span> An arbitrary integral
+type.&nbsp; The actual type may be any one of <span class=
+"CodeText"><span style='font-size:10.0pt'>short</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>long</span></span>,
+<span class="CodeText"><span style='font-size:10.0pt'>unsigned
+short</span></span>, <span class="CodeText"><span style=
+'font-size:10.0pt'>unsigned</span></span>, or <span class=
+"CodeText"><span style='font-size:10.0pt'>unsigned
+long</span></span>.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>
+<p class="TextFontCX"><span class="Annot"><font size=
+"2">&nbsp;&nbsp;&nbsp;</font></span> An arbitrary unsigned integral
+type.&nbsp; The actual type may be any one of <span class=
+"CodeText"><span style='font-size:10.0pt'>unsigned
+short</span></span>, <span class="CodeText"><span style=
+'font-size:10.0pt'>unsigned</span></span>, or <span class=
+"CodeText"><span style='font-size:10.0pt'>unsigned
+long</span></span>.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>
+<p class="TextFontCX"><span class="Annot"><font size=
+"2">&nbsp;&nbsp;&nbsp;</font></span> An arbitrary signed integral
+type.&nbsp; The actual type may be any one of <span class=
+"CodeText"><span style='font-size:10.0pt'>short</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span>, or <span class=
+"CodeText"><span style='font-size:10.0pt'>long</span></span>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint reports an error if the code depends
+on the actual representation of a type declared as an arbitrary
+integral.&nbsp; The <span class="Flag"><span style=
+'font-size:10.0pt'>match-any-integral</span></span>&nbsp;flag
+relaxes checking and allows an arbitrary integral type is allowed
+to match any integral type.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Other flags set the arbitrary integral types
+to a concrete type.&nbsp; These should only be used if portability
+to platforms that may use different representations is not
+important.&nbsp; The <span class="Flag"><span style=
+'font-size:10.0pt'>long-integral</span></span>&nbsp;and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>long-unsigned-integral</span></span>&nbsp;flags
+      set the type corresponding to <span class=
+      "Annot"><span style='font-size: 10.0pt'>/*@integraltype@*/</span></span>&nbsp;to
+      be <span class="CodeText"><span style=
+      'font-size:10.0pt'>unsigned long</span></span> and
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>long</span></span> respectively.&nbsp; The
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>long-unsigned-unsigned-integral</span></span>&nbsp;flag
+      sets the type corresponding to <span class=
+      "Annot"><span style=
+      'font-size: 10.0pt'>/*@unsignedintegraltype@*/</span></span>
+      to be <span class="CodeText"><span style=
+      'font-size:10.0pt'>unsigned long</span></span>.&nbsp; The
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>long-signed-integral</span></span>&nbsp;flag
+      sets the type corresponding to <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>/*@signedintegraltype@*/</span></span> to
+      be <span class="CodeText"><span style=
+      'font-size:10.0pt'>long</span></span>.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974952"></a><a name="_Ref534642133"></a><a name=
+"_Ref533964143"></a><a name="_Ref344892413"></a><a name=
+"_Toc344355400">4.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Boolean Types</a></h2>
+<p class="TextFontCX">Pre-ISO99 C had no Boolean representation
+&#8211; the result of a comparison operator was an integer, and no
+type checking is done for test expressions.&nbsp; C99 introduced a
+Boolean type (<span class="CodeText"><span style=
+'font-size:10.0pt'>_Bool</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>bool</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>true</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>false</span></span>
+macros in <span style=
+'font-size:10.0pt;font-family:Arial'>stdbool.h</span>), but did not
+strengthen the type checking.&nbsp; Splint supports a Boolean type
+that can be checked distinctly from integral types.&nbsp; Many
+common errors can be detected by introducing a distinct Boolean
+type and stronger type checking.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint checks that the test expression in an
+<span class="CodeText"><span style=
+'font-size:10.0pt'>if</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>while</span></span>, or
+<span class="CodeText"><span style=
+'font-size:10.0pt'>for</span></span> statement or an operand of a
+<span class="CodeText"><span style=
+'font-size:10.0pt'>&amp;&amp;</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>||</span></span> or
+<span class="CodeText"><span style=
+'font-size:10.0pt'>!</span></span>operator is a Boolean.&nbsp; If
+the type of a test expression is not a Boolean, Splint will produce
+a warning depending on the type of the test expression and flag
+settings.&nbsp; If the test expression has pointer type, the
+warning is inhibited by <span class="Flag"><span style=
+'font-size:10.0pt'>&#8211;predboolptr</span></span> (this can be
+used to prevent messages for the idiom of testing if a pointer is
+not null without a comparison).&nbsp; If it is type
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>, the warnings is
+      inhibited by <span class="Flag"><span style=
+      'font-size:10.0pt'>-pred-bool-int</span></span>.&nbsp; For
+      all other types, Splint warns unless <span class=
+      "Flag"><span style=
+      'font-size: 10.0pt'>-pred-bool-others</span></span> is
+      set.&nbsp;&nbsp; Relations, comparisons and certain standard
+      library functions are declared to return Booleans.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Since using <span class=
+"CodeText"><span style='font-size:10.0pt'>=</span></span> instead
+of <span class="CodeText"><span style=
+'font-size:10.0pt'>==</span></span> is such a common bug, reporting
+of test expressions that are assignments is controlled by the
+separate <span class="Flag"><span style=
+'font-size:10.0pt'>pred-assign</span></span> flag.&nbsp; The
+message can be suppressed by adding extra parentheses around the
+test expression.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Use the <span class="Flag"><span style=
+'font-size:10.0pt'>&#8211;booltype
+&lt;name&gt;</span></span>&nbsp;flag to select the type name is
+used to represent Boolean values.&nbsp; There is no default Boolean
+type, although <span class="CodeText"><span style=
+'font-size: 10.0pt'>bool</span></span> is used by convention.&nbsp;
+The names <span class="CodeText"><span style=
+'font-size:10.0pt'>TRUE</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>FALSE</span></span> are
+assumed to represent true and false Boolean values.&nbsp; To change
+the names of true and false, use <span class=
+      "Flag"><span style='font-size:10.0pt'>-booltrue</span></span>
+      and <span class="Flag"><span style=
+      'font-size:10.0pt'>-boolfalse</span></span>.&nbsp; (The
+      Splint distribution includes an implementation of
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>bool</span></span>, in <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt;color:windowtext'>lib/bool.h</span></span>.&nbsp;
+      However, it isn&#8217;t necessary to use this implementation
+      to get the benefits of Boolean checking.)</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Figure 4 illustrates some of the Boolean
+checking done by Splint.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr style='height:13.3pt'>
+<td valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.3pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>bool.c</span></b></span></p></td>
+<td valign="top" style=
+'border-top:1.5pt solid black; border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black; background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:2.0in;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:156.15pt'>
+<p class="Verbatim"># include "bool.h"</p>
+<p class="Verbatim">int f (int i, char *s,</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp; bool b1, bool b2)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;6</span></span>&nbsp; if (i = 3)</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;7</span></span>&nbsp;&nbsp;&nbsp; return
+b1;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;8</span></span>&nbsp; if (!i || s)</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;9</span></span>&nbsp;&nbsp;&nbsp; return
+i;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>10</span></span>&nbsp; if (s)</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>11</span></span>&nbsp;&nbsp;&nbsp; return 7;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>12</span></span>&nbsp; if (b1 == b2)</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>13</span></span>&nbsp;&nbsp;&nbsp; return 3;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>14</span></span>&nbsp; return 2;</p>
+<p class="Verbatim">}</p></td>
+<td valign="top" style=
+'border-top:medium none;border-left: medium none;border-bottom:1.5pt solid black;border-right:1.5pt solid black; padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>
+<p class="lclintrun">&gt; splint bool.c +predboolptr
+&#8211;booltype bool</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">bool.c:6: Test expression for if is assignment
+expression: i = 3</p>
+<p class="lclintrun">bool.c:6: Test expression for if not bool,
+type int: i = 3</p>
+<p class="lclintrun">bool.c:7: Return value type bool does not
+match declared type int: b1</p>
+<p class="lclintrun">bool.c:8: Operand of ! is non-boolean (int):
+!i</p>
+<p class="lclintrun">bool.c:8: Right operand of || is non-boolean
+(char *): !i || s</p>
+<p class="lclintrun">bool.c:10: Test expression for if not bool,
+type char *: s</p>
+<p class="lclintrun">bool.c:12: Use of == with bool variables
+(risks inconsistency because</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+of multiple true values): b1 == b2</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun" style='page-break-after:avoid'>Finished
+checking --- 7 code warnings found</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Ref533964137"></a><a name=
+"_Toc534824608"></a><a name="_Ref534821769">Figure 4</a>.&nbsp;
+Boolean Checking</p></td></tr></table></center>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974953"></a><a name="_Ref534970776">4.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Abstract Types</a></h2>
+<p class="TextFontCX">Information hiding is a technique for
+handling complexity.&nbsp; By hiding implementation details,
+programs can be understood and developed in distinct modules and
+the effects of a change can be localized.&nbsp; One technique for
+information hiding&nbsp;is data abstraction.&nbsp; An
+abstract&nbsp;type is used to represent some natural program
+abstraction.&nbsp; It provides functions for manipulating instances
+of the type.&nbsp; The module that implements these functions is
+called the <i>implementation</i> module.&nbsp; We call the
+functions that are part of the implementation of an abstract type
+the <i>operations</i> of the type.&nbsp; Other modules that use the
+abstract type are called <i>clients</i>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Clients may use the type name and operations,
+but should not manipulate or rely on the actual representation of
+the type.&nbsp; Only the implementation module may manipulate the
+representation of an abstract type.&nbsp; This hides information,
+since implementers and maintainers of client modules should not
+need to know anything about how the abstract type is implemented.
+It provides modularity, since the representation of an abstract
+type can be changed without having to change any client code.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint supports abstract types by detecting
+places where client code depends on the concrete representation of
+an abstract type.&nbsp; Some examples of abstraction violations
+detected by Splint are shown in Figure 5.</p>
+<p class="beforelist">&nbsp;</p>
+<p class="beforelist">To declare an abstract type, the
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>abstract</span></span>&nbsp;annotation is
+      added to a <span class="CodeText"><span style=
+      'font-size:10.0pt'>typedef</span></span>.&nbsp; For example
+      (in <span class="Keyword"><span style=
+      'font-size:10.0pt;font-family: Arial;color:windowtext'>mstring.h</span></span>),</p>
+<p class="example">typedef /*@abstract@*/ char *mstring;</p>
+<p class="TextFontCX">declares <span class=
+      "CodeText"><span style='font-size:10.0pt'>mstring</span></span>
+      as an abstract type.&nbsp; It is implemented using a
+      <span class="CodeText"><span style='font-size:10.0pt'>char
+      *</span></span>, but clients of the type should not depend on
+      or need to be aware of this.&nbsp; If it later becomes
+      apparent that a better representation such as a string table
+      should be used, we should be able to change the
+      implementation of <span class="CodeText"><span style=
+      'font-size: 10.0pt'>mstring</span></span> without having to
+      change or inspect any client code.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">In a client module, abstract types are
+checked by name, not structure.&nbsp; Splint reports an error if an
+instance of <span class="CodeText"><span style=
+'font-size:10.0pt'>mstring</span></span> is passed as a
+      <span class="CodeText"><span style='font-size:10.0pt'>char
+      *</span></span> (for instance, as an argument to <span class=
+      "CodeText"><span style=
+      'font-size: 10.0pt'>strlen</span></span>), since the
+      correctness of this call depends on the representation of the
+      abstract type.&nbsp; Splint also reports errors if any C
+      operator except assignment (<span class=
+      "CodeText"><span style='font-size:10.0pt'>=</span></span>) or
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>sizeof</span></span> is used on an
+      abstract type.&nbsp; The assignment operator is allowed since
+      its semantics do not depend on the representation of the type
+      (for abstract types whose instances can change value, a
+      client does need to know if assignment has copy or sharing
+      semantics as discussed in Section 4.3.2).&nbsp; The use of
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>sizeof</span></span>&nbsp;is also
+      permitted, since this is the only way for clients to allocate
+      pointers to the abstract type.&nbsp; Type casting objects to
+      or from abstract types in a client module is an abstraction
+      violation and will generate a warning message.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Normally, Splint will assume a type
+definition is not abstract unless the <span class=
+"Annot"><span style='font-size:10.0pt'>/*@abstract@*/</span></span>
+qualifier is used.&nbsp; If instead you want all user-defined types
+to be abstract types unless they are marked as <span class=
+"Annot"><span style='font-size:10.0pt'>concrete</span></span>, the
+<span class="Flag"><span style=
+'font-size:10.0pt'>+imp-abstract</span></span> flag can be
+used.&nbsp; This adds an implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>abstract</span></span>
+      annotation to any <span class="CodeText"><span style=
+      'font-size:10.0pt'>typedef</span></span> that is not marked
+      with <span class="Annot"><span style=
+      'font-size:10.0pt'>/*@concrete@*/</span></span>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'width:418.5pt;margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr style='height:13.45pt'>
+<td valign="top" style=
+'width:211.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>palindrome.c</span></b></span></p></td>
+<td valign="top" style=
+'width:207.0pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr style='height:196.2pt'>
+<td valign="top" style=
+'width:211.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>
+<p class="Verbatim"><span style='font-size:9.0pt'># include
+"bool.h"</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'># include
+"mstring.h"</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>bool isPalindrome
+(mstring s)</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;6</span></span> <span style=
+'font-size:9.0pt'>char *current = (char *) s;</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;7</span></span> <span style=
+'font-size:9.0pt'>int i, len = (int) strlen (s);</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp; for (i =
+0; i &lt;= (len+1) / 2; i++)</span></p>
+<p class="Verbatim"><span style=
+'font-size:9.0pt'>&nbsp;&nbsp;&nbsp; {</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>11</span></span><span style=
+'font-size:9.0pt'>&nbsp;&nbsp;&nbsp; if (current[i] !=
+s[len-i-1])</span></p>
+<p class="Verbatim"><span style=
+'font-size:9.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return
+FALSE;</span></p>
+<p class="Verbatim"><span style=
+'font-size:9.0pt'>&nbsp;&nbsp;&nbsp; }</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp; return
+TRUE;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>bool callPal
+(void)</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>19</span></span><i><span style=
+'font-size:9.0pt;font-family:Arial'>&nbsp;</span></i>
+      <span style='font-size:9.0pt'>return (isPalindrome
+      ("bob"));</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
+<td valign="top" style=
+'width:207.0pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>
+<p class="lclintrun">&gt; splint palindrome.c</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">palindrome.c:6: Cast from underlying</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; abstract type mstring:
+(char *)s</p>
+<p class="lclintrun">palindrome.c:7: Function strlen expects
+arg</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; 1 to be char * gets
+mstring: s</p>
+<p class="lclintrun">palindrome.c:11: Array fetch from
+non-array</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; (mstring): s[len - i -
+1]</p>
+<p class="lclintrun">palindrome.c:19: Function isPalindrome</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; expects arg 1 to be mstring
+gets char *:</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; "bob"</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="lclintrun">Finished checking --- 4 code warnings</p>
+<p class="TextFontCX"><span style=
+'font-size: 9.0pt;font-family:Times'>&nbsp;</span></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824609"></a><a name=
+"_Toc347255385"></a><a name="_Ref344908730"></a><a name=
+"_Ref344908735">Figure 5</a>.&nbsp; Information Hiding
+Violations</p></td></tr></table></center>
+<p align="right"><i><span style=
+'font-size:9.0pt'>&nbsp;Traditionally, programming books wax
+mathematical when they arrive at the topic of abstract data
+types&#8230;<br>
+Such books make it seem as if you&#8217;d never actually use an
+abstract data type except as a sleep aid.</span></i></p>
+ 
+<p class="TextFontCX" align="right" style='text-align:right'>
+<i><span style=
+'font-size:9.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></i>
+<span style='font-size:9.0pt'>&nbsp;&nbsp;&nbsp;Steve
+McConnell</span></p>
+<p class="TextFontCX"><i>&nbsp;</i></p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974954"></a><a name="_Ref344892422"></a><a name=
+"_Ref344870884"></a><a name="_Toc344355398">4.3.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Controlling Access</a></h3>
+<p class="TextFontCX">Where code may manipulate the representation
+of an abstract type, we say the code has <i>access</i> to that
+type.&nbsp; If code has access to an abstract type, the
+representation of the type and the abstract type are
+indistinguishable.&nbsp; Usually, a single program module that is
+the only code that has access to the type representation implements
+an abstract type.&nbsp; Sometimes, more complicated access control
+is desired if the implementation of an abstract type is split
+across program files, or particular client code needs to access the
+representation.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">There are a several ways of selecting what
+code has access the representation of an abstract type:</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Modules.&nbsp; An abstract type defined in <i><span style=
+'font-size: 10.0pt;font-family:Arial'>M</span></i><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+is accessible in <i><span style=
+'font-size:10.0pt;font-family:Arial'>M</span></i><span class=
+"Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>.&nbsp;
+Controlled by the <span class="Flag"><span style=
+'font-size:10.0pt'>accessmodule</span></span> flag.&nbsp; This
+means when <span class="Flag"><span style=
+'font-size:10.0pt'>accessmodule</span></span> is on, as it is by
+default, the module access rule is in effect.&nbsp; If
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>accessmodule</span></span> is off (when
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>-access-module</span></span> is used), the
+      module access rule is not in effect and an abstract type
+      defined in <i><span style=
+      'font-size:10.0pt;font-family:Arial'>M</span></i><span class=
+      "Keyword"><span style=
+      'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+      is not necessarily accessible in <i><span style=
+      'font-size:10.0pt;font-family: Arial'>M</span></i><span class="Keyword">
+<span style=
+'font-size:10.0pt; font-family:Arial;color:windowtext'>.c</span></span>.</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+File names.&nbsp; An abstract type named <span class=
+"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
+is accessible in files named <span class=
+      "CodeText"><i><span style='font-size:10.0pt'>type.&lt;extension&gt;</span></i></span>.&nbsp;
+      For example, the representation of <span class=
+      "CodeText"><span style=
+      'font-size: 10.0pt'>mstring</span></span> is accessible in
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>mstring.h</span></span> and <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>mstring.c</span></span>.&nbsp; Controlled
+      by the <span class="Flag"><span style=
+      'font-size:10.0pt'>access-file</span></span>&nbsp;flag.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Function names.&nbsp; An abstract type named <span class=
+"CodeText"><i><span style=
+'font-size: 10.0pt'>type</span></i></span> may be accessible in a
+function named <span class="CodeText"><i><span style=
+'font-size:10.0pt'>type_name</span></i></span> or
+      <span class="CodeText"><i><span style=
+      'font-size:10.0pt'>typeName</span></i></span>.&nbsp; For
+      example, <span class="CodeText"><span style=
+      'font-size:10.0pt'>mstring_length</span></span> and
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>mstringLength</span></span> would have
+      access to the <span class="CodeText"><span style=
+      'font-size:10.0pt'>mstring</span></span> abstract type.&nbsp;
+      Controlled by <span class="Flag"><span style=
+      'font-size:10.0pt'>accessfunction</span></span>&nbsp;and the
+      naming convention&nbsp;(see Section 12).</p>
+<p class="TextFontCX" style=
+'margin-left:12.95pt; text-indent:-12.95pt'><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Access control comments. The syntax <span class=
+      "Annot"><span style='font-size:10.0pt'>/*@access
+      <i>type</i>,<sup>+</sup>@*/</span></span><a href="#_ftn2"
+      name="_ftnref2" title=""><span class=
+      "MsoFootnoteReference"><span class=
+      "MsoFootnoteReference"><span style=
+      'font-size:11.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>
+      allows the following code to access the representation of
+      <span class="CodeText"><i><span style=
+      'font-size:10.0pt'>type</span></i></span>.&nbsp; Similarly,
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>/*@noaccess</span></span> <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'><i>type</i>,<sup>+</sup>@*/</span></span>
+      restricts access to the representation of <span class=
+      "CodeText"><i><span style=
+      'font-size: 10.0pt'>type</span></i></span>.&nbsp; The type in
+      a <span class="Annot"><span style=
+      'font-size:10.0pt'>noaccess</span></span> comment must have
+      been declared as an abstract type.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974955"></a><a name="_Toc344355399"></a><a name=
+"_Ref343240525"></a><a name="_Ref343240518">4.3.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Mutability</a></h3>
+<p class="TextFontCX">We can view types as being <i>mutable</i> or
+<i>immutable</i>.&nbsp; A type is mutable if passing it as a
+parameter to a function call can change the value of an instance of
+the type.&nbsp; For example, the primitive type <span class=
+"CodeText"><span style='font-size:10.0pt'>int</span></span> is
+immutable.&nbsp; If <span class="CodeText"><span style=
+'font-size:10.0pt'>i</span></span> is a local variable of type
+<span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span> and no variables point to the
+location where <span class="CodeText"><span style=
+'font-size:10.0pt'>i</span></span> is stored, the value of
+<span class="CodeText"><span style=
+'font-size:10.0pt'>i</span></span> must be the same before and
+after the call <span class="CodeText"><span style=
+'font-size:10.0pt'>f (i)</span></span>.&nbsp; Structure and union
+types are also immutable, since they are copied when they are
+passed as arguments.&nbsp; On the other hand, pointer types are
+mutable.&nbsp; If <span class="CodeText"><span style=
+'font-size:10.0pt'>x</span></span> is a local variable of type
+<span class="CodeText"><span style='font-size:10.0pt'>int
+*</span></span>, the value of <span class=
+      "CodeText"><span style='font-size:10.0pt'>*x</span></span>
+      (and hence, the value of the object <span class=
+      "CodeText"><span style='font-size:10.0pt'>x</span></span>)
+      can be changed by the function call <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>g(x)</span></span>.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The mutability of a concrete type is
+determined by its type definition. For abstract types, mutability
+does not depend on the type representation but on what operations
+the type provides. If an abstract type has operations that may
+change the value of instances of the type, the type is
+mutable.&nbsp; If not, it is immutable.&nbsp; The value of an
+instance of an immutable type never changes.&nbsp; Since object
+sharing is noticeable only for mutable types, they are checked
+differently from immutable types.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">The <span class="Annot"><span style=
+'font-size:10.0pt'>/*@mutable@*/</span></span> and
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>/*@immutable@*/</span></span> annotations
+      are used to declare an abstract type as mutable or
+      immutable.&nbsp; (If neither is used, the abstract type is
+      assumed to be mutable.)&nbsp; For example,</p>
+<p class="Verbatim">&nbsp;&nbsp; typedef /*@abstract@*/
+/*@mutable@*/ char *mstring;</p>
+<p class="Verbatim">&nbsp;&nbsp; typedef /*@abstract@*/
+/*@immutable@*/ int weekDay;</p>
+<p class="afterlist">declares <span class=
+      "CodeText"><span style='font-size:10.0pt'>mstring</span></span>
+      as a mutable abstract type and <span class=
+      "CodeText"><span style=
+      'font-size: 10.0pt'>weekDay</span></span> as an immutable
+      abstract type.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Clients of a mutable abstract type need to
+know the semantics of assignment.&nbsp; After the assignment
+expression <span class="CodeText"><span style='font-size:10.0pt'>s
+= t</span></span>, do <span class="CodeText"><span style=
+'font-size:10.0pt'>s</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>t</span></span> refer to
+the same object (that is, will changes to the value of
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>s</span></span> also change the value of
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>t</span></span>).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint prescribes that all abstract types
+have sharing semantics, so <span class=
+      "CodeText"><span style='font-size:10.0pt'>s</span></span> and
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>t</span></span> would indeed be the same
+      object.&nbsp; Splint will produce a warning if a mutable type
+      is implemented with a representation (e.g., a <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>struct</span></span>) that does not
+      provide sharing semantics (controlled by <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>mutrep</span></span>&nbsp;flag).&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The mutability of an abstract type is not
+necessarily the same as the mutability of its representation. We
+could use the immutable concrete type <span class=
+"CodeText"><span style='font-size:10.0pt'>int</span></span> to
+represent mutable strings using an index into a string table, or
+declare <span class="CodeText"><span style=
+'font-size:10.0pt'>mstring</span></span> as immutable as long as no
+operations are provided that modify the value of an
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>mstring</span></span>.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974956"></a><a name="_Toc344355422"></a><a name=
+"_Ref343109614">4.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Polymorphism</a></h2>
+<p class="TextFontCX">In C, all declarators must be declared to
+have exactly one type.&nbsp; This makes it impossible to write
+functions that operate on more than one type of parameter &#8211;
+for example, we cannot use the same square function for
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>s and <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>float</span></span>s.&nbsp; Because of the
+      stricter type checking made possible by Splint, it is often
+      useful to declare a parameter that has more than one possible
+      type.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint provides alternate types to indicate
+that a declaration may be one of several possible types.&nbsp; The
+<span class="Annot"><span style='font-size:10.0pt'>/*@alt
+<i>type</i>,<sup>+</sup>@*/</span></span> annotation creates a
+union type.&nbsp; For example, <span class=
+      "CodeText"><span style='font-size:10.0pt'>int</span></span>
+      <a href="mailto:/*@alt"><span class="Annot"><span style=
+      'font-size:10.0pt'>/*@alt</span></span></a><span class=
+      "Annot"><span style='font-size:10.0pt'>char,
+      unsigned</span></span> <a href="mailto:char@*/"><span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>char@*/</span></span></a><span class=
+      "CodeText"><span style='font-size:10.0pt'>c</span></span>
+      declares <span class="CodeText"><span style=
+      'font-size:10.0pt'>c</span></span> such that either an
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>, <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>unsigned char</span></span> value may be
+      assigned to it without warning.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">One use of alternate types is to specify the
+type of a macro that operates on multiple types of operands (see
+Section 11.2.1).&nbsp; Alternate types are also useful for
+declaring functions for which the return value may be safely
+ignored (see Section 8.4.2).&nbsp; A function can be declared to
+return <span class="CodeText"><i><span style=
+'font-size:10.0pt'>t</span></i></span> <a href=
+"mailto:/*@alt"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@alt</span></span></a><a href=
+"mailto:void@*/"><span class="Annot"><span style=
+'font-size:10.0pt'>void@*/</span></span></a> to indicate that it
+returns a value of type <span class=
+      "CodeText"><i><span style='font-size:10.0pt'>t</span></i></span>,
+      but there should be not warning if that value is ignored.</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974957"></a><a name="_Ref534008388">5<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="memory" name="memory">
+Memory Management</a>
+</a></h1>
+<p class="TextFontCX">About half the bugs in typical C programs can
+be attributed to memory management problems.&nbsp; Memory
+management bugs are notoriously difficult to detect through
+traditional techniques.&nbsp; Often, the symptom of the bug is far
+removed from its actual source.&nbsp; Memory management bugs often
+only appear sporadically and some bugs may only be apparent when
+compiler optimizations are turned on or the code is compiled on a
+different platform.&nbsp; Run-time tools offer some help, but are
+cumbersome to use and limited to detecting errors that occur when
+test cases are run.&nbsp; By detecting these errors statically, we
+can be confident that certain types of errors will never occur and
+provide verified documentation on the memory management behavior of
+a program.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">Splint can detect many memory management
+errors at compile time including using storage that may have been
+deallocated (Section 5.2), memory leaks&nbsp;(Section 5.2), or
+returning a pointer to stack-allocated storage&nbsp;(Section
+5.2.6).</p>
+<p align="right"><i><span style='font-size:9.0pt'>Yea, from the
+table of my memory I'll wipe away all trivial fond records, all
+saws of books,<br>
+all forms, all pressures past, that youth and observation copied
+there.</span></i><br>
+ <span style='font-size:9.0pt'>Hamlet prefers
+garbage&nbsp;collection (Shakespeare, Hamlet. Act I, Scene
+v)</span></p>
+<p class="afterlist">Most of these checks depend on annotations
+added to programs to document assumptions related to memory
+management and pointer values.&nbsp; By documenting these
+assumptions for function interfaces, variables, type definitions
+and structure fields, memory management bugs can be detected at
+their source &#8212; where an assumption is violated.&nbsp; In
+addition, precise documentation about memory management decisions
+makes it easier to change code.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974958"></a><a name="_Toc344355408">5.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Storage Model</a></h2>
+<p class="TextFontCX">This section describes execution-time
+concepts for describing the state of storage more precisely than
+can be done using standard C terminology.&nbsp; Certain uses of
+storage are likely to indicate program bugs, and are reported as
+anomalies.<a href="#_ftn3" name="_ftnref3" title=
+      ""><span class="MsoFootnoteReference"><b><span class=
+      "MsoFootnoteReference"><b><span style=
+      'font-size:11.0pt;font-family:"Times New Roman"'>[3]</span></b></span></b></span></a></p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint assumes a CLU-like object storage
+model.<a href="#_ftn4" name="_ftnref4" title=""><span class=
+"MsoFootnoteReference"><span class=
+"MsoFootnoteReference"><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>&nbsp;
+An <i>object</i> is a typed region of storage.&nbsp; Some objects
+use a fixed amount of storage that is allocated and deallocated
+automatically by the compiler.&nbsp; Other objects use dynamic
+storage that must be managed by the program.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Storage is <i>undefined</i> if it has not
+been assigned a value, and <i>defined</i> after it has been
+assigned a value.&nbsp; An object is <i>completely defined</i> if
+all storage that may be reached from it is defined.&nbsp; What
+storage is reachable from an object depends on the type and value
+of the object.&nbsp; For example, if <span class=
+"CodeText"><span style='font-size:10.0pt'>p</span></span> is a
+pointer to a structure, <span class="CodeText"><span style=
+'font-size:10.0pt'>p</span></span> is completely defined if the
+value of <span class="CodeText"><span style=
+'font-size:10.0pt'>p</span></span> is <span class=
+"CodeText"><span style='font-size:10.0pt'>NULL</span></span>, or if
+every field of the structure <span class=
+      "CodeText"><span style='font-size:10.0pt'>p</span></span>
+      points to is completely defined.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">When an expression is used as the left side
+of an assignment expression we say it is <i>used as an
+lvalue</i>.&nbsp; Its location in memory is used, but not its
+value.&nbsp; Undefined storage may be used as an lvalue since only
+its location is needed.&nbsp; When storage is used in any other
+way, such as on the right side of an assignment, as an operand to a
+primitive operator (including the indirection operator,
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>*</span></span>),<a href="#_ftn5" name=
+      "_ftnref5" title=""><span class=
+      "MsoFootnoteReference"><span class=
+      "MsoFootnoteReference"><span style=
+      'font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>
+      or as a function parameter, we say it is <i>used as an
+      rvalue</i>.&nbsp; It is an anomaly to use undefined storage
+      as an rvalue.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A <i>pointer</i> is a typed memory
+address.&nbsp; A pointer is either <i>live</i> or
+<i>dead</i>.&nbsp; A live pointer is either <span class=
+"CodeText"><span style='font-size:10.0pt'>NULL</span></span> or an
+address within allocated storage.&nbsp; A pointer that points to an
+object is an <i>object</i> pointer.&nbsp; A pointer that points
+inside an object (e.g., to the third element of an allocated block)
+is an <i>offset</i> pointer.&nbsp; A pointer that points to
+allocated storage that is not defined is an <i>allocated</i>
+pointer.&nbsp; The result of dereferencing an allocated pointer is
+undefined storage.&nbsp; Hence, it is an anomaly to use it as an
+rvalue.&nbsp; A dead (or &#8220;dangling&#8221;) pointer does not
+point to allocated storage.&nbsp; A pointer becomes dead if the
+storage it points to is deallocated (e.g., the pointer is passed to
+the <span class="CodeText"><span style=
+'font-size:10.0pt'>free</span></span> library function.)&nbsp; It
+is an anomaly to use a dead pointer as an rvalue.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">There is a special object <i>null</i>
+corresponding to the <span class="CodeText"><span style=
+'font-size:10.0pt'>NULL</span></span>pointer in a C program.&nbsp;
+A pointer that may have the value <span class=
+"CodeText"><span style='font-size:10.0pt'>NULL</span></span> is a
+<i>possibly-null</i> pointer.&nbsp; It is an anomaly to use a
+possibly-null pointer where a non-null pointer is expected (e.g.,
+certain function arguments or the indirection operator).</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974959"></a><a name="_Ref347476065"></a><a name=
+"_Ref347469133"></a><a name="_Ref347465595"></a><a name=
+"_Ref344893840"></a><a name="_Toc344355409">5.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Deallocation Errors</a></h2>
+<p class="TextFontCX">There are two kinds of deallocation errors
+with which we are concerned:&nbsp; deallocating storage when there
+are other live references to the same storage, or failing to
+deallocate storage before the last reference to it is lost.&nbsp;
+To handle these deallocation errors, we introduce a concept of an
+obligation to release storage.&nbsp; Every time storage is
+allocated, it creates an obligation to release the storage.&nbsp;
+This obligation is attached to the reference to which the storage
+is assigned.<a href="#_ftn6" name="_ftnref6" title=
+      ""><span class="MsoFootnoteReference"><span class=
+      "MsoFootnoteReference"><span style=
+      'font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>&nbsp;
+      Before the scope of the reference is exited or it is assigned
+      to a new value, the storage to which it points must be
+      released.&nbsp; Annotations&nbsp;can be used to indicate that
+      this obligation is transferred through a return value,
+      function parameter or assignment to an external
+      reference.</p>
+<p align="right"><i><span style='font-size:9.0pt'>&#8216;Tis in my
+memory lock&#8217;d, and you yourself shall keep the key of
+it.</span></i><br>
+<span style='font-size:9.0pt'>Ophelia prefers&nbsp;explicit
+deallocation (Hamlet. Act I, Scene iii)</span></p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974960">5.2.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Unshared References</a></h3>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span> annotation is used to
+indicate a reference is the only pointer to the object it points
+to.&nbsp; We can view the reference as having an obligation to
+release this storage.&nbsp; This obligation is satisfied by
+transferring it to some other reference in one of three ways:</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+pass it as an actual parameter corresponding to a formal parameter
+declared with an <span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span>
+annotation&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+assign it to an external reference declared with an
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>only</span></span> annotation</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+return it as a result declared with an <span class=
+"Annot"><span style='font-size:10.0pt'>only</span></span>
+annotation</p>
+<p class="afterlist">After the release obligation is transferred,
+the original reference is a dead pointer and the storage it points
+to may not be used.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">All obligations to release storage stem from
+primitive allocation routines (e.g., <span class=
+"CodeText"><span style='font-size:10.0pt'>malloc</span></span>),
+and are ultimately satisfied by calls to <span class=
+"CodeText"><span style='font-size:10.0pt'>free</span></span>.&nbsp;
+The standard library declared the primitive allocation and
+deallocation routines.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The basic memory allocator,
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>malloc</span></span>, is declared:</p>
+<p class="example"><a href="mailto:/*@only@*/">/*@only@*/</a>
+/*@null@*/ void *malloc (size_t size);</p>
+<p class="TextFontCX">It returns an object that is referenced only
+by the function return value.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The deallocator, <span class=
+"CodeText"><span style='font-size:10.0pt'>free</span></span>, is
+declared:<a href="#_ftn7" name="_ftnref7" title=
+      ""><span class="MsoFootnoteReference"><span class=
+      "MsoFootnoteReference"><span style=
+      'font-size:11.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a></p>
+<p class="example">void free (/*@only@*/ <a href=
+"mailto:/*@out@*/">/*@out@*/</a> <a href=
+"mailto:/*@null@*/">/*@null@*/</a> void *ptr);</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'width:193.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<a name="_Ref344990094"><span class="Keyword"><b><span style=
+'font-size:10.0pt;color:white'>only.c</span></b></span></a></p></td>
+<td valign="top" style=
+'width:225.0pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:193.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim"><i><span style=
+'font-size:8.0pt;font-family:Arial'>1&nbsp;</span></i>
+      <span style='font-size:9.5pt'>extern /*@only@*/ int
+      *glob;</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>/*@only@*/ int
+*</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>f (/*@only@*/ int
+*x, int *y,</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp; int
+*z)</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp; /*@globals
+glob;@*/</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>{</span></p>
+<p class="Verbatim"><i><span style=
+'font-size:8.0pt;font-family:Arial'>&nbsp;8</span></i>
+      <span style='font-size:9.5pt'>int *m = (int *)</span></p>
+<p class="Verbatim"><i><span style=
+'font-size:8.0pt;font-family:Arial'>&nbsp;9</span></i><span style='font-size:9.5pt'>
+&nbsp;&nbsp;&nbsp; malloc (sizeof (int));</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;</span></p>
+<p class="Verbatim"><i><span style=
+'font-size:8.0pt;font-family:Arial'>11</span></i>
+      <span style='font-size:9.5pt'>glob =
+      y;&nbsp;&nbsp;&nbsp;</span> <i><span style=
+      'font-size:9.5pt; font-family:"Times New Roman"'>Memory
+      leak</span></i></p>
+<p class="Verbatim"><i><span style=
+'font-size:8.0pt;font-family:Arial'>12</span></i>
+      <span style='font-size:9.5pt'>free (x);</span></p>
+<p class="Verbatim"><i><span style=
+'font-size:8.0pt;font-family:Arial'>13</span></i>
+      <span style='font-size:9.5pt'>*m =
+      *x;&nbsp;&nbsp;&nbsp;&nbsp;</span> <i><span style=
+      'font-size:9.5pt; font-family:"Times New Roman"'>Use after
+      free</span></i></p>
+<p class="Verbatim"><i><span style=
+'font-size:8.0pt;font-family:Arial'>14</span></i>
+      <span style='font-size:9.5pt'>return
+      z;&nbsp;&nbsp;&nbsp;</span> <i><span style=
+      'font-size:9.5pt; font-family:"Times New Roman"'>Memory leak
+      detected</span></i><i><span style=
+      'font-size:9.5pt;font-family:Arial'>&nbsp;</span></i></p>
+<p class="TextFontCX"><span style=
+'font-size: 9.5pt'>}</span></p></td>
+<td valign="top" style=
+'width:225.0pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint only.c</p>
+<p class="lclintrun">only.c:11: Only storage glob (type int *) not
+released</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+before assignment: glob = y</p>
+<p class="lclintrun">&nbsp;&nbsp; only.c:1: Storage glob becomes
+only</p>
+<p class="lclintrun">only.c:11: Implicitly temp storage y assigned
+to only:</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+glob = y</p>
+<p class="lclintrun">only.c:13: Dereference of possibly null
+pointer m: *m</p>
+<p class="lclintrun">&nbsp;&nbsp; only.c:8: Storage m may become
+null</p>
+<p class="lclintrun">only.c:13: Variable x used after being
+released</p>
+<p class="lclintrun">&nbsp;&nbsp; only.c:12: Storage x released</p>
+<p class="lclintrun">only.c:14: Implicitly temp storage z returned
+as only: z</p>
+<p class="lclintrun">only.c:14: Fresh storage m not released before
+return</p>
+<p class="lclintrun" style='page-break-after:avoid'>&nbsp;&nbsp;
+only.c:9: Fresh storage m
+allocated&nbsp;&nbsp;</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824610">Figure 6.&nbsp;
+Memory Management</a></p></td></tr></table>
+<p class="TextFontCX">The parameter to <span class=
+"CodeText"><span style='font-size:10.0pt'>free</span></span> must
+reference an unshared object.&nbsp; Since the parameter is declared
+using <span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span>, the caller may not use the
+referenced object after the call, and may not pass in a reference
+to a shared object.&nbsp; There is nothing special about
+<span class="CodeText"><span style=
+'font-size:10.0pt'>malloc</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>free</span></span>
+&#8212; their behavior can be described entirely in terms of the
+provided annotations.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref347468963"></a><a name="_Toc534974961"></a><a name=
+"_Ref347469360">5.2.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Temporary Parameters</a></h3>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>temp</span></span>&nbsp;annotation is used to
+declare a function parameter that is used temporarily by the
+function.&nbsp; An error is reported if the function releases the
+storage associated with a <span class="Annot"><span style=
+'font-size:10.0pt'>temp</span></span> formal parameter or creates
+new aliases to it that are visible after the function
+returns.&nbsp; Any storage may be passed as a <span class=
+"Annot"><span style='font-size:10.0pt'>temp</span></span>
+parameter, and it satisfies its original memory constraints after
+the function returns.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974962">5.2.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Owned and Dependent References</a></h3>
+<p class="TextFontCX">In real programs it is sometimes necessary to
+have storage that is shared between several possibly
+references.&nbsp; The <span class="Annot"><span style=
+'font-size:10.0pt'>owned</span></span> and <span class=
+"Annot"><span style='font-size:10.0pt'>dependent</span></span>
+annotations provide a more flexible way of managing storage, at the
+cost of less checking.&nbsp; The <span class=
+      "Annot"><span style='font-size:10.0pt'>owned</span></span>
+      annotation denotes a reference with an obligation to release
+      storage.&nbsp; Unlike <span class="Annot"><span style=
+      'font-size:10.0pt'>only</span></span>, however, other
+      external references marked with <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>dependent</span></span> annotations may
+      share this object.&nbsp; It is up to the programmer to ensure
+      that the lifetime of a <span class="Annot"><span style=
+      'font-size:10.0pt'>dependent</span></span> reference is
+      contained within the lifetime of the corresponding
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>owned</span></span> reference.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974963"></a><a name="_Ref347805800">5.2.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Keep Parameters</a></h3>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>keep</span></span> annotation is similar to
+<span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span>, except the caller may use
+the reference after the call.&nbsp; The called function must assign
+the <span class="Annot"><span style=
+'font-size:10.0pt'>keep</span></span> parameter to an
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>only</span></span> reference, or pass it
+      as a <span class="Annot"><span style=
+      'font-size:10.0pt'>keep</span></span> parameter to another
+      function.&nbsp; It is up to the programmer to make sure that
+      the calling function does not use this reference after it is
+      released.&nbsp; The <span class="Annot"><span style=
+      'font-size:10.0pt'>keep</span></span> annotation is useful
+      for adding an object to a collection (e.g., a symbol table),
+      where it is known that it will not be deallocated until the
+      collection is.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974964"></a><a name="_Ref347469304">5.2.5<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Shared References</a></h3>
+<p class="TextFontCX">If Splint is used to check a program designed
+to be used in a garbage-collected environment, there may be storage
+that is shared by one or more references and never explicitly
+released.&nbsp; The <span class="Annot"><span style=
+'font-size:10.0pt'>shared</span></span> annotation declares storage
+that may be shared arbitrarily, but never released.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974965"></a><a name="_Ref348341639">5.2.6<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Stack References</a></h3>
+<p class="TextFontCX">Local variables that are not allocated
+dynamically are stored on a call stack. &nbsp;When a function
+returns, its stack frame is deallocated, destroying the storage
+associated with the function&#8217;s local variables.&nbsp; A
+memory error occurs if a pointer into this storage is live after
+the function returns.&nbsp; Splint detects errors involving stack
+references exported from a function through return values or
+assignments to references reachable from global variables or actual
+parameters.&nbsp; No annotations are needed to detect stack
+reference errors, since it is clear from a declaration if storage
+is allocated on the function stack.&nbsp; Figure 7 gives and
+example of errors reported involving stack-allocated storage.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'width:2.25in;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>stack.c</span></b></span></p></td>
+<td valign="top" style=
+'width:256.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:2.25in;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim">int *glob;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">/*@dependent@*/ int *</p>
+<p class="Verbatim">&nbsp; f (int **x)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; int sa[2] = { 0, 1 };</p>
+<p class="Verbatim">&nbsp; int loc = 3;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;9</span></span> glob = &amp;loc;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>10</span></span> *x = &amp;sa[0];</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>12</span></span> return &amp;loc;</p>
+<p class="Verbatim">}&nbsp;</p></td>
+<td valign="top" style=
+'width:256.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint stack.c</p>
+<p class="lclintrun">stack.c:12: Stack-allocated storage &amp;loc
+reachable</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+from return value: &amp;loc</p>
+<p class="lclintrun">stack.c:12: Stack-allocated storage *x
+reachable from</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+parameter x</p>
+<p class="lclintrun">&nbsp;&nbsp; stack.c:10: Storage *x becomes
+stack</p>
+<p class="lclintrun">stack.c:12: Stack-allocated storage glob
+reachable</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+from global glob</p>
+<p class="lclintrun">&nbsp;&nbsp; stack.c:9: Storage glob becomes
+stack</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="TextFontCX" align="left" style=
+'text-align:left;page-break-after:avoid'><i>A</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>dependent</span></span> <i>annotation is
+      used on the return value.&nbsp; Without this, other warnings
+      would be reported, since the result would have an
+      implicit</i> <span class="Annot"><span style=
+      'font-size: 10.0pt'>only</span></span>
+      <i>annotation.</i></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:5.05pt;padding-right: 9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824611"></a><a name=
+"_Ref534821941">Figure 7</a>.&nbsp; Stack-Allocated
+Storage</p></td></tr></table></center>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974966">5.2.7<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Inner Storage</a></h3>
+<p class="TextFontCX">An annotation always applies to the outermost
+level of storage.&nbsp; For example,</p>
+<p class="example">/*@only@*/ int **x;</p>
+<p class="beforelist">declares <span class=
+      "CodeText"><span style='font-size:10.0pt'>x</span></span> as
+      an unshared pointer to a pointer to an <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>.&nbsp; The <span class=
+      "Flag"><span style='font-size:10.0pt'>only</span></span>
+      annotation applies to <span class="CodeText"><span style=
+      'font-size:10.0pt'>x</span></span>, but not to <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>*x</span></span>.&nbsp; To apply
+      annotations to inner storage a type definition may be
+      used:</p>
+<p class="Verbatim">&nbsp; typedef /*@only@*/ int *oip;</p>
+<p class="Verbatim">&nbsp; /*@only@*/ oip *x;</p>
+<p class="afterlist">Now, x is an <span class=
+      "Annot"><span style='font-size:10.0pt'>only</span></span>
+      pointer to an <span class="Annot"><span style=
+      'font-size:10.0pt'>oip</span></span>, which is an
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>only</span></span> pointer to an
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>int</span></span>.</p>
+<p class="afterlist">When annotations are used in type definitions,
+they may be overridden in instance declarations.&nbsp; For
+example,</p>
+<p class="example">/*@dependent@*/ oip x;</p>
+<p class="TextFontCX">makes <span class=
+      "CodeText"><span style='font-size:10.0pt'>x</span></span> a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>dependent</span></span> pointer to an
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>.&nbsp; Another way to
+      apply annotations to inner storage is to use a state clause
+      (see Section 7.4).</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974967"></a><a name="_Ref347812243"></a><a name=
+"_Ref344893978"></a><a name="_Toc344355410">5.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Implicit Memory Annotations</a></h2>
+<p class="TextFontCX">Since it is important that Splint can check
+unannotated programs effectively, the meaning of declarations with
+no memory annotations is chosen to minimize the number of
+annotations needed to get useful checking on an unannotated
+program.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">An implicit memory management annotation may
+be assumed for declarations with no explicit memory management
+annotation.&nbsp; Implicit annotations are checked identically to
+the corresponding explicit annotation, except error messages
+indicate that they result from an implicit annotation.&nbsp; Figure
+8 illustrates some implicit annotations.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Unannotated function parameters are assumed
+to be <span class="Annot"><span style=
+'font-size:10.0pt'>temp</span></span>.&nbsp; This means if memory
+checking is turned on for an unannotated program, all functions
+that release storage referenced by a parameter or assign a global
+variable to alias the storage will produce error messages.&nbsp;
+(Controlled by <span class="Flag"><span style=
+'font-size:10.0pt'>paramimptemp</span></span>.)</p>
+<p class="TextFontCX">&nbsp;</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'width:423.0pt;margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr style='page-break-inside:avoid'>
+<td colspan="2" valign="top" style=
+'width:423.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>implicit.c</span></b></span></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:207.0pt;border-top:none;border-left: solid black 1.5pt;border-bottom:solid black 1.5pt;border-right:none; padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim">typedef struct {</p>
+<p class="Verbatim">&nbsp;&nbsp; <span class=
+"implicit"><b>only</b></span> char *name;</p>
+<p class="Verbatim">&nbsp;&nbsp; int&nbsp;&nbsp; val;</p>
+<p class="Verbatim">} *rec;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">extern <span class=
+"implicit"><b>only</b></span> rec rec_last ;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">extern <span class=
+"implicit"><b>only</b></span> rec</p>
+<p class="Verbatim">&nbsp;&nbsp; rec_create (<span class=
+"implicit"><b>temp</b></span> char *name,</p>
+<p class="Verbatim">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+int val) ;</p>
+<p class="TextFontCX"><i>Annotations in</i> <span class=
+"Keyword"><b><i><span style=
+'font-size:10.0pt;color:windowtext'>italics</span></i></b></span>
+<i>are not present in the code, but may be implied depending on
+flag settings.</i></p></td>
+<td valign="top" style=
+'width:3.0in;border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align:left'>
+<i>Implicit</i> <span class="Annot"><i><span style=
+'font-size:10.0pt'>only</span></i></span> <i>annotation on mutable
+structure field if</i> <span class="Flag"><span style=
+'font-size:10.0pt'>structimponly</span></span> <i>is on.</i></p>
+<p class="lclintrun"><i>&nbsp;</i></p>
+<p class="TextFontCX" align="left" style='text-align:left'>
+<i>Implicit</i> <span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span> <i>annotation on mutable
+global variables if</i> <span class="Flag"><span style=
+'font-size:10.0pt'>globimponly</span></span> <i>is on.</i></p>
+<p class="TextFontCX" align="left" style='text-align:left'>
+<i>&nbsp;</i></p>
+<p class="TextFontCX" align="left" style=
+'text-align:left;page-break-after:avoid'><i>Implicit</i>
+<span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span> <i>annotation on mutable
+function result if</i> <span class="Flag"><span style=
+'font-size: 10.0pt'>retimponly</span></span> <i>is set.
+Implicit</i> <span class="Annot"><span style=
+'font-size:10.0pt'>temp</span></span> <i>annotation on mutable
+parameter if</i> <span class="Flag"><span style=
+'font-size:10.0pt'>paramimptemp</span></span> <i>is
+set.</i></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824612"></a><a name=
+"_Ref534822006">Figure 8</a>.&nbsp; Implicit
+Annotations</p></td></tr></table></center>
+<p class="TextFontCX">Unannotated return values, structure fields
+and global variables are assumed to be <span class=
+"Annot"><span style='font-size:10.0pt'>only</span></span>.&nbsp;
+With implicit annotations (on by default), turning on memory
+checking for an unannotated program will produce errors for any
+function that does not return unshared storage or assignment of
+shared storage to a global variable or structure field.&nbsp; If an
+exposure qualifier is used (see Section 6.2), the implied
+<span class="Annot"><span style=
+'font-size: 10.0pt'>dependent</span></span> annotation is used
+instead of the more generally implied <span class=
+"Annot"><span style='font-size:10.0pt'>only</span></span>
+annotation.&nbsp; (Controlled by <span class=
+      "Flag"><span style='font-size:10.0pt'>retimponly</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>structimponly</span></span> and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>globimponly</span></span>.&nbsp; The
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>allimponly</span></span>&nbsp;flag sets
+      all of the implicit only flags.) &nbsp;&nbsp;</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974968"></a><a name="_Ref534970957"></a><a name=
+"_Ref347469058"></a><a name="_Ref344907383"></a><a name=
+"_Toc344355411">5.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Reference Counting</a></h2>
+<p class="TextFontCX">Another approach to memory management is to
+add a field to a type to explicitly keep track of the number of
+references to that storage.&nbsp; Every time a reference is added
+or lost the reference count is adjusted accordingly; if it would
+become zero, the storage is released.&nbsp; Reference counting it
+difficult to do without automatic checking since it is easy to
+forget to increment or decrement the reference count, and
+exceedingly difficult to track down these errors.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint supports reference counting by using
+annotations to constrain the use of reference counted storage in a
+manner similar to other memory management annotations.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A reference counted type is declared using
+the <span class="Annot"><span style=
+'font-size:10.0pt'>refcounted</span></span> annotation.&nbsp; Only
+pointer to <span class="CodeText"><span style=
+'font-size:10.0pt'>struct</span></span> types may be declared as
+<span class="Annot"><span style=
+'font-size:10.0pt'>refcounted</span></span>, since reference
+counted storage must have a field to count the references.&nbsp;
+One field in the structure (or integral type) is preceded by the
+<span class="Annot"><span style=
+'font-size:10.0pt'>refs</span></span> annotation to indicate that
+the value of this field is the number of live references to the
+structure. For example (in <span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial; color:windowtext'>rstring.h</span></span>),</p>
+<p class="Verbatim" style='margin-top:6.0pt'>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; typedef /*@abstract@*/
+/*@refcounted@*/ struct {</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;
+/*@refs@*/ int refs;</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; char
+*contents;</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } *rstring;</p>
+<p class="afterlist">declares <span class=
+      "CodeText"><span style='font-size:10.0pt'>rstring</span></span>
+      as an abstract, reference-counted type.&nbsp; The
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>refs</span></span> field counts the number
+      of references and the <span class="CodeText"><span style=
+      'font-size:10.0pt'>contents</span></span> field holds the
+      contents of a string.</p>
+<p class="TextFontCX">&nbsp;</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'width:425.5pt;margin-left:.2in;border-collapse:collapse'>
+<tr>
+<td valign="top" style=
+'width:267.05pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>rstring.c</span></b></span></p></td>
+<td valign="top" style=
+'width:158.45pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:267.05pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim"><span style='font-size:9.0pt'># include
+"rstring.h"</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>static rstring
+rstring_ref (rstring r)</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;
+r-&gt;refs++;</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>6</span></span> <span style=
+'font-size:9.0pt'>return r;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>rstring
+rstring_first (rstring r1, rstring r2)</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>{</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp; if (strcmp
+(r1-&gt;contents, r2-&gt;contents) &lt; 0)</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>12</span></span><span style=
+'font-size:9.0pt'>&nbsp;&nbsp; return r1;</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>&nbsp;&nbsp;
+else</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>14</span></span><span style=
+'font-size:9.0pt'>&nbsp;&nbsp;&nbsp;&nbsp; return rstring_ref
+(r2);</span></p>
+<p class="Verbatim"><span style='font-size:9.0pt'>}</span></p></td>
+<td valign="top" style=
+'width:158.45pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint rstring.c</p>
+<p class="lclintrun">rstring.c:12: Reference counted&nbsp;</p>
+<p class="lclintrun">&nbsp;&nbsp; storage returned without
+modifying</p>
+<p class="lclintrun">&nbsp;&nbsp; reference count: r1</p>
+<p class="lclintrun"><i>&nbsp;</i></p>
+<p class="TextFontCX" align="left" style='text-align:left'>
+<i><span style='font-size:10.0pt'>No error is reported for line 6
+since the reference count was incremented.&nbsp; No error is
+reported for line 14, since</span></i> <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>rstring_ref</span></i></span><i><span style='font-size:10.0pt'>
+returns a new reference.</span></i></p>
+<p class="TextFontCX" align="left" style=
+'text-align:left;page-break-after:avoid'><span style=
+'font-size:10.0pt'>&nbsp;</span></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       align="center">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:.1in;padding-right: 0in;padding-bottom:.1in;padding-left:0in'>
+<p class="MsoCaption"><a name="_Toc534824613"></a><a name=
+"_Ref534822069">Figure 9</a>.&nbsp; Reference
+Counting</p></td></tr></table></center>
+<br clear="all">
+ 
+<p class="TextFontCX">All functions that return <span class=
+"Annot"><span style='font-size:10.0pt'>refcounted</span></span>
+storage must increase the reference count before returning.&nbsp;
+Splint cannot determine if the reference count was increased, so
+any function that directly returns a reference to
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>refcounted</span></span> storage will
+      produce an error.&nbsp; This is avoided, by using a function
+      to return a new reference (e.g., <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>rstring_ref</span></span> in Figure
+      9).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A reference counted type may be passed as a
+<span class="Annot"><span style=
+'font-size:10.0pt'>temp</span></span> or <span class=
+"Annot"><span style='font-size:10.0pt'>dependent</span></span>
+parameter.&nbsp; It may not be passed as an <span class=
+"Annot"><span style='font-size:10.0pt'>only</span></span>
+parameter.&nbsp; Instead, the <span class=
+      "Annot"><span style='font-size:10.0pt'>killref</span></span>
+      annotation is used to denote a parameter whose reference is
+      eliminated by the function call.&nbsp; Like <span class=
+      "Annot"><span style='font-size:10.0pt'>only</span></span>
+      parameters, an actual parameter corresponding to a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>killref</span></span> formal parameter may
+      not be used in the calling function after the call.&nbsp;
+      Splint checks that the implementation of a function releases
+      all <span class="Annot"><span style=
+      'font-size:10.0pt'>killref</span></span> parameters, either
+      by passing them as <span class="Annot"><span style=
+      'font-size: 10.0pt'>killref</span></span> parameters, or
+      assigning or returning them without increasing the reference
+      count.</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref348845247"></a><a name="_Ref348796245"></a><a name=
+"_Toc344355413"></a><a name="_Ref344355210"></a><a name=
+"_Ref343064238"></a><a name="_Ref343064188"></a><a name=
+"_Toc534974969"></a><a name="_Ref534642796"></a><a name=
+"_Ref534642146">6<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="sharing" name="sharing">
+Sharing</a></a></h1>
+<p class="TextFontCX">Errors involving unexpected sharing of
+storage can cause serious problems.&nbsp; Undocumented sharing may
+lead to unpredictable modifications, and some library calls (e.g.,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>strcpy</span></span>) have undefined behavior if
+parameters share storage.&nbsp; Another class of sharing errors
+occurs when clients of an abstract type may obtain a reference to
+mutable storage that is part of the abstract representation.&nbsp;
+This exposes the representation of the abstract type, since clients
+may modify an instance of the abstract type indirectly through this
+shared storage.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref534977801"></a><a name="_Toc534974970">6.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Aliasing</a></h2>
+<p class="TextFontCX">Splint detects errors involving dangerous
+aliasing of parameters.&nbsp; Some of these errors are already
+detected through the standard memory annotations (e.g.,
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>only</span></span>&nbsp;parameters may not
+      be aliases.)&nbsp;&nbsp; Two additional annotations are
+      provided for constraining aliasing of parameters and return
+      values.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974971"></a><a name="_Ref347469444">6.1.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Unique Parameters</a></h3>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>unique</span></span>&nbsp;annotation denotes a
+parameter that may not be aliased by any other storage reachable
+from the function implementation &#8212; that is, any storage
+reachable through the other parameters or global variables used by
+the function.&nbsp; The <span class="Annot"><span style=
+'font-size:10.0pt'>unique</span></span> annotation places similar
+constraints on function parameters as the <span class=
+"Annot"><span style='font-size:10.0pt'>only</span></span>
+annotation, but it does not transfer the obligation to release
+storage.&nbsp; Splint will report an error if a <span class=
+"Annot"><span style='font-size:10.0pt'>unique</span></span>
+parameter may be aliased by another parameter or global
+variable.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint reports an error if a function returns
+a reference to storage reachable from one of its parameters (if
+<span class="Flag"><span style=
+'font-size:10.0pt'>retalias</span></span> is on) since this may
+introduce unexpected aliases in the body of the calling function
+when the result is assigned.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Figure 10 illustrated sharing checks.&nbsp;
+An error is reported since the first parameter to the library
+function <span class="CodeText"><span style=
+'font-size:10.0pt'>strcpy</span></span> is declared with
+unique.&nbsp; If a <span class="CodeText"><span style=
+'font-size:10.0pt'>unique</span></span> qualifier were added to the
+parameter declaration for <span class="CodeText"><span style=
+'font-size:10.0pt'>s</span></span> or <span class=
+"CodeText"><span style='font-size:10.0pt'>t</span></span>, no error
+would be reported.&nbsp;</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>unique.c</span></b></span></p></td>
+<td valign="top" style=
+'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim"># include &lt;string.h&gt;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">void&nbsp;</p>
+<p class="Verbatim">capitalize (/*@out@*/ char *s,</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;char *t)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;7</span></span>&nbsp; strcpy (s, t);</p>
+<p class="Verbatim">&nbsp;&nbsp; *s = toupper (*s);</p>
+<p class="Verbatim">}</p></td>
+<td valign="top" style=
+'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint unique.c</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">unique.c: (in function capitalize)</p>
+<p class="lclintrun">unique.c:7: Parameter 1 (s) to function strcpy
+is</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; declared unique but may be
+aliased externally by</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; parameter 2 (t)</p>
+<p class="lclintrun">&nbsp;</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:6.5pt;padding-right: 9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824614"></a><a name=
+"_Ref534822167">Figure 10</a>.&nbsp; Unique
+parameters</p></td></tr></table></center>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974972"></a><a name="_Ref347469448">6.1.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Returned Parameters</a></h3>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>returned</span></span> annotation denotes a
+parameter that may be aliased by the return value.&nbsp; Splint
+checks the call assuming the result may be an alias to the
+<span class="Annot"><span style=
+'font-size:10.0pt'>returned</span></span> parameter.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Consider the following code excerpt:</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="Verbatim">extern intSet intSet_insert (/*@returned@*/
+intSet s, int x);</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">intSet intSet_singleton (int x)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>7</span></span>&nbsp; return (intSet_insert
+(intSet_new (), x));</p>
+<p class="TextFontCX">}</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Without the <span class=
+      "Annot"><span style='font-size:10.0pt'>returned</span></span>
+      qualifier on the parameter to <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>intSet_insert</span></span>, a memory leak
+      error would be reported for line 7, since the <span class=
+      "Annot"><span style='font-size:10.0pt'>only</span></span>
+      storage returned by <span class="CodeText"><span style=
+      'font-size:10.0pt'>intSet_new</span></span> is not
+      released.&nbsp; Because of the <span class=
+      "Annot"><span style='font-size:10.0pt'>returned</span></span>
+      qualifier, Splint assumes the result of <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>intSet_insert</span></span> is the same
+      storage as its first parameter, in this case the storage
+      returned by <span class="CodeText"><span style=
+      'font-size:10.0pt'>intSet_new</span></span>.&nbsp; No error
+      is reported, since the only storage is then transferred
+      through the return value (which has an implicit only
+      annotation, see Section 5.3).</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref344907981"></a><a name="_Ref344894258"></a><a name=
+"_Ref344809320"></a><a name="_Toc344355414"></a><a name=
+"_Toc534974973"></a><a name="_Ref345591408"></a><a name=
+"_Ref345591053">6.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Exposure</a></h2>
+<p class="TextFontCX">Splint detects places where the
+representation of an abstract type is exposed.&nbsp; This occurs if
+a client has a pointer to storage that is part of the
+representation of an instance of the abstract type.&nbsp; The
+client can then modify or examine the storage this points to, and
+manipulate the value of the abstract type instance without using
+its operations.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">There are three ways a representation may be
+exposed:</p>
+<p class="TextFontCX" style=
+'margin-left:.25in; text-indent:-.25in'>1.<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Returning (or assigning to a global variable) an object that
+includes a pointer to a mutable component of an abstract
+type&nbsp;representation.&nbsp; (Controlled by <span class=
+"Flag"><span style=
+'font-size:10.0pt'>ret-expose</span></span>).</p>
+<p class="TextFontCX" style=
+'margin-left:.25in; text-indent:-.25in'>2.<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Assigning a mutable component of an abstract object to storage
+reachable from an actual parameter or a global variable that may be
+used after the call. &nbsp;&nbsp;This means the client may
+manipulate the abstract object using the actual parameter after the
+call.&nbsp; Note that if the corresponding formal parameter is
+declared <span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span>, the caller may not use the
+actual parameter after the call so the representation is not
+exposed.&nbsp; (Controlled by <span class="Flag"><span style=
+'font-size:10.0pt'>assign-expose</span></span>).</p>
+<p class="TextFontCX" style=
+'margin-left:.25in; text-indent:-.25in'>3.<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Casting mutable storage to or from an abstract type.&nbsp;
+(Controlled by <span class="Flag"><span style=
+'font-size:10.0pt'>cast-expose</span></span>).</p>
+<p class="afterlist">Annotations may be used to allow exposed
+storage to be returned safely by restricting how the caller may use
+the returned storage.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974974"></a><a name="_Ref347469553">6.2.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Read-Only Storage</a></h3>
+<p class="beforelist">It is often useful for a function to return a
+pointer to internal storage (or an instance of a mutable abstract
+type) that is intended only as an <i>observer</i>.&nbsp; The caller
+may use the result, but should not modify the storage it points
+to.&nbsp; For example, consider a na&#239;ve implementation of the
+<span class="CodeText"><span style=
+'font-size:10.0pt'>employee_getName</span></span> operation for the
+abstract <span class="CodeText"><span style=
+'font-size:10.0pt'>employee</span></span> type:</p>
+<p class="Verbatim">&nbsp;&nbsp; typedef /*@abstract@*/ struct
+{</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; char *name;</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int id;</p>
+<p class="Verbatim">&nbsp;&nbsp; } *employee;</p>
+<p class="Verbatim">&nbsp;&nbsp; &#8230;</p>
+<p class="Verbatim">&nbsp;&nbsp; char *employee_getName (employee
+e) { return e-&gt;name; }</p>
+<p class="afterlist">Splint produces a message to indicate that the
+return value exposes the representation.&nbsp; One solution would
+be to return a fresh copy of <span class=
+      "CodeText"><span style='font-size:10.0pt'>e-&gt;name</span></span>.&nbsp;
+      This is expensive, though, especially if we expect
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>employee_getName</span></span> is used
+      mainly just to get a string for searching or printing.&nbsp;
+      Instead, we could change the declaration of <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>employee_getName</span></span> to:</p>
+<p class="example">extern /*@observer@*/ char *employee_getName
+(employee e);</p>
+<p class="TextFontCX">Now, the original implementation is
+correct.&nbsp; The declaration indicates that the caller may not
+modify the result, so it is acceptable to return shared
+storage.&nbsp; (The program must also not use the returned observer
+storage after any other calls to the abstract type module using the
+same parameter.&nbsp; Splint does not attempt to check this, and in
+practice it is rarely a problem.)&nbsp; Splint checks that the
+caller does not modify the return value.&nbsp; An error is reported
+if observer storage is modified directly, passed as a function
+parameter that may be modified, assigned to a global variable or
+reference derivable from a global variable that is not declared
+with an <span class="Annot"><span style=
+'font-size: 10.0pt'>observer</span></span> annotation , or returned
+as a function result or a reference derivable from the function
+result that is not annotation with an <span class=
+"Annot"><span style='font-size:10.0pt'>observer</span></span>
+annotation.</p>
+<h4 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref347469563"></a><a name="_Ref348017065">String
+Literals</a></h4>
+<p class="TextFontCX">A program that attempts to modify&nbsp;a
+string literal has undefined&nbsp;behavior [ISO, 6.4.5]. This is
+not enforced by most C compilers, and can lead to particularly
+pernicious bugs that only appear when optimizations are turned on
+and the compiler attempts to minimize storage for string
+literals.&nbsp; Splint can be used to check that string literals
+are not modified, by treating them as -<span class=
+"Annot"><span style=
+'font-size:10.0pt'>observer</span></span>&nbsp;storage.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>+read-only-strings</span></span> is set (default
+in standard mode), Splint will report an error if a string literal
+is modified.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974975">6.2.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Exposed Storage</a></h3>
+<p class="TextFontCX">Sometimes it is necessary to expose the
+representation of an abstract type.&nbsp; This may be evidence of a
+design flaw, but in some cases is justified for efficiency
+reasons.&nbsp; The <span class="Annot"><span style=
+'font-size:10.0pt'>exposed</span></span> annotation&nbsp;denotes
+storage that is exposed.&nbsp; It may be used on a return value for
+results that reference storage internal to an abstract
+representation, on a parameter value to indicate a parameter that
+may be assigned directly to part of an abstract representation
+(note that if the parameter is annotated with <span class=
+"Annot"><span style='font-size:10.0pt'>only</span></span>, it is
+not an error to assign it to part of an abstract representation,
+since the caller may not use the storage after the call returns),
+or on a field of an abstract representation to indicate that
+external references to the storage may exist.&nbsp; <a name=
+"_Toc344355415"></a><a name="_Ref343064165"></a><a name=
+"_Ref347254440"></a><a name="_Ref347169365">An error is reported
+if</a> <span class="Annot"><span style=
+'font-size:10.0pt'>exposed</span></span> storage is released, but
+unlike an <span class="Annot"><span style=
+'font-size:10.0pt'>observer</span></span>, no error is reported if
+it is modified.&nbsp; Figure 11 shows examples of exposure problems
+detected by Splint.</p>
+<p class="TextFontCX">&nbsp;</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:6.75pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr>
+<td width="45%" valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>exposure.c</span></b></span></p></td>
+<td valign="top" style=
+'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim"># include "employee.h"</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">char *</p>
+<p class="Verbatim">employee_getName (employee e)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>6</span></span>&nbsp; return e-&gt;name;</p>
+<p class="Verbatim">}</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">/*@observer@*/ char *</p>
+<p class="Verbatim">employee_obsName (employee e)</p>
+<p class="Verbatim">{ return e-&gt;name; }</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">/*@exposed@*/ char *</p>
+<p class="Verbatim">employee_exposeName (employee e)</p>
+<p class="Verbatim">{ return e-&gt;name; }</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">void</p>
+<p class="Verbatim">employee_capName (employee e)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; char *name;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">&nbsp; name = employee_obsName (e);</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>23</span></span> *name = toupper (*name);</p>
+<p class="Verbatim">}</p></td>
+<td valign="top" style=
+'border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint exposure.c +checks</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">exposure.c:6: Function returns reference
+to</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+parameter e: e-&gt;name</p>
+<p class="lclintrun">exposure.c:6: Return value exposes rep of</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+employee: e-&gt;name</p>
+<p class="lclintrun">exposure.c:6: Released storage e-&gt;name
+reachable</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+from parameter at return point</p>
+<p class="lclintrun">&nbsp;&nbsp; exposure.c:6: Storage e-&gt;name
+is released</p>
+<p class="lclintrun">exposure.c:23: Suspect modification of
+observer</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+name: *name = toupper(*name)</p>
+<p class="TextFontCX" style='page-break-after: avoid'>&nbsp;</p>
+<p class="TextFontCX" align="left" style=
+'text-align:left;page-break-after:avoid'><i><span style=
+'font-size: 10.0pt'>Three messages are reported for line 6 where a
+mutable field of an abstract type is returned with no sharing
+qualifier (without</span></i> <span class="Flag"><span style=
+'font-size:10.0pt'>+checks</span></span><i><span style=
+'font-size:10.0pt'>only the third one would be reported.)&nbsp; The
+error for line 23 reports a modification of an observer.&nbsp; If
+the call in line 22 were changed to call</span></i>
+      <span class="CodeText"><span style=
+      'font-size: 10.0pt'>employee_exposeName</span></span><i><span style='font-size:10.0pt'>
+, no error would be reported.</span></i></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824615">Figure 11.&nbsp;
+Exposure</a></p></td></tr></table></center>
+<p class="TextFontCX">&nbsp;</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref361649198"></a><a name="_Ref361649165"></a><a name=
+"_Ref354415790"></a><a name="_Ref350062908"></a><a name=
+"_Ref348845273"></a><a name="_Ref345591297"></a><a name=
+"_Ref344916609"></a><a name="_Ref344894369"></a><a name=
+"_Ref344891459"></a><a name="_Ref344798185"></a><a name=
+"_Toc344355418"></a><a name="_Toc534974976"></a><a name=
+"_Ref534014913"></a><a name="_Ref534014715"></a><a name=
+"_Ref348871484">7<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="function" name="function">
+Function Interfaces</a></a></h1>
+<p class="TextFontCX">Functions communicate with their calling
+environment through an interface.&nbsp; The caller communicates the
+values of actual parameters and global variables to the function,
+and the function communicates to the caller through the return
+value, global variables and storage reachable from the actual
+parameters.&nbsp; By keeping interfaces narrow (restricting the
+amount of information visible across a function interface), we can
+understand and implement functions independently.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A function prototype documents the interface
+to a function.&nbsp; It serves as a contract between the function
+and its caller.&nbsp; In early versions of C, the function
+&#8220;prototype&#8221; was very limited.&nbsp; It described the
+type returned by the function but nothing about its
+parameters.&nbsp; ANSI C (1989) provided function prototypes with
+the ability to add information on the number and types of parameter
+to a function.&nbsp; Splint provides the means to express much more
+about a function interface such as what global variable the
+function may use and what values visible to the caller it may
+modify.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The extra interface information places
+constraints on both how the function may be called and how it may
+be implemented.&nbsp; Splint reports places where these constraints
+are not satisfied.&nbsp; Typically, these indicate bugs in the code
+or errors in the interface documentation.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">This section describes annotations that may
+be added to a function declaration to document what global
+variables the function implementation may use and what values
+visible to its caller it may modify.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974977"></a><a name="_Ref348845225"></a><a name=
+"_Ref344908335"></a><a name="_Ref344892358"></a><a name=
+"_Toc344355403">7.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Modifications</a></h2>
+<p class="TextFontCX">The modifies clause lists what values visible
+to the caller may be modified by a function.&nbsp; Modifies clauses
+limit what values a function may modify, but they do not require
+that listed values are always modified.&nbsp; The declaration,</p>
+<p class="example">int f (int *p, int *q) /*@modifies *p@*/;</p>
+<p class="TextFontCX">declares a function <span class=
+"CodeText"><span style='font-size:10.0pt'>f</span></span> that may
+modify the value pointed to by its first argument but may not
+modify the value of its second argument or any global state.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint checks that a function does not modify
+any caller-visible value not encompassed by its modifies clause and
+does modify all values listed in its modifies clause on some
+possible execution of the function.&nbsp; Figure 12 shows an
+example of modifies checking done by Splint.</p>
+<p class="TextFontCX">&nbsp;</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style='margin-left:5.4pt;border-collapse:collapse'
+width="80%">
+<tr>
+<td width="40%" valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<a name="_Ref344908343"><span class="Keyword"><b><span style=
+'font-size:10.0pt;color:white'>modify.c</span></b></span></a></p></td>
+<td width="60%" valign="top" style=
+'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr style='height:120.9pt'>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>
+<p class="Verbatim">void setx (int *x, int *y)</p>
+<p class="Verbatim">&nbsp; /*@modifies *x@*/</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>4</span></span>&nbsp; *y = *x;</p>
+<p class="Verbatim">}</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">void sety (int *x, int *y)</p>
+<p class="Verbatim">&nbsp; /*@modifies *y@*/</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp;&nbsp; setx (y, x);</p>
+<p class="Verbatim">}</p></td>
+<td width="60%" valign="top" style=
+'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>
+<p class="lclintrun">&gt; splint modify.c +checks</p>
+<p class="lclintrun">modify.c:4: Undocumented modification of *y:
+*y = *x</p>
+<p class="lclintrun">modify.c:5: Suspect object listed in modifies
+of setx</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+not modified: *x</p>
+<p class="lclintrun">&nbsp;&nbsp; modify.c:1: Declaration of
+setx</p>
+<p class="TextFontCX"><i><span style=
+'font-size: 10.0pt'>&nbsp;</span></i></p>
+<p class="TextFontCX" style='page-break-after: avoid'>
+<i><span style='font-size:10.0pt'>There are
+n</span></i><i><span style='font-size:10.0pt'>o errors
+for</span></i> <span class="CodeText"><span style=
+'font-size:10.0pt'>sety</span></span><i><span style=
+'font-size:10.0pt'>&#8211; the call to</span></i>
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>setx</span></span><i><span style=
+      'font-size:10.0pt'>modifies the value<br>
+ pointed to by its first parameter (</span></i><span class=
+"CodeText"><span style=
+'font-size:10.0pt'>y</span></span><i><span style=
+'font-size:10.0pt'>) as documented by the<br>
+ modifies clause.&nbsp; The</span></i> <span class=
+"Flag"><span style=
+'font-size:10.0pt'>checks</span></span><i><span style=
+'font-size:10.0pt'>mode turns on</span></i> <span class=
+"Flag"><span style=
+'font-size:10.0pt'>mustmod</span></span><i><span style=
+'font-size:10.0pt'>checking,<br>
+ so the second error concerning missing documented<br>
+ modifications is reported.</span></i></p></td></tr>
+<tr height="0">
+<td style='border:none'></td>
+<td style='border:none'></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:4.3pt;padding-right: .3in;padding-bottom:4.3pt;padding-left:.3in'>
+<p class="MsoCaption"><a name="_Toc534824616"></a><a name=
+"_Ref534822865">Figure 12</a>.&nbsp;
+Modification</p></td></tr></table></center>
+<br clear="all">
+ 
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974978">7.1.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+State Modifications</a></h3>
+<p class="beforelist">A few special names are provided for
+describing function modifications that effect state not
+identifiable through parameters or global variables:</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>internalState</span></span></p>
+<p class="IndentText">The function modifies some internal state
+(that is, the value of a <span class="CodeText"><span style=
+'font-size:10.0pt'>static</span></span> variable).&nbsp; Even
+though a client cannot access the internal state directly, it is
+important to know that something may be modified by the function
+call both for clear documentation and for checking undefined order
+of evaluation (Section 8.2) and side effect free parameters
+(Section 11.2.1).</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>fileSystem</span></span></p>
+<p class="IndentText">The function modifies the file system.&nbsp;
+Any modification that may change the system state is considered a
+file system modification.&nbsp; All functions that modify an object
+of type pointer to <span class="CodeText"><span style=
+'font-size:10.0pt'>FILE</span></span> also modify the file
+system.&nbsp; In addition, functions that do not modify a
+<span class="CodeText"><span style=
+'font-size:10.0pt'>FILE</span></span> pointer but modify some state
+that is visible outside this process also modify the file system
+(e.g., <span class="CodeText"><span style=
+'font-size:10.0pt'>rename</span></span>).&nbsp;&nbsp; The flag
+<span class="Flag"><span style=
+'font-size:10.0pt'>mod-file-system</span></span> controls reporting
+of undocumented file system modifications.</p>
+<p class="MsoListBullet"><span class="Annot"><span style=
+'font-size:10.0pt'>nothing</span></span></p>
+<p class="IndentText">The function modifies nothing (i.e., it is
+side effect free).</p>
+<p class="TextFontCX" style='margin-left:.5in'>&nbsp;</p>
+<p class="TextFontCX">The annotation, <span class=
+"Annot"><span style='font-size:10.0pt'>/*@*/</span></span> in a
+function declaration or definition (after the parameter list,
+before the semi-colon or function body) denotes a function that
+modifies nothing and does not use any global variables (see Section
+7.2).</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974979"></a><a name="_Ref345591515">7.1.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Missing Modifies Clauses</a></h3>
+<p class="TextFontCX">Splint is designed so programs with many
+functions that are declared without modifies clauses can be checked
+effectively.&nbsp; Unless <span class="Flag"><span style=
+'font-size:10.0pt'>modnomods</span></span> is in on, no
+modification errors are reported checking a function declared with
+no modifies clause.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A function with no modifies clause is an
+<i>unconstrained</i> function since there are no documented
+constraints on what it may modify.&nbsp; When an unconstrained
+function is called, it is checked differently from a function
+declared with a modifies clause.&nbsp; To prevent spurious errors,
+no modification error is reported at the call site unless the
+<span class="Flag"><span style=
+'font-size:10.0pt'>mod-uncon</span></span>&nbsp;flag is on.&nbsp;
+Flags control whether errors involving unconstrained functions are
+reported for other checks that depend on modifications (side effect
+free macro parameters (Section 11.2.1), undefined&nbsp;evaluation
+order (Section 8.2), and likely infinite loops&nbsp;(Section
+8.3.1).)</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref534980042"></a><a name="_Toc534974980"></a><a name=
+"_Ref534972121"></a><a name="_Ref348845219"></a><a name=
+"_Ref347475720"></a><a name="_Ref347171487"></a><a name=
+"_Ref344908307"></a><a name="_Ref344893725"></a><a name=
+"_Toc344355404">7.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Global Variables</a></h2>
+<p class="TextFontCX">Another aspect of a function&#8217;s
+interface, is the global variables it uses.&nbsp; A globals list in
+a function declaration lists external variables that may be used in
+the function body.&nbsp; Splint checks that global variables used
+in a procedure match those listed in its globals list. A global is
+used in a function if it appears in the body directly, or it is in
+the globals list of a function called in the body. Splint reports
+if a global that is used in a procedure is not listed in its
+globals list, and if a listed global is not used in the function
+implementation.&nbsp; Figure 13 shows an example function
+definition with a globals list and associated checking done by
+Splint.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr style='height:13.25pt'>
+<td valign="top" style=
+'width:202.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>globals.c</span></b></span></p></td>
+<td valign="top" style=
+'width:220.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr style='height:70.65pt'>
+<td valign="top" style=
+'width:202.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>
+<p class="Verbatim"><span style='font-size:9.5pt'>int glob1,
+glob2;</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>3</span></span> <span style='font-size:9.5pt'>int
+f (void) /*@globals glob1;@*/</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>{</span></p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>5&nbsp;</span></span> <span style=
+'font-size:9.5pt'>return glob2;</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>}</span></p></td>
+<td valign="top" style=
+'width:220.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>
+<p class="lclintrun">&gt; splint globals.c +checks</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">globals.c:5: Undocumented use of global
+glob2</p>
+<p class="lclintrun">globals.c:3: Global glob1 listed but not
+used</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun" style='page-break-after:avoid'>
+&nbsp;</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:8.65pt;padding-right: 9.35pt;padding-bottom:8.65pt;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Ref349498221"></a><a name=
+"_Ref349498215"></a><a name="_Ref347468808"></a><a name=
+"_Ref347468791"></a><a name="_Ref344908072"></a><a name=
+"_Ref344908069"></a><a name="_Ref344893745"></a><a name=
+"_Toc344355405"></a><a name="_Toc534824617"></a><a name=
+"_Ref534822988">Figure 13</a>.&nbsp; Global
+Variables</p></td></tr></table></center>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974981">7.2.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Controlling Globals Checking</a></h3>
+<p class="TextFontCX">Whether on not an error is reported for a use
+of a global variable in a given function depends on the scope of
+the variable (file <span class="CodeText"><span style=
+'font-size:10.0pt'>static</span></span> or external), the checking
+annotation used in the variable declaration or the implicit
+annotation if no checking annotation is used, whether or not the
+function is declared with a globals list, and flag settings.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">A global or file static variable declaration
+may be preceded by an annotation to indicate how the variable
+should be checked.&nbsp; In order of decreasing checks, the
+annotations are:</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@checkedstrict@*/</span></span></p>
+<p class="IndentText">Strictest checking.&nbsp; Undocumented uses
+and modifications of the variable are reported in all functions
+whether or not they have a globals list (unless <span class=
+"Flag"><span style=
+'font-size:10.0pt'>check-strict-globs</span></span> is off).</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@checked@*/</span></span></p>
+<p class="IndentText">Undocumented use of the variable is reported
+in a function with a globals list, but not in a function declared
+with no globals (unless <span class="Flag"><span style=
+'font-size:10.0pt'>glob-noglobs</span></span> is on).<a name=
+"here"></a></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@checkmod@*/</span></span></p>
+<p class="IndentText">Undocumented uses of the variable are not
+reported, but undocumented modifications are reported.&nbsp;&nbsp;
+(If <span class="Flag"><span style=
+'font-size:10.0pt'>mod-globs-nomods</span></span> is on, errors are
+reported even in functions declared with no modifies&nbsp;clause or
+globals list.)</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@unchecked@*/</span></span></p>
+<p class="IndentText">No messages are reported for undocumented use
+or modification of this global variable.</p>
+<p class="afterlist">If a variable has none of these annotations,
+an implicit annotation is determined by the flag
+settings.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Different flags control the implicit
+annotation for variables declared with global scope and variables
+declared with file scope (i.e., using the <span class=
+"CodeText"><span style='font-size:10.0pt'>static</span></span>
+storage qualifier). To set the implicit annotation for global
+variables declared in <span class="Flag"><i><span style=
+'font-size:10.0pt'>context</span></i></span> (<span class=
+"Flag"><span style='font-size:10.0pt'>globs</span></span> for
+external variables or <span class="Flag"><span style=
+'font-size:10.0pt'>statics</span></span> for file static variable)
+to be <span class="Flag"><i><span style=
+'font-size:10.0pt'>annotation</span></i></span> (<span class=
+"Flag"><span style='font-size:10.0pt'>checked</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>checkmod</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>checkedstrict</span></span>)
+use <span class="Flag"><span style=
+'font-size:10.0pt'>imp<i>&lt;annotation&gt;
+&lt;context&gt;</i></span></span>.&nbsp; For example,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>+imp-checked-strict-statics</span></span>
+      makes the implicit checking on unqualified file static
+      variables <span class="Flag"><span style=
+      'font-size:10.0pt'>checkedstrict</span></span>.&nbsp; See
+      Appendix B for a complete list of globals checking flags.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974982"></a><a name="_Ref534971010">7.2.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></a>
+Definition State</h3>
+<p class="TextFontCX">Annotations can be used in the globals list
+of a function declaration to describe the states of global
+variables before and after the call.&nbsp; If a global is preceded
+by <span class="Annot"><span style=
+'font-size:10.0pt'>undef</span></span>, it is assumed to be
+undefined before the call. Thus, no error is reported if the global
+is not defined when the function is called, but an error is
+reported if the global is used in the function body before it is
+defined.&nbsp; The <span class="Annot"><span style=
+'font-size:10.0pt'>killed</span></span> annotation denotes a
+global&nbsp;variable that may be undefined when the call
+returns.&nbsp; For globals that contain dynamically allocated
+storage, a <span class="Annot"><span style=
+'font-size:10.0pt'>killed</span></span> global variable is similar
+to an <span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span>&nbsp;parameter (Section
+5.2).&nbsp; An error is reported if it contains the only reference
+to storage that is not released before the call returns.&nbsp;
+Figure 14 illustrated <span class="Annot"><span style=
+'font-size:10.0pt'>killed</span></span> and <span class=
+"Annot"><span style='font-size:10.0pt'>undef</span></span>
+globals.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:.9pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+<span class="Keyword"><b><span style=
+'font-size:10.0pt;color:white'>annotglobs.c</span></b></span></p></td>
+<td valign="top" style=
+'width:198.8pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>
+<p class="Verbatim">int globnum;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">struct {</p>
+<p class="Verbatim">&nbsp; char *firstname, *lastname;</p>
+<p class="Verbatim">&nbsp; int id;</p>
+<p class="Verbatim">} globname;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">void</p>
+<p class="Verbatim">initialize (/*@only@*/ char *name)</p>
+<p class="Verbatim">&nbsp; /*@globals undef globnum,</p>
+<p class="Verbatim">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+undef globname @*/</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>13</span></span> globname.id = globnum;</p>
+<p class="Verbatim">&nbsp; globname.lastname = name;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>15</span></span>}</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">void finalize (void)</p>
+<p class="Verbatim">&nbsp; /*@globals killed globname@*/</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; free (globname.lastname);</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>21</span></span> }</p></td>
+<td valign="top" style=
+'width:198.8pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>
+<p class="lclintrun">&gt; splint annotglobs.c</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">annotglobs.c:13: Undef global globnum used</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+before definition</p>
+<p class="lclintrun">annotglobs.c:15: Global storage globname</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; contains 1 undefined field
+when call</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; returns: firstname</p>
+<p class="lclintrun">annotglobs.c:21: Only storage</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; globname.firstname (type
+char *) derived</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; from killed global is not
+released</p>
+<p class="lclintrun" style='page-break-after:avoid'>
+&nbsp;&nbsp;&nbsp; (memory leak)</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" align="left" style=
+'padding-top:10.1pt;padding-right: 9.35pt;padding-bottom:10.1pt;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824618"></a><a name=
+"_Ref534823055">Figure 14</a>.&nbsp; Annotated Globals
+Lists</p></td></tr></table></center>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974983"></a><a name="_Ref344894947"></a><a name=
+"_Toc344355406">7.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Declaration Consistency</a></h2>
+<p class="TextFontCX">Splint checks that function declarations and
+definitions are consistent.&nbsp; The general rule is that the
+<i>first</i> declaration of a function implies all later
+declarations and definitions.&nbsp; If a function is declared in a
+header file, the first declaration processed is its first
+declaration (if it is declared in more than one header file an
+error is reported if <span class="Flag"><span style=
+'font-size:10.0pt'>redecl</span></span>&nbsp;is set)
+      <span style='display:none'>(if the same function is declared
+      in more than one header file ???)</span>.&nbsp; Otherwise,
+      the first declaration in the file defining the function is
+      its first declaration.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Later declarations may not include variables
+in the globals list that were not included in the first
+declaration.&nbsp; The exception to this is when the first
+declaration is in a header file and the later declaration or
+definition includes file static variables.&nbsp; Since these are
+not visible in the header file, they can not be included in the
+header file declaration.&nbsp; Similarly, the modifies clause of a
+later declaration may not include objects that are not modifiable
+in the first declaration.&nbsp; The later declaration may be more
+specific.&nbsp; For example, if the header declaration is:</p>
+<p class="example" style='text-indent:.3in'>extern void setName
+(employee e, char *s) /*@modifies e@*/;</p>
+<p class="TextFontCX">the later declaration could be,</p>
+<p class="example">&nbsp;&nbsp; void setName (employee e, char *)
+/*@modifies e-&gt;name@*/;</p>
+<p class="TextFontCX">If <span class="CodeText"><span style=
+'font-size:10.0pt'>employee</span></span> is an abstract type, the
+declaration in the header should not refer to a particular
+implementation (i.e., it shouldn&#8217;t rely on there being a
+<span class="CodeText"><span style=
+'font-size:10.0pt'>name</span></span> field), but the
+implementation declaration can be more specific.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">This rule also applies to file static
+variables.&nbsp; The header declaration for a function that
+modifies a file static variable should use <span class=
+"Annot"><span style='font-size:10.0pt'>modifies
+internalState</span></span> since file static variables are not
+visible to clients.&nbsp; The implementation declaration should
+list the actual file static variables that may be modified.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974984"></a><a name="_Ref354411787">7.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+State Clauses</a></h2>
+<p class="TextFontCX">Sometimes it is necessary to specify function
+interfaces at a lower level than is possible with the standard
+annotations.&nbsp; For example, if a function defines some fields
+of a returned structure but does not define all the fields.&nbsp;
+The <span class="Annot"><span style=
+'font-size:10.0pt'>/*@special@*/</span></span> annotation is used
+to mark a parameter, global variable, or return value that is
+described using state clauses.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">State clauses may be used to constrain the
+state of a parameter or return value before or after a call.&nbsp;
+One or more state clauses may appear in a function declaration,
+before the modifies or globals clauses.&nbsp; State clauses may be
+listed in any order, but the same state clause should not be used
+more than once.&nbsp; In a state clause list, <span class=
+"CodeText"><span style='font-size:10.0pt'>result</span></span> is
+used to refer to the return value of the function.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" style='margin-bottom:6.0pt'>The following
+state clauses are used to describe the definition state or
+parameters before and after the function is called and the return
+value after the function returns:</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@uses
+<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="indentbefore0">References in a <span class=
+"Annot"><span style='font-size:10.0pt'>uses</span></span> clause
+must be completely defined before the function is called.&nbsp;
+They are assumed to be defined at function entrance when the
+function is checked.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@sets
+<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="indentbefore0">References in a <span class=
+"Annot"><span style='font-size:10.0pt'>sets</span></span> clause
+must be allocated before the function is called.&nbsp; They are
+completely defined after the function returns. They are assumed to
+be allocated but undefined storage at function entrance and an
+error is reported if there is a path on which they are not defined
+before the function returns.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@defines
+<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="indentbefore0">References in a <span class=
+"Annot"><span style='font-size:10.0pt'>defines</span></span> clause
+must not refer to unshared, allocated storage before the function
+is called.&nbsp; They are completely defined after the function
+returns. When the function is checked, they are assumed to be
+undefined at function entrance and an error is reported if there is
+a path on which they are not defined before the function
+returns.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@allocates
+<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="indentbefore0">References in an <span class=
+"Annot"><span style='font-size:10.0pt'>allocates</span></span>
+clause must be unallocated before the function is called.&nbsp;
+They are allocated but not necessarily defined after the function
+returns. An error is reported if there is a path through the
+function on which they are not allocated before the function
+returns.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@releases
+&lt;references&gt;@*/</span></span></p>
+<p class="IndentText">References in the <span class=
+"Annot"><span style='font-size:10.0pt'>releases</span></span>
+clause are deallocated by the function.&nbsp; They must be storage
+that could be passed as an <span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span>&nbsp;parameter before the
+function is called, and are dead pointers after the function
+returns.&nbsp; They are assumed to be defined at function entrance
+and an error is reported if they refer to live, allocated storage
+at any return point.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Some examples of state clauses are shown in
+Figure 15. The <span class="Annot"><span style=
+'font-size: 10.0pt'>defines</span></span> clause for
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>record_new</span></span> indicates that
+      the <span class="CodeText"><span style=
+      'font-size:10.0pt'>id</span></span> field of the structure
+      pointed to by the result is defined, but the <span class=
+      "CodeText"><span style='font-size:10.0pt'>name</span></span>
+      field is not.&nbsp; So, <span class="CodeText"><span style=
+      'font-size:10.0pt'>record_create</span></span> needs to call
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>record_setName</span></span> to define the
+      name field.&nbsp; Similarly, the <span class=
+      "Annot"><span style='font-size:10.0pt'>releases</span></span>
+      clause for <span class="CodeText"><span style=
+      'font-size:10.0pt'>record_clearName</span></span> indicates
+      that no storage is associated with the <span class=
+      "CodeText"><span style='font-size:10.0pt'>name</span></span>
+      field of its parameter after the return, so no failure to
+      deallocate storage message is produced for the call to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>free</span></span> in <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>record_free</span></span>.&nbsp; The
+      <span class="Annot"><span style='font-size:10.0pt'>ensures
+      isnull</span></span> clause is described in the next
+      section.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'width:423.0pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>clauses.c</span></b></span></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:423.0pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim">typedef struct</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; int id;</p>
+<p class="Verbatim">&nbsp; /*@only@*/ char *name;</p>
+<p class="Verbatim">} *record;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">static /*@special@*/ record record_new
+(void)</p>
+<p class="Verbatim">&nbsp; /*@defines result-&gt;id@*/</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; record r = (record) malloc (sizeof
+(*r));</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">&nbsp; assert (r != NULL);</p>
+<p class="Verbatim">&nbsp; r-&gt;id = 3;</p>
+<p class="Verbatim">&nbsp; return r;</p>
+<p class="Verbatim">}</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">static void</p>
+<p class="Verbatim">&nbsp;&nbsp; record_setName (/*@special@*/
+record r, /*@only@*/ char *name)</p>
+<p class="Verbatim">&nbsp;&nbsp; /*@defines r-&gt;name@*/</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; r-&gt;name = name;</p>
+<p class="Verbatim">}</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">record record_create (/*@only@*/ char
+*name)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; record r = record_new ();</p>
+<p class="Verbatim">&nbsp; record_setName (r, name);</p>
+<p class="Verbatim">&nbsp; return r;</p>
+<p class="Verbatim">}</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">void record_clearName (/*@special@*/ record
+r)</p>
+<p class="Verbatim">&nbsp;&nbsp; /*@releases r-&gt;name@*/</p>
+<p class="Verbatim">&nbsp;&nbsp; /*@ensures isnull
+r-&gt;name@*/</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; free (r-&gt;name);</p>
+<p class="Verbatim">&nbsp; r-&gt;name = NULL;</p>
+<p class="Verbatim">}</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">void record_free (/*@only@*/ record r)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; record_clearName (r);</p>
+<p class="Verbatim">&nbsp; free (r);</p>
+<p class="Verbatim">}</p>
+<p class="Verbatim" style='page-break-after:avoid'>
+&nbsp;</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824619"></a><a name=
+"_Ref354412972">Figure 15</a>.&nbsp; State
+Clauses</p></td></tr></table></center>
+<p class="TextFontCX"><span class="Keyword"><span style=
+'font-size:10.0pt'>&nbsp;</span></span></p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974985"></a><a name="_Ref534888798">7.5<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Requires and Ensures Clauses</a></h2>
+<p class="TextFontCX">More general assumptions about state of
+parameters and globals before and after a function is called can be
+described using <span class="Annot"><i><span style=
+'font-size:10.0pt'>requires</span></i></span> and
+      <span class="Annot"><i><span style=
+      'font-size:10.0pt'>ensures</span></i></span> clauses.&nbsp; A
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>requires</span></span> clause specifies a
+      predicate that must be true at a call site; when checking a
+      function implementation Splint assumes the constraints given
+      in its <span class="Annot"><span style=
+      'font-size:10.0pt'>requires</span></span> clauses are true at
+      function entry.&nbsp; An <span class="Annot"><span style=
+      'font-size:10.0pt'>ensures</span></span> clause specifies a
+      predicate that is true at a call site after the call returns;
+      when checking a function implementation Splint warns if there
+      is an execution path that does not return with a state that
+      satifies the constraints given in its <span class=
+      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
+      clauses.&nbsp; A function declaration can have many
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>requires</span></span> and <span class=
+      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
+      clauses as long as their meanings are not contradictory.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The following constraints can be stated using
+<span class="Annot"><span style=
+'font-size:10.0pt'>requires</span></span> and <span class=
+"Annot"><span style='font-size:10.0pt'>ensures</span></span>
+clauses:</p>
+<h6 style='margin-left:0in;text-indent:0in'><b>Aliasing
+Annotations</b></h6>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@requires
+only<i>&lt;references&gt;</i>@*/</span></span>; <span class=
+"Annot"><span style='font-size:10.0pt'>/*@ensures
+only<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@requires
+shared<i>&lt;references&gt;</i>@*/</span></span>;
+      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
+      shared<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@requires
+owned<i>&lt;references&gt;</i>@*/</span></span>; <span class=
+"Annot"><span style='font-size:10.0pt'>/*@ensures
+owned<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@requires
+dependent<i>&lt;references&gt;</i>@*/</span></span>;
+      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
+      dependent<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="IndentText">References refer to <span class=
+"Annot"><span style='font-size:10.0pt'>only</span></span>,
+<span class="Annot"><span style=
+'font-size:10.0pt'>shared</span></span>, <span class=
+"Annot"><span style='font-size:10.0pt'>owned</span></span> or
+<span class="Annot"><span style=
+'font-size:10.0pt'>dependent</span></span> storage before
+(<span class="Annot"><span style=
+'font-size:10.0pt'>requires</span></span>) or after
+      (<span class="Annot"><span style=
+      'font-size:10.0pt'>ensures</span></span>) the call.</p>
+<h6 style='margin-left:0in;text-indent:0in'><b>Exposure
+Annotations</b></h6>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@requires
+observer<i>&lt;references&gt;</i>@*/</span></span>;
+      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
+      observer<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@requires
+exposed<i>&lt;references&gt;</i>@*/</span></span>;
+      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
+      exposed <i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="IndentText">References refer to <span class=
+"Annot"><span style='font-size:10.0pt'>observer</span></span> or
+<span class="Annot"><span style=
+'font-size:10.0pt'>exposed</span></span> storage before
+(<span class="Annot"><span style=
+'font-size:10.0pt'>requires</span></span>) or after
+      (<span class="Annot"><span style=
+      'font-size:10.0pt'>ensures</span></span>) the call.</p>
+<h6 style='margin-left:0in;text-indent:0in'><b>Null</b>
+<b>State</b><b>Annotations</b></h6>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@requires
+isnull<i>&lt;references&gt;</i>@*/</span></span>;
+      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
+      isnull<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="IndentText">References have the value <span class=
+"CodeText"><span style='font-size:10.0pt'>NULL</span></span> before
+(<span class="Annot"><span style=
+'font-size:10.0pt'>requires</span></span>) or after
+      (<span class="Annot"><span style=
+      'font-size:10.0pt'>ensures</span></span>) the call.&nbsp;
+      Note, this is not the same name or meaning as the
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span> annotation (which means
+      the value may or may not be <span class="Annot"><span style=
+      'font-size:10.0pt'>NULL</span></span>.)</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@requires
+notnull<i>&lt;references&gt;</i>@*/</span></span>;
+      <span class="Annot"><span style='font-size:10.0pt'>/*@ensures
+      notnull<i>&lt;references&gt;</i>@*/</span></span></p>
+<p class="IndentText">References do not have the value
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span> before (<span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>requires</span></span>) or after
+      (<span class="Annot"><span style=
+      'font-size:10.0pt'>ensures</span></span>) the call.</p>
+<p class="TextFontCX">&nbsp;</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974986"></a><a name="_Ref534642886"></a><a name=
+"_Ref483663682">8<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="control" name="control">
+Control Flow</a></a></h1>
+<p class="TextFontCX">The section describes checking done by Splint
+related to control flow.&nbsp; Many of these checks are
+significantly improved because of the extra information that is
+known about the program when annotations are provided.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974987"></a><a name="_Ref345859337"></a><a name=
+"_Ref344907653"></a><a name="_Ref344894343"></a><a name=
+"_Ref344873752"></a><a name="_Toc344355417">8.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Execution</a></h2>
+<p class="TextFontCX">To detect certain errors and avoid spurious
+errors, it is important to know something about the control flow
+behavior of called functions. Without additional information,
+Splint assumes that all functions eventually return and execution
+continues normally at the call site.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>noreturn</span></span>&nbsp;annotation is used
+to denote a function that never returns<a href="#_ftn8" name=
+"_ftnref8" title=""><span class=
+      "MsoFootnoteReference"><span class="MsoFootnoteReference"><span style='font-size:11.0pt;font-family:"Times New Roman"'>
+[8]</span></span></span></a>.&nbsp; For example,</p>
+<p class="example"><span class="Annot"><span style=
+'font-size:10.0pt'>extern /*@noreturn@*/ void fatalerror
+(/*@observer@*/ char *s);</span></span></p>
+<p class="beforelist">declares <span class=
+      "CodeText"><span style='font-size:10.0pt'>fatalerror</span></span>
+      to never return.&nbsp; This enables Splint to correctly
+      analyze code like,</p>
+<p class="TextFontCX"><span class="Keyword"><span style=
+'font-size:10.0pt'>&nbsp;&nbsp; if (x == NULL) fatalerror
+("Yikes!");</span></span></p>
+<p class="TextFontCX"><span class="Keyword"><span style=
+'font-size:10.0pt'>&nbsp;&nbsp; *x = 3;</span></span></p>
+<p class="afterlist">Other functions may return, but sometimes (or
+usually) return normally.&nbsp; The <span class=
+      "Annot"><span style='font-size:10.0pt'>maynotreturn</span></span>
+      annotation denotes a function that may or may not
+      return.&nbsp; This may be useful for documentation, but does
+      not help checking much, since Splint must assume that a
+      function declared with <span class="Annot"><span style=
+      'font-size:10.0pt'>maynotreturn</span></span> returns
+      normally when checking the code.&nbsp; The <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>alwaysreturns</span></span> annotation
+      denotes a function that always returns (but Splint does no
+      checking to verify this).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">To describe non-returning functions more
+precisely, the <span class="Annot"><span style=
+'font-size:10.0pt'>noreturnwhentrue</span></span>&nbsp;and
+<span class="Annot"><span style=
+'font-size:10.0pt'>noreturnwhenfalse</span></span>&nbsp;annotations
+may be used.&nbsp; Similar to <span class=
+      "Annot"><span style='font-size: 10.0pt'>nullwhentrue</span></span>
+      and <span class="Annot"><span style=
+      'font-size:10.0pt'>falsewhennull</span></span> (see Section
+      2.1.1), <span class="Annot"><span style=
+      'font-size:10.0pt'>noreturnwhentrue</span></span>&nbsp;and
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>noreturnwhenfalse</span></span> mean that
+      a function never returns if the value of its first argument
+      is true (<span class="Annot"><span style=
+      'font-size:10.0pt'>noreturnwhentrue</span></span>) or false
+      (<span class="Annot"><span style=
+      'font-size:10.0pt'>noreturnwhenfalse</span></span>).&nbsp;
+      They may be used only on functions whose first argument is a
+      Boolean.&nbsp;&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" style='margin-bottom:6.0pt'>Hence, a function
+declared with <span class="Annot"><span style=
+'font-size:10.0pt'>noreturnwhenwfalse</span></span> must not return
+if the value of its argument is false.&nbsp; For example, the
+standard library declares <span class="Keyword"><span style=
+'font-size:10.0pt'>assert</span></span>&nbsp;as<a href="#_ftn9"
+name="_ftnref9" title=""><span class=
+"MsoFootnoteReference"><span class=
+"MsoFootnoteReference"><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>:</p>
+<p class="example" style=
+'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>
+/*@noreturnwhenfalse@*/ void</p>
+<p class="example" style=
+'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>
+assert (/*@sef@*/ bool /*@alt int@*/ pred);</p>
+<p class="beforelist" style='margin-top:6.0pt'>This way, code
+like,</p>
+<p class="Verbatim">&nbsp;&nbsp; assert (x != NULL);</p>
+<p class="Verbatim">&nbsp;&nbsp; *x = 3;</p>
+<p class="TextFontCX">is checked without reporting a false warning,
+since the <span class="Annot"><span style=
+'font-size:10.0pt'>noreturnwhenwfalse</span></span> annotation on
+<span class="CodeText"><span style=
+'font-size:10.0pt'>assert</span></span> means the deference of
+<span class="CodeText"><span style=
+'font-size:10.0pt'>x</span></span> is not reached is
+      <span class="CodeText"><span style='font-size:10.0pt'>x !=
+      NULL</span></span> is false.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974988"></a><a name="_Ref350066608">8.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Undefined</a> Behavior</h2>
+<p class="TextFontCX">The order in which side effects take place in
+a C program is not entirely defined by the code.&nbsp; Certain
+execution points are known as <i>sequence points</i> &#8212; a
+function call (after the arguments have been evaluated), the end of
+a full expression (an initializer, expression in an expression
+statement, the control expression of an <span class=
+"CodeText"><span style='font-size:10.0pt'>if</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>switch</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>while</span></span> or
+<span class="CodeText"><span style=
+'font-size:10.0pt'>do</span></span> statement, each expression of a
+<span class="CodeText"><span style=
+'font-size:10.0pt'>for</span></span> statement, and the expression
+in a <span class="CodeText"><span style=
+'font-size: 10.0pt'>return</span></span> statement), and after the
+first operand or a <span class="CodeText"><span style=
+'font-size:10.0pt'>&amp;&amp;</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>||</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>?</span></span> or <span class=
+"CodeText"><span style='font-size:10.0pt'>,</span></span>
+operand.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">All side effects before a sequence point must
+be complete before the sequence point, and no evaluations after the
+sequence point shall have taken place.&nbsp; Between sequence
+points, side effects and evaluations may take place in any
+order.&nbsp; Hence, the order in which expressions or arguments are
+evaluated is not specified.&nbsp; Compilers are free to evaluate
+function arguments and parts of expressions (that do not contain
+sequence points) in any order.&nbsp; The behavior of code is
+undefined if it uses a value that is modified by another expression
+that is not required to be evaluated before or after the other
+use.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint detects instances where undetermined
+order of evaluation produces undefined&nbsp;behavior.&nbsp; If
+modifies clauses and globals lists are used, this checking is
+enabled in expressions involving function calls. Evaluation order
+checking is controlled by the <span class="Flag"><span style=
+'font-size:10.0pt'>eval-order</span></span> flag.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:13.05pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+<span class="Keyword"><b><span style=
+'font-size:10.0pt;color:white'>order.c</span></b></span></p></td>
+<td valign="top" style=
+'width:198.8pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:148.95pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim">extern int glob;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">extern int mystery (void);</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">extern int modglob (void)</p>
+<p class="Verbatim">&nbsp;&nbsp; /*@globals glob@*/</p>
+<p class="Verbatim">&nbsp;&nbsp; /*@modifies glob@*/;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">int f (int x, int y[])</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>11</span></span> int i = x++ * x;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>13</span></span> y[i] = i++;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>14</span></span> i += modglob() * glob;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>15</span></span> i += mystery() * glob;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>16</span></span> return i;</p>
+<p class="Verbatim">}</p></td>
+<td valign="top" style=
+'width:275.4pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint order.c +evalorderuncon</p>
+<p class="lclintrun">order.c:11: Expression has undefined behavior
+(value of</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; right operand modified by
+left operand): x++ * x</p>
+<p class="lclintrun">order.c:13: Expression has undefined behavior
+(left operand</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; uses i, modified by right
+operand): y[i] = i++</p>
+<p class="lclintrun">order.c:14: Expression has undefined behavior
+(value of</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; right operand modified by
+left operand):</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; modglob() * glob</p>
+<p class="lclintrun">order.c:15: Expression has undefined
+behavior</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; (unconstrained function
+mystery used in left operand</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; may set global variable
+glob used in right operand):</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; mystery() * glob</p>
+<p class="TextFontCX" align="left" style='text-align:left'>
+<i>&nbsp;</i></p>
+<p class="TextFontCX" align="left" style=
+'text-align:left;page-break-after:avoid'><i>The warning for line 14
+is reported because the modifies clause of</i> <span class=
+"CodeText"><span style='font-size:10.0pt'>modglob</span></span>
+<i>indicated that it may modify</i> <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>glob</span></span><i>.&nbsp; The behavior is
+undefined since we don&#8217;t&nbsp; know if</i> <span class=
+"CodeText"><span style='font-size:10.0pt'>glob</span></span> <i>is
+evaluated before, after or during the</i> <i>modification.&nbsp;
+The line 15 warning would not be reported without</i>
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>+evalorderuncon</span></span><i>.</i></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824620"></a><a name=
+"_Ref534823183">Figure 16</a>.&nbsp; Evaluation
+Order</p></td></tr></table></center>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">When checking systems without modifies and
+globals information (see Section 7), evaluation order checking may
+report errors when unconstrained functions are called in procedure
+arguments.&nbsp; Since Splint has no annotations to constrain what
+these functions may modify, it cannot be guaranteed that the
+evaluation order is defined if another argument calls an
+unconstrained function or uses a global variable or storage
+reachable from a parameter to the unconstrained function.&nbsp; Its
+best to add modifies and globals clauses to constrain the
+unconstrained functions in ways that eliminate the possibility of
+undefined behavior.&nbsp; For large legacy systems, this may
+require too much effort.&nbsp; Instead, the <span class=
+"Flag"><span style=
+'font-size:10.0pt'>&#8209;eval-order-uncon</span></span> flag may
+be used to prevent reporting of undefined behavior due to the order
+of evaluation of unconstrained functions.&nbsp; Figure 16
+illustrates detection of undefined behavior.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:18.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>loop.c</span></b></span></p></td>
+<td valign="top" style=
+'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr style='height:143.1pt'>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>
+<p class="Verbatim">extern int glob1, glob2;</p>
+<p class="Verbatim">extern int f (void)</p>
+<p class="Verbatim">&nbsp; /*@globals glob1@*/</p>
+<p class="Verbatim">&nbsp; /*@modifies nothing@*/;</p>
+<p class="Verbatim">extern void g (void)</p>
+<p class="Verbatim">&nbsp; /*@modifies glob2@*/ ;</p>
+<p class="Verbatim">extern void h (void) ;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">void upto (int x)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>14</span></span>&nbsp; while (x &gt; f ())
+g();</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>15</span></span>&nbsp; while (f () &lt; 3)
+h();</p>
+<p class="Verbatim">}</p></td>
+<td valign="top" style=
+'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>
+<p class="lclintrun">&gt; splint loop.c +infloopsuncon</p>
+<p class="lclintrun">loop.c:14: Suspected infinite loop.&nbsp; No
+value used in</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; loop test (x, glob1) is
+modified by test or loop</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; body.</p>
+<p class="lclintrun">loop.c:15: Suspected infinite loop.&nbsp; No
+condition</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; values modified.&nbsp;
+Modification possible through</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; unconstrained calls: h</p>
+<p class="TextFontCX" style='page-break-after: avoid'><i>An error
+is reported for line 14 since the only value modified by<br>
+ the loop test or body if</i> <span class=
+      "CodeText"><span style='font-size: 10.0pt'>glob2</span></span>
+      <i>and the value of the loop test<br>
+ does not depend on</i> <span class="CodeText"><span style=
+'font-size:10.0pt'>glob2</span></span><i>.&nbsp; The error for line
+15 would not be<br>
+ reported without</i> <span class="Flag"><span style=
+'font-size:10.0pt'>+infloopsuncon</span></span><i>.</i></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824621"></a><a name=
+"_Ref534823256">Figure 17</a>.&nbsp; Infinite
+Loops</p></td></tr></table></center>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974989"></a><a name="_Ref344892701"></a><a name=
+"_Toc344355430">8.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Problematic Control Structures</a></h2>
+<p class="TextFontCX">A number of control structures that are
+syntactically legal may indicate likely bugs in programs.&nbsp;
+Splint can detect errors involving likely infinite
+loops&nbsp;(Section 8.3.1), fall through cases and missing cases in
+<span class="CodeText"><span style=
+'font-size:10.0pt'>switch</span></span> statements&nbsp;(Section
+8.3.2), <span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> statements within deeply
+nested loops or switches (Section 8.3.3), clauses of
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>if</span></span>, <span class=
+      "CodeText"><span style='font-size:10.0pt'>while</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>for</span></span> statements that are
+      empty statements or unblocked single statements (Section
+      8.3.4) and incomplete if-else logic (Section 8.3.5).&nbsp;
+      Although any of these may appear in a correct program,
+      depending on the programming style used they may indicate
+      likely bugs or style violations that should be detected and
+      eliminated.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974990"></a><a name="_Ref344810086">8.3.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Likely Infinite Loops</a></h3>
+<p class="TextFontCX">Splint reports an error if it detects a loop
+that appears to be infinite.&nbsp; An error is reported for a loop
+that does not modify any value used in its condition test inside
+the body of the loop or in the condition test itself.&nbsp; This
+checking is enhanced by modifies clauses and globals lists (see
+Section 7) since they <a name="_Ref344818734">provide more
+information about what global variable may be used in the condition
+test and what values may be modified by function calls in the loop
+body.</a></p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Figure 17 shows examples of infinite
+loops&nbsp;detected by Splint. An error is reported for the loop in
+line 14, since neither of the values used in the loop condition
+(<span class="CodeText"><span style=
+'font-size:10.0pt'>x</span></span> directly and <span class=
+"CodeText"><span style='font-size:10.0pt'>glob1</span></span>
+through the call to <span class="CodeText"><span style=
+'font-size:10.0pt'>f</span></span>) is modified by the body of the
+loop.&nbsp; If the declaration of <span class=
+"CodeText"><span style='font-size:10.0pt'>g</span></span> is
+changed to include <span class="CodeText"><span style=
+'font-size:10.0pt'>glob1</span></span> in the modifies clause no
+error is reported.&nbsp; (In this example, if we assume the
+annotations are correct, then the programmer has probably called
+the wrong function in the loop body.&nbsp; This isn&#8217;t
+surprising, given the horrible choices of function and variable
+names!)</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">If an unconstrained function is called within
+the loop body, Splint will assume that it modifies a value used in
+the condition test and not report an infinite loop error, unless
+<span class="Flag"><span style=
+'font-size:10.0pt'>infloopsuncon</span></span> is on.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>infloopsuncon</span></span> is on, Splint will
+report infinite loop errors for loops where there is no explicit
+modification of a value used in the condition test, but where they
+may be an undetected modification through a call to an
+unconstrained function (e.g., line 12 in Figure 17).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span style='font-size:10.0pt'>&nbsp;</span></p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974991"></a><a name="_Ref349899747"></a><a name=
+"_Ref345591205">8.3.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Switches</a></h3>
+<p class="TextFontCX">The automatic fall through of C switch
+statements is almost never the intended behavior.<a href="#_ftn10"
+name="_ftnref10" title=""><span class=
+"MsoFootnoteReference"><span class=
+"MsoFootnoteReference"><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>&nbsp;
+Splint detects <span class="CodeText"><span style=
+'font-size:10.0pt'>case</span></span> statements with code that may
+fall through to the next <span class="CodeText"><span style=
+'font-size:10.0pt'>case</span></span>.&nbsp; The <span class=
+"Flag"><span style='font-size:10.0pt'>casebreak</span></span> flag
+controls reporting of fall through cases.&nbsp; A single fall
+through case may be marked by preceding the <span class=
+"CodeText"><span style='font-size:10.0pt'>case</span></span>
+keyword with <span class="Annot"><span style=
+'font-size:10.0pt'>/*@fallthrough@*/</span></span> to indicate
+explicitly that execution falls through to this case.&nbsp; See
+Figure 18 for an example.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">For switches on <span class=
+"CodeText"><span style='font-size:10.0pt'>enum</span></span> types,
+Splint reports an error if a member of the enumerator does not
+appear as a case in the switch body (and there is no
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>default</span></span> case).&nbsp;
+      (Controlled by <span class="Flag"><span style=
+      'font-size:10.0pt'>misscase</span></span>.)</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:.2in;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'width:3.0in;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>switch.c</span></b></span></p></td>
+<td valign="top" style=
+'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim">typedef enum {</p>
+<p class="Verbatim">&nbsp; YES, NO, DEFINITELY,</p>
+<p class="Verbatim">&nbsp; PROBABLY, MAYBE } ynm;</p>
+<p class="Verbatim">void decide (ynm y)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; switch (y)</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp; {</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp; case PROBABLY:</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp; case NO: printf ("No!");</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>10</span></span> &nbsp;&nbsp;case MAYBE: printf
+("Maybe");</p>
+<p class="Verbatim">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+/*@fallthrough@*/</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp; case YES: printf
+("Yes!");</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>13</span></span> &nbsp;&nbsp;}</p>
+<p class="Verbatim">}</p></td>
+<td valign="top" style=
+'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint switch.c</p>
+<p class="lclintrun">switch.c:10: Fall through case (no preceding
+break)</p>
+<p class="lclintrun">switch.c:13: Missing case in switch:
+DEFINITELY</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="MsoCaption" align="left" style='text-align:left'>
+<i><span style='font-weight:normal'>No fall through error is
+reported for the</span></i> <span class=
+      "CodeText"><span style='font-weight:normal'>NO</span></span><i><span style='font-weight:normal'>
+case,<br>
+ since there are no statements associated with the<br>
+ previous case.&nbsp;</span></i></p>
+<p class="TextFontCX" style='page-break-after: avoid'><i>The</i>
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*@fallthrough@*/</span></span> <i>comment
+prevents<br>
+ a message from being produced for the<br></i> <span class=
+"Annot"><span style='font-size:10.0pt'>YES</span></span>
+<i>case.</i></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.0pt;padding-bottom:0in;padding-left:9.0pt'>
+<p class="MsoCaption"><a name="_Toc344355431"></a><a name=
+"_Ref344881581"></a><a name="_Toc534824622"></a><a name=
+"_Ref534823308">Figure 18</a>. &nbsp;Switch
+Cases</p></td></tr></table></center>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974992"></a><a name="_Ref534971227">8.3.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Deep Breaks</a></h3>
+<p class="TextFontCX">There is no syntax provided by C (other than
+<span class="CodeText"><span style=
+'font-size:10.0pt'>goto</span></span>) for breaking out of a nested
+loop.&nbsp; All <span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> and <span class=
+"CodeText"><span style='font-size:10.0pt'>continue</span></span>
+statements act only on the innermost surrounding loop or
+switch.&nbsp; This can lead to serious problems<a href="#_ftn11"
+name="_ftnref11" title=""><span class=
+"MsoFootnoteReference"><span class=
+"MsoFootnoteReference"><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>
+when a programmer intends to break the outer loop or switch
+instead.&nbsp; Splint optionally reports warnings for
+      <span class="CodeText"><span style=
+      'font-size: 10.0pt'>break</span></span> and <span class=
+      "CodeText"><span style=
+      'font-size: 10.0pt'>continue</span></span> statements in
+      nested contexts.</p>
+<p class="beforelist">&nbsp;</p>
+<p class="beforelist">Four types of <span class=
+"CodeText"><span style='font-size: 10.0pt'>break</span></span>
+warnings are reported:</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+<span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> inside a loop
+      (<span class="CodeText"><span style=
+      'font-size:10.0pt'>while</span></span> or <span class=
+      "CodeText"><span style='font-size:10.0pt'>for</span></span>)
+      that is inside a loop.&nbsp; Controlled by <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>looploopbreak</span></span>.&nbsp; To
+      indicate that a <span class="CodeText"><span style=
+      'font-size:10.0pt'>break</span></span> is inside an inner
+      loop, precede the <span class="CodeText"><span style=
+      'font-size:10.0pt'>break</span></span> by <a href=
+      "mailto:/*@innerbreak@*/"><span class="Annot"><span style=
+      'font-size: 10.0pt'>/*@innerbreak@*/</span></span></a>.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+<span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> inside a loop that is inside
+a <span class="CodeText"><span style=
+'font-size:10.0pt'>switch</span></span> statement.&nbsp; Controlled
+by <span class="Flag"><span style=
+'font-size:10.0pt'>switchloopbreak</span></span>.&nbsp; To mark the
+<span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> as a loop break, precede the
+<span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> by <span class=
+"Annot"><span style=
+'font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+<span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> inside a <span class=
+"CodeText"><span style='font-size:10.0pt'>switch</span></span>
+statement that is inside a loop.&nbsp; Controlled by
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>loopswitchbreak</span></span>.&nbsp; To
+      mark the <span class="CodeText"><span style=
+      'font-size:10.0pt'>break</span></span> as a switch break,
+      precede the <span class="CodeText"><span style=
+      'font-size:10.0pt'>break</span></span> by <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>/*@switchbreak@*/</span></span>.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+<span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> inside a <span class=
+"CodeText"><span style='font-size:10.0pt'>switch</span></span>
+inside another <span class="CodeText"><span style=
+'font-size:10.0pt'>switch</span></span>.&nbsp; Controlled by
+<span class="Flag"><span style=
+'font-size:10.0pt'>switchswitchbreak</span></span>.&nbsp; To
+indicate that the <span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> is for the inner switch, use
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>
+<p class="afterlist">Since <span class=
+      "CodeText"><span style='font-size:10.0pt'>continue</span></span>
+      only makes sense within loops, warnings are only reported for
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>continue</span></span> statements within
+      nested loops.&nbsp; (Controlled by <span class=
+      "Flag"><span style=
+      'font-size: 10.0pt'>looploopcontinue</span></span>.)&nbsp; A
+      safe inner <span class="CodeText"><span style=
+      'font-size:10.0pt'>continue</span></span> may be preceded by
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>/*@innercontinue@*/</span></span>&nbsp;to
+      suppress error messages locally. The <span class=
+      "Flag"><span style='font-size:10.0pt'>deepbreak</span></span>
+      flag sets all nested break and continue checking flags.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint warns if the marker preceding a
+<span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> is not consistent with its
+placement.&nbsp; A warning results if <span class=
+"Annot"><span style='font-size:10.0pt'>innerbreak</span></span>
+precedes a <span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> that is not breaking an
+inner loop, <span class="Annot"><span style=
+'font-size:10.0pt'>switchbreak</span></span> precedes a
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>break</span></span> that is not breaking a
+      switch, or <span class="Annot"><span style=
+      'font-size: 10.0pt'>loopbreak</span></span>&nbsp;precedes a
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>break</span></span> that is not breaking a
+      loop.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974993"></a><a name="_Ref347246280">8.3.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></a>
+Loop and If Bodies</h3>
+<p class="beforelist">An empty statement after an
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>if</span></span>, <span class=
+      "CodeText"><span style='font-size:10.0pt'>while</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>for</span></span> often indicates a
+      potential bug.&nbsp; A single statement (i.e., not a compound
+      block) after an <span class="CodeText"><span style=
+      'font-size:10.0pt'>if</span></span>, <span class=
+      "CodeText"><span style='font-size:10.0pt'>while</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>for</span></span> is not likely to
+      indicate a bug, but make the code harder to read and
+      edit.&nbsp; Splint can report errors for if or loop
+      statements with empty bodies or bodies that are not compound
+      statements.&nbsp; Separate flags control checking for
+      statements following an <span class="CodeText"><span style=
+      'font-size:10.0pt'>if</span></span>, <span class=
+      "CodeText"><span style='font-size:10.0pt'>while</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>for</span></span>:</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+<span class="Flag"><span style=
+'font-size:10.0pt'>[if</span></span>,<span class=
+      "Flag"><span style='font-size:10.0pt'>while</span></span>,<span class="Flag">
+<span style='font-size:10.0pt'>for]empty</span></span> &#8212;
+report errors for empty bodies (e.g., <span class=
+"CodeText"><span style='font-size:10.0pt'>if (x &gt; 3)
+;</span></span> )</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+<span class="Flag"><span style=
+'font-size:10.0pt'>[if</span></span>,<span class=
+      "Flag"><span style='font-size:10.0pt'>while</span></span>,<span class="Flag">
+<span style='font-size:10.0pt'>for]block</span></span> &#8212;
+report errors for non-block bodies (e.g., <span class=
+"CodeText"><span style='font-size:10.0pt'>if (x &gt; 3)
+x++;</span></span>)</p>
+<p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
+<span class="Keyword"><span style=
+'font-size:10.0pt'>&nbsp;</span></span></p>
+<p class="afterlist">The <span class="CodeText"><span style=
+'font-size:10.0pt'>if</span></span> statement checks also apply to
+the body of the <span class="CodeText"><span style=
+'font-size:10.0pt'>else</span></span> clause.&nbsp; No
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>ifblock</span></span> warning is reported
+      if the body of the <span class="CodeText"><span style=
+      'font-size:10.0pt'>else</span></span> clause is an
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>if</span></span> statement, to allow
+      conventional <span class="CodeText"><span style=
+      'font-size: 10.0pt'>else if</span></span> chains.&nbsp;</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974994"></a><a name="_Ref347246283">8.3.5<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Complete Logic</a></h3>
+<p class="beforelist">Although it may be perfectly reasonable in
+many contexts, an <span class="CodeText"><span style=
+'font-size:10.0pt'>if</span></span>-<span class=
+"CodeText"><span style='font-size:10.0pt'>else</span></span> chain
+with no final <span class="CodeText"><span style=
+'font-size:10.0pt'>else</span></span> may indicate missing logic or
+forgetting to check error cases.&nbsp; If <span class=
+"Flag"><span style='font-size:10.0pt'>elseif-complete</span></span>
+is on, Splint warns when an <span class=
+      "CodeText"><span style='font-size:10.0pt'>if</span></span>
+      statement that is the body of an <span class=
+      "CodeText"><span style='font-size: 10.0pt'>else</span></span>
+      clause does not have a matching <span class=
+      "CodeText"><span style='font-size:10.0pt'>else</span></span>
+      clause.&nbsp; For example, the code,</p>
+<p class="Verbatim">&nbsp;&nbsp; if (x == 0) { return "nil"; }</p>
+<p class="Verbatim">&nbsp;&nbsp; else if (x == 1) { return "many";
+}</p>
+<p class="afterlist">results in a warning since the second
+<span class="CodeText"><span style=
+'font-size:10.0pt'>if</span></span> has no matching
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>else</span></span> branch.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974995"></a><a name="_Ref344892802">8.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Suspicious Statements</a></h2>
+<p class="TextFontCX">Splint detects errors involving statements
+with no apparent effects (Section 8.4.1) and statements that ignore
+the result of a called function (Section 8.4.2).</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974996"></a><a name="_Ref347247824">8.4.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Statements with No Effects</a></h3>
+<p class="TextFontCX">Splint can report errors for statements that
+have no effect.&nbsp; (Controlled by <span class=
+      "Flag"><span style='font-size:10.0pt'>no-effect</span></span>.)&nbsp;&nbsp;
+      Because of modifies clauses, Splint can detect more errors
+      than traditional checkers.&nbsp; Unless the <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>no-effect-uncon</span></span>&nbsp;flag is
+      on, errors are not reported for statements that involve calls
+      to unconstrained functions since the unconstrained function
+      may cause a modification.&nbsp; Figure 19 shows examples of
+      Splint&#8217;s no effect checking.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:5.4pt;border-collapse:collapse; margin-left:-2.25pt;margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<a name="_Ref344893305"></a><a name=
+      "_Ref344874935"><span class="StyleKeywordBold"><span style=
+      'font-size:10.0pt'>noeffect.c</span></span></a></p></td>
+<td valign="top" style=
+'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim">extern void</p>
+<p class="Verbatim">&nbsp; nomodcall (int *x) /*@*/;</p>
+<p class="IndentText"><i>Recall /*@*/ is shorthand for<br>
+ modifies nothing and use<br>
+ no globals.</i></p>
+<p class="Verbatim">extern void mysterycall (int *x);</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">int noeffect (int *x, int y)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim">&nbsp; y == *x;</p>
+<p class="Verbatim">&nbsp; nomodcall (x);</p>
+<p class="Verbatim">&nbsp; mysterycall (x);</p>
+<p class="Verbatim">&nbsp; return *x;</p>
+<p class="Verbatim">}</p></td>
+<td valign="top" style=
+'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint noeffect.c +noeffectuncon</p>
+<p class="lclintrun">noeffect.c:6: Statement has no effect: y ==
+*x</p>
+<p class="lclintrun">noeffect.c:7: Statement has no effect:
+nomodcall(x)</p>
+<p class="lclintrun">noeffect.c:8: Statement has no effect
+(possible</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; undetected modification
+through call to</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; unconstrained function
+mysterycall):</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; mysterycall(x)</p>
+<p class="IndentText"><i>&nbsp;</i></p>
+<p class="IndentText" style='page-break-after:avoid'><i>The warning
+for line 8 would not be<br>
+reported without</i> <span class="Flag"><span style=
+'font-size: 10.0pt'>+noeffectuncon</span></span>.</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Ref534813977"></a><a name=
+"_Toc534824623"></a><a name="_Ref534823396">Figure 19</a>.&nbsp;
+Statements with No Effect</p></td></tr></table></center>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref534978820"></a><a name="_Toc534974997">8.4.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Ignored Return Values</a></h3>
+<p class="TextFontCX">Splint reports an error when a return value
+is ignored.&nbsp; Checking may be controlled based on the type of
+the return value: <span class="Flag"><span style=
+'font-size:10.0pt'>ret-val-int</span></span> controls reporting of
+ignored return values of type <span class=
+      "Keyword"><span style='font-size:10.0pt'>int</span></span>,
+      and <span class="Flag"><span style=
+      'font-size:10.0pt'>ret-val-bool</span></span> for return
+      values of type <span class="Keyword"><span style=
+      'font-size:10.0pt'>bool</span></span>, and <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>ret-val-others</span></span>&nbsp;for all
+      other types.&nbsp; A function statement may be cast to
+      <span class="Keyword"><span style=
+      'font-size:10.0pt'>void</span></span> to prevent this error
+      from being reported.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Alternate types&nbsp;(Section 4.4) can be
+used to declare functions that return values that may safely be
+ignored by declaring the result type to alternately be
+      <span class="Keyword"><span style=
+      'font-size:10.0pt'>void</span></span>.&nbsp; Several
+      functions in the standard library are specified to
+      alternately return <span class="Keyword"><span style=
+      'font-size:10.0pt'>void</span></span> to prevent ignored
+      return value errors for standard library functions (e.g.,
+      <span class="Keyword"><span style=
+      'font-size:10.0pt'>strcpy</span></span>) where the result may
+      be safely ignored (see Section 14.1).&nbsp; Figure 20 shows
+      examples of ignored return value errors reported by
+      Splint.</p>
+<p class="MsoNormal" align="left" style=
+'text-align:left;background:white'><span style=
+'font-size:10.0pt'>&nbsp;</span></p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style='margin-left:9.9pt;border-collapse:collapse'>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>ignore.c</span></b></span></p></td>
+<td valign="top" style=
+'border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim"># include &#8220;bool.h&#8221;</p>
+<p class="Verbatim">extern int fi (void);</p>
+<p class="Verbatim">extern bool fb (void);</p>
+<p class="Verbatim">extern int /*@alt void@*/</p>
+<p class="Verbatim">&nbsp; fv (void);</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">int ignore (void)</p>
+<p class="Verbatim">{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp; 8</span></span>&nbsp; fi ();</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp; 9</span></span>&nbsp; (void) fi ();</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>10</span></span>&nbsp; fb ();</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>11</span></span>&nbsp; fv ();</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>12</span></span>&nbsp; return fv ();</p>
+<p class="Verbatim">}</p></td>
+<td valign="top" style=
+'border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint ignore.c</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">ignore.c:8: Return value (type int) ignored:
+fi()</p>
+<p class="lclintrun">ignore.c:10: Return value (type bool) ignored:
+fb()</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="MsoNormal" style='background:white'><i><span style=
+'font-size:10.0pt'>The message for line 8 would not be reported
+if</span></i> <span class="Flag"><span style=
+'font-size:10.0pt'>&#8209;retvalint</span></span><i><span style='font-size:10.0pt'>
+is set;<br>
+ for line 10, if</span></i> <span class="Flag"><span style=
+'font-size:10.0pt'>&#8209;retvalbool</span></span><i><span style='font-size:10.0pt'>
+is set.</span></i></p>
+<p class="MsoNormal" style='background:white'><i><span style=
+'font-size:10.0pt'>&nbsp;</span></i></p>
+<p class="MsoNormal" style='background:white'><i><span style=
+'font-size:10.0pt'>&nbsp;No message is reported for line 9 because
+the result is cast to</span></i> <span class=
+      "CodeText"><span style='font-size:10.0pt'>void</span></span><i><span style='font-size:10.0pt'>
+,<br>
+ and no message is reported for line 11 because</span></i>
+<span class="CodeText"><span style=
+'font-size:10.0pt'>fv</span></span><i><span style=
+'font-size:10.0pt'>is declared<br>
+ to alternately return</span></i> <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>void</span></span><i><span style=
+'font-size:10.0pt'>.</span></i></p>
+<p class="TextFontCX" style='page-break-after: avoid'>
+&nbsp;</p></td></tr></table>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.0pt;padding-bottom:0in;padding-left:9.0pt'>
+<p class="MsoCaption"><a name="_Toc534824624"></a><a name=
+"_Ref534823436">Figure 20</a>.&nbsp; Ignored Return
+Values</p></td></tr></table></div></center>
+<p class="MsoNormal" align="left" style=
+'text-align:left;background:white'><span style=
+'font-size:10.0pt'>&nbsp;</span></p>
+<b><span style=
+'font-size:16.0pt;font-family:"Times New Roman"'><br clear="all"
+style='page-break-before:always'></span></b> 
+<h1 style='margin-left:0in;text-indent:0in;page-break-before:auto'>
+<a name="_Toc534974998"></a><a name="_Ref534963019"></a><a name=
+"_Ref534962975">9<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="buffer" name="buffer">
+Buffer Sizes</a></a></h1>
+<p class="TextFontCX">Buffer overflow errors are a particularly
+dangerous type of bug in C programs.&nbsp; They are directly
+responsible for about half of all security attacks
+[Larochelle01].&nbsp; For performance reasons, C does not perform
+run time bounds checking.&nbsp; Referencing storage outside
+allocated regions can cause memory corruption and lead to strange
+behavior.&nbsp; Moreover, buffer overflow bugs are particularly
+insidious because they can go undetected in testing or normal use,
+but usually result in security critical bugs.&nbsp; Reads beyond
+the end of a buffer can cause the program to leak
+information.&nbsp; Writes beyond the end a buffer (buffer
+overflows) can usually be exploited make the program run arbitrary
+code.&nbsp; Attackers can exploit these programming bugs to replace
+the return address on the stack and place arbitrary code in memory
+thereby gaining full access to the machine.&nbsp; Splint is able to
+detect many memory bounds errors. <a href="#_ftn12" name=
+"_ftnref12" title=""><span style=
+'font-size:11.0pt; font-family:"Times New Roman"'>[12]</span></a>&nbsp;</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534974999">9.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Checking Accesses</a></h2>
+<p class="TextFontCX">Splint models blocks of contiguous memory
+using two properties: <span class="Annot"><span style=
+'font-size:10.0pt'>maxSet</span></span> and <span class=
+"Annot"><span style='font-size:10.0pt'>maxRead</span></span>.&nbsp;
+Given a buffer <span class="CodeText"><i><span style=
+'font-size:10.0pt'>b</span></i></span>, <span class=
+"Annot"><span style=
+'font-size:10.0pt'>maxSet(<i>b</i>)</span></span> denotes the
+highest address beyond <span class="CodeText"><i><span style=
+'font-size:10.0pt'>b</span></i></span> that can be safely used as
+an lvalue. &nbsp;For the declaration <span class=
+"CodeText"><span style='font-size:10.0pt'>char
+buf[MAXSIZE]</span></span> we have <span class=
+      "Annot"><span style='font-size: 10.0pt'>maxSet(buf)</span></span>
+      <span class="CodeText"><span style='font-size: 10.0pt'>=
+      MAXSIZE - 1</span></span>. &nbsp;Similarly, <span class=
+      "Annot"><span style='font-size:10.0pt'>maxRead</span></span>
+      denotes the highest index of a buffer that can be safely used
+      an rvalue.&nbsp; It is inappropriate to read an uninitialized
+      element or beyond the <span class="CodeText"><span style=
+      'font-size:10.0pt'>NUL</span></span> terminator of a null
+      terminated buffer.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">When a buffer is accessed as an lvalue,
+Splint generates a precondition constraint involving the
+<span class="Annot"><span style=
+'font-size:10.0pt'>maxSet</span></span> property.&nbsp; When a
+buffer is accessed as an rvalue, Splint generates a precondition
+constraint involving the <span class="Annot"><span style=
+'font-size:10.0pt'>maxRead</span></span> property.&nbsp; For the
+expression <span class="CodeText"><span style=
+'font-size:10.0pt'>*<i>ptr</i></span></span>, Splint generates the
+constraints <span class="Annot"><span style=
+'font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>
+      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
+      0</span></span> or <span class="Annot"><span style=
+      'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
+      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
+      0</span></span> depending on whether <span class=
+      "CodeText"><i><span style=
+      'font-size:10.0pt'>ptr</span></i></span> is used as an lvalue
+      or rvalue.&nbsp; Similarly, for accesses of the form
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>ptr[i]</span></span>, splint generates the
+      constraints <span class="Annot"><span style=
+      'font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>
+      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
+      i</span></span> or <span class="Annot"><span style=
+      'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
+      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
+      i</span></span>.&nbsp; If <span class="Flag"><span style=
+      'font-size:10.0pt'>+boundswrite</span></span> is set, Splint
+      warns if it is unable to resolve a constraint involving
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>maxSet</span></span>. If <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>+boundsread</span></span> is set, Splint
+      warns about unresolved <span class="Annot"><span style=
+      'font-size:10.0pt'>maxRead</span></span> constraints
+      also.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint generates postconditions for
+statements to help resolve precondition constraints.&nbsp; When a
+buffer is written to we know that an element of a buffer is
+initialized and is safe to read.&nbsp; We generate the
+postcondition <span class="Annot"><span style=
+'font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span>
+      <span class="CodeText"><span style='font-size:10.0pt'>&gt;=
+      0</span></span> if the buffer is accessed using <span class=
+      "CodeText"><span style='font-size:10.0pt'>*ptr</span></span>
+      or <span class="Annot"><span style=
+      'font-size:10.0pt'>maxRead(ptr)</span></span> <span class=
+      "CodeText"><span style='font-size:10.0pt'>&gt;=
+      i</span></span> if the buffer is accessed using <span class=
+      "CodeText"><i><span style=
+      'font-size:10.0pt'>ptr</span></i></span><span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>[<i>i</i>]</span></span>.&nbsp; Splint
+      generates additional postconditions for a variety of C
+      constructs.&nbsp; For assignment statements, Splint generates
+      a postcondition equating the two operands.&nbsp; Splint also
+      generates post condition constraints for the <span class=
+      "Annot"><span style='font-size:10.0pt'>maxSet</span></span>
+      value of fixed sized arrays.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975000">9.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Annotating Buffer Sizes</a></h2>
+<p class="TextFontCX">Function declarations may include
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>requires</span></span> and <span class=
+      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
+      clauses that specify assumptions about buffer sizes for
+      function preconditions.&nbsp; They are interpreted like
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>requires</span></span> and <span class=
+      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
+      clauses for simple memory states (see Section 7.5) but can be
+      more expressive.&nbsp; When a function with a <span class=
+      "Annot"><span style='font-size:10.0pt'>requires</span></span>
+      clause is called, the call site must be checked to satisfy
+      the constraints implied by the <span class=
+      "Annot"><span style='font-size:10.0pt'>requires</span></span>
+      clause.&nbsp; Similarly, an <span class="Annot"><span style=
+      'font-size:10.0pt'>ensures</span></span> clause can be used
+      to specify function post conditions.&nbsp; If the
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>+checkpost</span></span> flag is set,
+      Splint warns if it cannot verify that a function
+      implementation satisfies its declared postconditions.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Constraints can contain function parameters
+as well as global variables and integer constants. The unary
+operators, <span class="Annot"><span style=
+'font-size:10.0pt'>maxSet</span></span> and <span class=
+"Annot"><span style='font-size:10.0pt'>maxRead</span></span> which
+correspond to the properties described above are also supported.
+&nbsp;Multiple predicates may be conjoined using <span class=
+"CodeText"><span style=
+'font-size: 10.0pt'>/\</span></span>.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">For example, the standard library annotates
+<span class="CodeText"><span style=
+'font-size:10.0pt'>strcpy</span></span>:</p>
+<p class="MsoPlainText" style='line-height:normal'>&nbsp;</p>
+<p class="Verbatim" style='margin-left:22.5pt'>void /*@alt char *
+@*/strcpy</p>
+<p class="Verbatim" style='margin-left:22.5pt;text-indent:13.5pt'>
+(/*@unique@*/ /*@out@*/ /*@returned@*/ char *s1, char *s2)</p>
+<p class="Verbatim" style='margin-left:.5in'>/*@modifies *s1@*/</p>
+<p class="Verbatim" style='margin-left:.5in'>/*@requires maxSet(s1)
+&gt;= maxRead(s2) @*/</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /*@ensures
+maxRead(s1) == maxRead (s2) @*/;&nbsp;&nbsp;&nbsp;&nbsp;</p>
+<p class="MsoPlainText" style=
+'margin-left:.5in;line-height:normal'><b>&nbsp;</b></p>
+<p class="MsoPlainText" style=
+'text-align:justify;line-height:normal'>The <span class=
+"Annot"><span style='font-size:10.0pt'>requires</span></span>
+clause indicates that the buffer passed as <span class=
+"CodeText"><span style='font-size:10.0pt'>s1</span></span> must be
+large enough to hold the string passed as <span class=
+"CodeText"><span style='font-size:10.0pt'>s2</span></span>.&nbsp;
+The <span class="Annot"><span style=
+'font-size:10.0pt'>ensures</span></span> clause specifies that
+<span class="Annot"><span style=
+'font-size:10.0pt'>maxRead</span></span> of <span class=
+"CodeText"><span style='font-size:10.0pt'>s1</span></span> after
+the call is equal to <span class="Annot"><span style=
+'font-size:10.0pt'>maxRead</span></span> of <span class=
+"CodeText"><span style='font-size:10.0pt'>s2</span></span>.&nbsp;
+In cases where the size of <span class=
+      "CodeText"><span style='font-size:10.0pt'>s2</span></span> is
+      unknown, programs should use <span class=
+      "CodeText"><span style=
+      'font-size: 10.0pt'>strncpy</span></span>, annotated as:</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim" style='margin-left:22.5pt'>void /*@alt char *
+@*/ strncpy</p>
+<p class="Verbatim" style='margin-left:22.5pt'>&nbsp;&nbsp;
+(/*@unique@*/ /*@out@*/ /*@returned@*/ char *s1, char *s2,</p>
+<p class="Verbatim" style='margin-left:22.5pt;text-indent:13.5pt'>
+&nbsp; size_t n)</p>
+<p class="Verbatim" style='margin-left:22.5pt'>
+&nbsp;&nbsp;/*@modifies *s1@*/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
+<p class="Verbatim" style='margin-left:22.5pt'>&nbsp; /*@requires
+maxSet(s1) &gt;= ( n - 1 ); @*/</p>
+<p class="Verbatim" style='margin-left:22.5pt'>&nbsp; /*@ensures
+maxRead (s2) &gt;= maxRead(s1) /\ maxRead (s1) &lt;= n;@*/;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The syntax for buffer size constraint clauses
+is:</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" align="left" style=
+'margin-left: 22.5pt;text-align:left'><i><span lang=
+"FR">constraint</span></i> <span lang="FR">&nbsp;</span>
+<span style='font-family:Symbol'>&#222;</span> <span lang=
+"FR">(</span><span class="Annot"><span style=
+'font-size:10.0pt'>requires</span></span> <span lang="FR">|</span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>ensures</span></span><span lang="FR">)
+<i>consExpr relOp consExpr</i></span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: 22.5pt;text-align:left'><i><span lang=
+"FR">relOp</span></i> <span lang=
+"FR">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>==</span></span>
+      <span lang="FR">|</span> <span class="Annot"><span style=
+      'font-size:10.0pt'>&gt;</span></span> <span lang=
+      "FR">|</span> <span class="Annot"><span style=
+      'font-size:10.0pt'>&gt;=</span></span> <span lang=
+      "FR">|</span> <span class="Annot"><span style=
+      'font-size:10.0pt'>&lt;</span></span> <span lang=
+      "FR">|</span> <span class="Annot"><span style=
+      'font-size:10.0pt'>&lt;=</span></span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: 22.5pt;text-align:left'><i><span lang=
+"FR">consExpr&nbsp;</span></i> <span style=
+'font-family:Symbol'>&#222;</span> <i><span lang=
+"FR">consExpression binOp consExpr</span></i> | <i>unaryOp</i>
+<span class="Annot"><span style=
+'font-size:10.0pt'>(</span></span><i>consExpr</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>)</span></span> | <i>term</i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: 22.5pt;text-align:left'><i>binOp</i>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size:10.0pt'>+</span></span> |
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>-</span></span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: 22.5pt;text-align:left'><i>unaryOp</i> &nbsp;
+<span style='font-family:Symbol'>&#222;</span> <span class=
+"Annot"><span style='font-size:10.0pt'>maxSet</span></span> |
+<span class="Annot"><span style=
+'font-size:10.0pt'>maxRead</span></span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: 22.5pt;text-align:left'><i>term</i>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <span style=
+'font-family:Symbol'>&#222;</span> <i>identifier</i> |
+<i>literal</i> | <span class="Annot"><span style=
+'font-size: 10.0pt'>result</span></span></p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975001">9.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Less Stringent Checking</a></h2>
+For some programs, Splint's standard bounds checking produces an
+unacceptably high number of warnings. Because of this, Splint now
+prioritizes warnings using a simple heuristic. The flags
+<span class="Flag"><span style=
+'font-size:10.0pt'>likely-bounds</span></span>, <span class=
+"Flag"><span style=
+'font-size:10.0pt'>likely-bounds-writes</span></span>, and
+<span class="Flag"><span style=
+'font-size:10.0pt'>likely-bounds-read</span></span> are similar to
+<span class="Flag"><span style=
+'font-size:10.0pt'>bounds</span></span>,<span class=
+"Flag"><span style='font-size:10.0pt'>bounds-write</span></span>,
+and <span class="Flag"><span style=
+'font-size:10.0pt'>bounds-read</span></span>, but they only cause
+Splint to produce warnings for what it determines are likely bounds
+errors. Splint classifies an unresolved constraint as a likely
+bounds error if it can reduce the constraint to a numerical
+inconsistency such as <span class="Verbatim">5 &gt;= 10</span>.
+Warnings for these constraints are more likely to be legitimate --
+indicating real bugs or the lack of annotations. Additionally, when
+these warnings are false positives, it is easier for humans to
+recognize them as spurious. These flags generate significantly
+fewer errors (an order of magnitude in some cases), and the errors
+generated are easier to understand. However, this does not come
+without cost. The checking is significantly less precise and is
+likely to miss real errors. 
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975001">9.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Warnings</a></h2>
+<p class="TextFontCX">Since bounds checking is more complex than
+other checks done by Splint, memory bounds warnings contain
+extensive information about the unresolved constraint.&nbsp;
+Warning messages for unresolved constraints contain both the
+original constraints and the simplified form of the constraint
+which cannot be resolved.&nbsp; If the constraint was derived from
+a function precondition, the original precondition is included in
+the error message.&nbsp; If the <span class=
+      "Flag"><span style='font-size:10.0pt'>+showconstraintlocation</span></span>
+      flag is set, the message includes the expression that the
+      constraint is derived from.&nbsp; The <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>+showconstraintparens</span></span> flag
+      directs Splint to display fully parenthesized constraints in
+      warnings to remove ambiguity.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Consider the code excerpt below containing a
+trivial out-of-bounds write:</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim" style='text-indent:.5in'>int buf[10];</p>
+<p class="Verbatim" style='text-indent:.5in'>buf[10] = 3;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" style='margin-bottom:6.0pt'>Splint warns:</p>
+<p align="left" class="lclintrun" style='margin-left:.5in'>
+setChar.c:5:4: Likely out-of-bounds store:<br>
+&nbsp;&nbsp;&nbsp; buf[10] = 3</p>
+<p class="lclintrun" align="left" style='margin-left:.5in'>
+&nbsp;&nbsp;&nbsp; Unable to resolve constraint: requires 9 &gt;=
+10</p>
+<p class="lclintrun" align="left" style=
+'margin-top:0in;margin-right:0in;margin-bottom:6.0pt; margin-left:.5in'>
+&nbsp;&nbsp;&nbsp; needed to satisfy precondition: requires
+maxSet(buf @ setChar.c:5:4) &gt;= 10</p>
+<p class="TextFontCX">Splint has simplified the constraint from the
+<span class="Annot"><span style=
+'font-size:10.0pt'>requires</span></span> clause to
+      <span class="CodeText"><span style='font-size:10.0pt'>9 &gt;=
+      10</span></span> by substituting for the known value of
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>maxSet(buf)</span></span> and generated a
+      warning because 9(the highest index of <span class=
+      "CodeText"><span style='font-size:10.0pt'>buf</span></span>
+      that may be safely written to) is not greater than or equal
+      to 10.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A more realistic example is shown Figure
+21.&nbsp; The function <span class="CodeText"><span style=
+'font-size:10.0pt'>updateEnv</span></span> is a na&#239;ve
+implementation of a function to copy an environmental
+variable.&nbsp; There is no standard restriction on the length of
+the return value of <span class="CodeText"><span style=
+'font-size:10.0pt'>getenv</span></span> so this can cause a buffer
+overflow.&nbsp; A safe version of <span class=
+"CodeText"><span style='font-size:10.0pt'>updateEnv</span></span>
+(such as <span class="CodeText"><span style=
+'font-size:10.0pt'>updateEnvSafe</span></span> in Figure 21) would
+ensure that the buffer is large enough to hold the environment
+variable string before copying.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>requires</span></span> clause means Splint will
+report a warning if a call to <span class=
+      "CodeText"><span style='font-size:10.0pt'>updateEnvSafe</span></span>
+      passed in a buffer as <span class="CodeText"><span style=
+      'font-size:10.0pt'>str</span></span> that is not big enough
+      to hold the value passed as <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>strSize</span></span> characters.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">In many cases, functions will have multiple
+unresolved constraints which are similar.&nbsp; For example, if a
+subsequence statement writes to the next element of a buffer.&nbsp;
+Usually all these constraints represent all real problems or are
+all spurious.&nbsp; If the <span class="Flag"><span style=
+'font-size:10.0pt'>+redundantconstraints</span></span> flag is set,
+Splint reports even apparently redundant warning messages.&nbsp;
+Otherwise, if satisfying one unresolved constraint would imply
+satisfying another, Splint only prints a warning message for the
+stronger constraint.</p>
+<p class="TextFontCX">&nbsp;</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style='margin-left:9.9pt;border-collapse:collapse'>
+<tr>
+<td valign="top" style=
+'width:202.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>bounds.c</span></b></span></p></td>
+<td valign="top" style=
+'width:3.0in;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:202.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim"><span style=
+'font-family:Courier'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>void
+updateEnv(char * str)</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>{</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
+char * tmp;</span></p>
+<p class="Verbatim"><i><span style=
+'font-size:9.0pt;font-family:Courier'>7</span></i><span style='font-family:Courier'>
+&nbsp; tmp = getenv(&#8220;MYENV&#8221;);</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
+if (tmp != NULL)</span></p>
+<p class="Verbatim"><i><span style=
+'font-size:9.0pt;font-family:Courier'>9</span></i><span style='font-family:Courier'>
+&nbsp;&nbsp;&nbsp;&nbsp; strcpy (str, tmp);</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>}</span></p>
+<p class="Verbatim"><span style=
+'font-family:Courier'>&nbsp;</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>void
+updateEnvSafe (char * str,</span></p>
+<p class="Verbatim"><span style=
+'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+size_t strSize)</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>&nbsp;</span>
+<a href="mailto:/*@requires"><span style=
+'font-family:Courier'>/*@requires</span></a> <span style=
+'font-family:Courier'>maxSet(str)</span></p>
+<p class="Verbatim"><span style=
+'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+&gt;= strSize &#8211;1@*/</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>{</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
+char * tmp;</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
+tmp = getenv(&#8220;MYENV&#8221;);</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
+if (tmp != NULL)</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
+{</span></p>
+<p class="Verbatim"><span style=
+'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; strncpy (str,
+tmp,</span></p>
+<p class="Verbatim"><span style=
+'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+strSize -1);</span></p>
+<p class="Verbatim"><span style=
+'font-family:Courier'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; str[strSize
+-1] = &#8216;/0&#8217;;</span></p>
+<p class="Verbatim"><span style='font-family:Courier'>&nbsp;&nbsp;
+}</span></p>
+<p class="Verbatim"><span style=
+'font-family:Courier'>}</span></p></td>
+<td valign="top" style=
+'width:3.0in;border-top:none;border-left:none; border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint bounds.c +bounds
++showconstraintlocation</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">bounds.c:9: Possible out-of-bounds store:</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; strcpy(str, tmp)</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; Unable to resolve
+constraint:</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; requires maxSet(str @
+bounds.c:9) &gt;=</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; maxRead(getenv("MYENV") @
+bounds.c:7)</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp;&nbsp; needed to satisfy
+precondition:</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; requires maxSet(str @
+bounds.c:9) &gt;=</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; maxRead(tmp @
+bounds.c:9)</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp;&nbsp; derived from strcpy
+precondition: requires</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; maxSet(&lt;parameter 1&gt;)
+&gt;=</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; maxRead(&lt;parameter
+2&gt;)</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Ref534909813"></a><a name=
+"_Ref534909817">Figure 21</a>.&nbsp; Memory
+Bounds</p></td></tr></table></center>
+<br clear="all">
+ 
+<p class="TextFontCX">The <span class="Flag"><span style=
+'font-size:10.0pt'>+functionpost</span></span> flag is useful for
+determining if array bounds warnings are spurious.&nbsp; If this
+flag is set, Splint will print the constraints that it established
+at the end of the function.&nbsp; If the warnings are spurious,
+localized control comments can be used to suppress them.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975002"></a><a name="_Ref534642928"></a><a name=
+"_Ref534642285">10<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="extensible" name="extensible">
+Extensible Checking</a></a></h1>
+<p class="TextFontCX">Splint provides mechanisms for defining new
+checks and annotations using metastate definitions.&nbsp;
+User-defined checks can be used to check and document properties
+not supported by the provided checks.<a href="#_ftn13" name=
+"_ftnref13" title=""><span class=
+      "MsoFootnoteReference"><span class="MsoFootnoteReference"><span style='font-size:11.0pt;font-family:"Times New Roman"'>
+[13]</span></span></span></a></p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A large class of useful checks can be
+described as constraints on attributes associated with program
+objects or the global execution state. Unlike types, however, the
+values of these attributes can change along an execution
+path.&nbsp; Splint provides a general language that lets users
+define attributes associated with different kinds of program
+objects as well as rules that both constrain attributes&#8217;
+values at interface points and specify how attributes
+change.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Because user-defined attribute checking is
+integrated with normal checking, Splint&#8217;s analysis of
+user-defined attributes can take advantage of other analyses, such
+as alias and nullness analysis.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975003">10.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Defining Attributes</a></h2>
+<p class="TextFontCX">To define an attribute, create a metastate
+file (<span class="ProgramNameChar"><span style=
+'font-size: 10.0pt'>.mts</span></span>) that defined the possible
+values and transfer rules of the attribute.&nbsp; Attributes can
+either be associated with a particular kind of program object (for
+example, all <span class="CodeText"><span style=
+'font-size:10.0pt'>char *</span></span>&#8217;s) or with the global
+state (whether or not the network has been initialized).&nbsp; The
+<span class="Flag"><span style='font-size:10.0pt'>&#8211;mts
+<i>&lt;file&gt;</i></span></span> flag is used to direct Splint to
+read a metastate file (which will be found on the
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>LARCH_PATH</span></span> with default
+      extension <span class="ProgramNameChar"><span style=
+      'font-size:10.0pt'>.mts</span></span>).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">An example attribute definition is shown in
+Figure 22.&nbsp; It defines the <span class=
+      "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
+      attribute for recording whether or not a <span class=
+      "CodeText"><span style='font-size: 10.0pt'>char
+      *</span></span> came from a possibly untrustworthy
+      source.&nbsp; Knowing whether a value is possibly hostile is
+      useful for preventing several security vulnerabilities
+      including format string bugs.<a href="#_ftn14" name=
+      "_ftnref14" title=""><span class=
+      "MsoFootnoteReference"><span class=
+      "MsoFootnoteReference"><span style=
+      'font-size:11.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>&nbsp;
+      (A simpler way to detect format vulnerabilities is to warn
+      for any format string that is unknown at compile time. Splint
+      provides this checking, issuing a warning if the <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>+formatconst</span></span> flag is set and
+      finds any unknown format strings at compile time. This can
+      produce spurious messages, however, because there might be
+      unknown format strings that are not vulnerable to hostile
+      input.)</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The first three lines of the attribute
+definition define the <span class="Annot"><span style=
+'font-size:10.0pt'>taintedness</span></span> attribute associated
+with <span class="CodeText"><span style='font-size:10.0pt'>char
+*</span></span> objects, which can be in one of two states:
+<span class="Annot"><span style=
+'font-size:10.0pt'>untainted</span></span> or <span class=
+"Annot"><span style='font-size:10.0pt'>tainted</span></span>.&nbsp;
+The <span class="Annot"><span style=
+'font-size:10.0pt'>context</span></span> clause gives a context
+selector for which objects have the attribute. &nbsp;&nbsp;In this
+case, <span class="Annot"><span style='font-size:10.0pt'>reference
+char *</span></span> means that every reference that is a
+<span class="CodeText"><span style='font-size:10.0pt'>char
+*</span></span> has an associated <span class=
+      "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
+      attribute.&nbsp; Other contexts include <span class=
+      "Annot"><span style=
+      'font-size: 10.0pt'>parameter</span></span> (only parameter
+      declarations), <span class="Annot"><span style=
+      'font-size:10.0pt'>literal</span></span> (only string or
+      number literals), and <span class="Annot"><span style=
+      'font-size:10.0pt'>null</span></span> (only known
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>NULL</span></span> values).&nbsp;
+      Attribute can also be defined that are not associated with
+      any particular object, but instead are associated with the
+      global state of a program execution.&nbsp; The <span class=
+      "Annot"><span style='font-size:10.0pt'>global</span></span>
+      keyword is used before <span class="Annot"><span style=
+      'font-size:10.0pt'>attribute</span></span> to define a global
+      attribute.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>oneof</span></span> clause introduces two
+identifiers for representing the <span class=
+      "Annot"><span style='font-size:10.0pt'>taintedness</span></span>
+      value: <span class="Annot"><span style=
+      'font-size:10.0pt'>untainted</span></span> for references
+      that are not derived from untrustworthy input, and
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>tainted</span></span> for references that
+      may contain hostile data.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>annotations</span></span> clause defines two new
+annotations that may be used to describe <span class=
+"Annot"><span style='font-size:10.0pt'>taintedness</span></span>
+assumptions.&nbsp; In this case, the annotations match the names of
+the value choices, but they may be any identifier.&nbsp; The clause
+<span class="Annot"><span style='font-size:10.0pt'>tainted
+<b>reference ==&gt;</b> tainted</span></span> defines the
+<span class="Annot"><span style=
+'font-size:10.0pt'>tainted</span></span> annotation that may be
+used on a reference to indicate that it has <span class=
+"Annot"><span style='font-size: 10.0pt'>tainted</span></span>
+state.&nbsp;</p>
+<center>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" align="left" height="264" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="Verbatim"><span class="Annot"><b>attribute</b></span>
+<span class="Annot">taintedness</span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp; <b>context</b>
+<b>reference</b> char *</span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp; <b>oneof</b>
+untainted, tainted</span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;
+<b>annotations</b></span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;&nbsp;&nbsp;
+tainted <b>reference ==&gt;</b> tainted</span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;&nbsp;&nbsp;
+untainted <b>reference ==&gt;</b> untainted</span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;
+<b>transfers</b></span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;&nbsp;&nbsp;
+tainted <b>as</b> untainted <b>==&gt; error</b> "Possibly tainted
+storage used where untainted required."</span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;
+<b>merge</b></span></p>
+<p class="Verbatim"><span class=
+"Annot">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tainted <b>+</b> untainted
+<b>==&gt;</b> tainted</span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;&nbsp;
+<b>defaults</b></span></p>
+<p class="Verbatim"><span class=
+"Annot">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; reference <b>==&gt;</b>
+tainted</span></p>
+<p class="Verbatim"><span class="Annot">&nbsp;
+&nbsp;&nbsp;&nbsp;&nbsp;literal <b>==&gt;</b> untainted</span></p>
+<p class="Verbatim"><span class=
+"Annot">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; null <b>==&gt;</b>
+untainted</span></p>
+<p class="Verbatim"><span class="Annot"><b>end</b></span></p>
+<p class="MsoCaption"><a name="_Ref534921559">Figure 22</a>.&nbsp;
+Taintedness Attribute</p></td></tr></table></center>
+<br clear="all">
+ 
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>transfers</span></span> clause defines rules for
+state changes and warning when objects are passed as parameters,
+returned, or assigned to externally visible references.&nbsp; The
+rule, <span class="Annot"><span style='font-size:10.0pt'>tainted
+<b>as</b> untainted <b>==&gt; error</b> "Possibly tainted storage
+used where untainted required."</span></span>, means it is an error
+to pass a <span class="Annot"><span style=
+'font-size:10.0pt'>tainted</span></span> value as a parameter that
+has <span class="Annot"><span style=
+'font-size:10.0pt'>untainted</span></span> taintedness.&nbsp; All
+other transfers are implicitly permitted, and leave the passed
+storage in the same state as before the transfer.&nbsp; We may also
+use a <span class="Annot"><span style=
+'font-size:10.0pt'>transfers</span></span> clause to indicate that
+the reference changes state after a transfer.&nbsp; A
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>losereference</span></span> clause (not
+      used in taintedness) is similar to a <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>transfers</span></span> clause, except it
+      is used to provide rules for when a reference to storage is
+      lost, either by leaving the scope in which it was declared,
+      returning from a function, or assigning it to a new
+      value.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>merge</span></span> clause defined rules for
+combining state along paths.&nbsp; The clause<span class=
+"Annot"><span style='font-size:10.0pt'>merge tainted + untainted
+==&gt; tainted</span></span> indicates that combining
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>tainted</span></span> and <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>untainted</span></span> objects produces a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>tainted</span></span> object. Thus, if a
+      reference is <span class="Annot"><span style=
+      'font-size:10.0pt'>tainted</span></span> along one control
+      path and <span class="Annot"><span style=
+      'font-size:10.0pt'>untainted</span></span> along another
+      control path, checking assumes that it is <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>tainted</span></span>after the two
+      branches merge. It is also used to merge taintedness states
+      in function specifications (see the <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>strcat</span></span> example in the next
+      section).&nbsp; We can also define error combinations so that
+      a warning is reported if the states on different paths are
+      incompatible.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>defaults</span></span> clause specifies default
+values used for declarators without explicit attribute annotations.
+We choose default values to make it easy to start checking an
+unannotated program. Here we assume unannotated references are
+<span class="Annot"><span style=
+'font-size:10.0pt'>tainted</span></span> and Splint will report a
+warning where unannotated references are passed to functions that
+require untainted parameters. The warnings indicate either a format
+bug in the code or a place where an <span class=
+      "Annot"><span style='font-size:10.0pt'>untainted</span></span>
+      annotation should be added. Running Splint again after adding
+      the annotation will propagate the newly documented assumption
+      through the program.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" style='margin-bottom:6.0pt'>The full grammar
+for metastate definitions is given in Appendix C.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975004">10.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Annotations</a></h2>
+<p class="TextFontCX">The annotations defined by metastate
+definitions can be used like normal annotations.&nbsp; The context
+specifier for an annotation indicates where it may be used.&nbsp;
+For the taintedness example, we can use <span class=
+"Annot"><span style='font-size:10.0pt'>tainted</span></span> and
+<span class="Annot"><span style=
+'font-size:10.0pt'>untainted</span></span> as annotations wherever
+<span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span> could be used.&nbsp; This
+includes <span class="Annot"><span style=
+'font-size:10.0pt'>ensures</span></span> and <span class=
+"Annot"><span style='font-size:10.0pt'>requires</span></span>
+clauses, which allows us to specify functions that modify state
+associated with metastate definitions.&nbsp; The syntax
+      <span class="Annot"><i><span style=
+      'font-size: 10.0pt'>&lt;expr&gt;</span></i></span><span class="Annot">
+<span style=
+'font-size: 10.0pt'>:<i>&lt;attribute&gt;</i></span></span> is used
+to refer to the value of the user-defined attribute for expression
+<span class="Annot"><i><span style=
+'font-size:10.0pt'>&lt;expr&gt;</span></i></span>.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">It is often necessary to extend the library
+specifications with metastate annotations.&nbsp; We don&#8217;t
+want to have different versions of the library for different
+metastate annotations, so instead Splint provides a mechanism for
+adding annotations separately using an <span class=
+"ProgramNameChar"><span style='font-size:10.0pt'>.xh</span></span>
+file.&nbsp; For the taintedness example, we do this by providing
+annotated declarations in the <span class=
+"ProgramNameChar"><span style=
+'font-size:10.0pt'>tainted.xh</span></span> file. Example
+specifications in this file include:</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="Verbatim">int printf&nbsp; (/*@untainted@*/ char *fmt,
+...);</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">char *fgets (char *s, int n, FILE *stream)
+/*@ensures tainted s@*/ ;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">char *strcat (/*@returned@*/ char *s1,&nbsp;
+char *s2)&nbsp;</p>
+<p class="Verbatim">&nbsp;&nbsp; /*@ensures s1:taintedness =
+s1:taintedness | s2:taintedness @*/</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="CodeText"><span style=
+'font-size:10.0pt'>strcat</span></span> specification uses
+<span class="Annot"><span style='font-size:10.0pt'>/*@ensures
+s1:taintedness = s1:taintedness | s2:taintedness @*/</span></span>
+to indicate that the taintedness of <span class=
+"CodeText"><span style='font-size:10.0pt'>s1</span></span> after
+<span class="CodeText"><span style=
+'font-size:10.0pt'>strcat</span></span> returns is the result of
+merging the taintedness of <span class=
+      "CodeText"><span style='font-size:10.0pt'>s1</span></span>
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>s2</span></span> before the call.&nbsp;
+      Because the parameters lack annotations, they are implicitly
+      tainted according to the default rules and either untainted
+      or tainted references can be passed as parameters to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>strcat</span></span>. The <span class=
+      "Annot"><span style='font-size:10.0pt'>ensures</span></span>
+      clause means that after <span class="CodeText"><span style=
+      'font-size:10.0pt'>strcat</span></span> returns the first
+      parameter (and the result, because of the returned annotation
+      on <span class="CodeText"><span style=
+      'font-size:10.0pt'>s1</span></span>) will be tainted if
+      either passed object was tainted.&nbsp; Splint merges the two
+      taintedness states using the attribute definition
+      rules&#8212;hence, if the <span class="CodeText"><span style=
+      'font-size:10.0pt'>s1</span></span> parameter is untainted
+      and the <span class="CodeText"><span style=
+      'font-size:10.0pt'>s2</span></span> parameter is tainted, the
+      result and first parameter will be tainted after <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>strcat</span></span> returns.</p>
+<p class="TextFontCX">&nbsp;</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975006"></a><a name="_Ref534642895"></a><a name=
+"_Ref534642215">11<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="macros" name="macros">
+Macros</a></a></h1>
+<p class="TextFontCX">Macros are commonly used in C programs to
+implement constants or to mimic functions without the overhead of a
+function call.&nbsp; Macros that are used to implement functions
+are a persistent source of bugs in C programs, since they may not
+behave like the intended function when they are invoked with
+certain parameters or used in certain syntactic contexts.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint eliminates most of the potential
+problems by detecting macros with dangerous implementations and
+dangerous macro invocations.&nbsp; Whether or not a macro
+definition is checked or expanded normally depends on flag settings
+and control comments (see Section 11.3).&nbsp; Stylized macros can
+also be used to define control structures for iterating through
+many values (see Section 11.4).</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975007"></a><a name="_Ref361651263"></a><a name=
+"_Ref344916524"></a><a name="_Ref344908437"></a><a name=
+"_Toc344355419">11.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Constant Macros</a></h2>
+<p class="TextFontCX">Macros may be used to implement
+constants.&nbsp; To get type-checking for constant macros, use the
+<span class="Annot"><span style=
+'font-size:10.0pt'>constant</span></span> annotation.&nbsp; For
+example,</p>
+<p class="example">/*@constant null char *mstring_undefined@*/</p>
+<p class="TextFontCX">Declared constants are not expanded and are
+checked according to the declaration.&nbsp; A constant with a
+<span class="Annot"><span style=
+'font-size:10.0pt'>null</span></span> annotation may be used as
+<span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span> storage.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975008"></a><a name="_Toc344355420"></a><a name=
+"_Ref343363760">11.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Function-like Macros</a></h2>
+<p class="TextFontCX">Using macros to imitate functions is
+notoriously dangerous.&nbsp; Consider this broken macro for
+squaring a number:</p>
+<p class="example"># define square(x) x * x</p>
+<p class="TextFontCX">This works fine for a simple invocation like
+<span class="CodeText"><span style=
+'font-size:10.0pt'>square(i)</span></span>.&nbsp; It behaves
+unexpectedly, though, if it is instantiated with a parameter that
+has a side effect.&nbsp; For example, <span class=
+"CodeText"><span style=
+'font-size: 10.0pt'>square(i++)</span></span> expands to
+<span class="CodeText"><span style='font-size:10.0pt'>i++ *
+i++</span></span>.&nbsp; Not only does this give the incorrect
+result, it has undefined behavior since the order in which the
+operands are evaluated is not defined.&nbsp; (See Section 8.2 for
+more information on how expressions exhibiting undefined evaluation
+order behavior are detected by Splint.)&nbsp; To correct the
+problem we either need to rewrite the macro so that its parameter
+is evaluated exactly once, or prevent clients from invoking the
+macro with a parameter that has a side effect.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Another possible problem with macros is that
+they may produce unexpected results because of operator precedence
+rules.&nbsp; The instantiation, <span class=
+      "CodeText"><span style='font-size:10.0pt'>square(i+1)</span></span>
+      expands to <span class="CodeText"><span style=
+      'font-size:10.0pt'>i+1*i+1</span></span>, which evaluates to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>i+i+1</span></span> instead of the square
+      of <span class="CodeText"><span style=
+      'font-size:10.0pt'>i+1</span></span>.&nbsp; To ensure the
+      expected behavior, the macro parameter should be enclosed in
+      parentheses where it is used in the macro body.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Macros may also behave unexpectedly if they
+are not syntactically equivalent to an expression.&nbsp; Consider
+the macro definition,</p>
+<p class="example"># define incCounts()&nbsp; ntotal++;
+ncurrent++;</p>
+<p class="TextFontCX">This works fine, unless it is used as a
+statement.&nbsp; For example,</p>
+<p class="example">if (x &lt; 3) incCounts();</p>
+<p class="TextFontCX">increments <span class=
+      "CodeText"><span style='font-size:10.0pt'>ntotal</span></span>
+      if <span class="CodeText"><span style='font-size:10.0pt'>x
+      &lt; 3</span></span> but always increments <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>ncurrent</span></span>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">One solution is to use the comma operator to
+define the macro:</p>
+<p class="example"># define incCounts()&nbsp; (ntotal++,
+ncurrent++)</p>
+<p class="beforelist">More complicated macros can be written using
+a <span class="CodeText"><span style='font-size:10.0pt'>do &#8230;
+while</span></span> construction:</p>
+<p class="Verbatim">&nbsp; # define incCounts() \</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp; do { ntotal++;
+ncurrent++; } while (FALSE)</p>
+<p class="afterlist">Splint detects these pitfalls in macro
+definitions, and checks that a macro behaves as much like a
+function as possible.&nbsp; A client should only be able to tell
+that a function was implemented by a macro if it attempts to use
+the macro as a pointer to a function.</p>
+<p class="MsoListBullet">&nbsp;</p>
+<p class="beforelist">Splint does these checks on a macro
+definition corresponding to a function:</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Each parameter to a macro (except those declared to be side effect
+free, see Section 11.2.1) must be used exactly once in all possible
+executions of the macro, so side effecting arguments behave as
+expected.<a href="#_ftn15" name="_ftnref15" title=
+      ""><span class="MsoFootnoteReference"><span class=
+      "MsoFootnoteReference"><span style=
+      'font-size:11.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>&nbsp;
+      (Controlled by <span class="Flag"><span style=
+      'font-size:10.0pt'>macroparams</span></span>.)</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+A parameter to a macro may not be used as the left-hand side of an
+assignment expression or as the operand of an increment or
+decrement operator in the macro text, since this produces
+non-functional behavior.&nbsp; (Controlled by <span class=
+"Flag"><span style=
+'font-size:10.0pt'>macroassign</span></span>.)</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Macro parameters must be enclosed in parentheses when they are used
+in potentially dangerous contexts.&nbsp; (Controlled by
+      <span class="Flag"><span style=
+      'font-size: 10.0pt'>macroparens</span></span>.)</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+A macro definition must be syntactically equivalent to a statement
+when it is invoked followed by a semicolon. (Controlled by
+<span class="Flag"><span style=
+'font-size:10.0pt'>macrostmt</span></span>.)</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+The type of the macro body must match the return type of the
+corresponding function.&nbsp; If the macro is declared with type
+<span class="CodeText"><span style=
+'font-size:10.0pt'>void</span></span>, its body may have any type
+but the macro value may not be used.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+All variables declared in the body of a macro definition must be in
+the macro variable namespace, so they do not conflict with
+variables in the scope where the macro is invoked (which may be
+used in the macro parameters).&nbsp; By default, the macro
+namespace is all names prefixed by <span class=
+"CodeText"><span style='font-size:10.0pt'>m_</span></span>.&nbsp;
+(See Section 12.2 for information on controlling namespaces.)</p>
+<p class="afterlist">At the call site, a macro is checked like any
+other function call.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975009"></a><a name="_Toc344355421"></a><a name=
+"_Ref343109609">11.2.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Side
+Effect Free Parameters</a></h3>
+<p class="beforelist">Suppose we really do want to implement
+<span class="CodeText"><span style=
+'font-size:10.0pt'>square</span></span> as a macro, but want do so
+in a safe way.&nbsp; One way to do this is to require that it is
+never invoked with a parameter that has a side effect.&nbsp; Splint
+will check that this constraint holds, if the parameter is
+annotated to be side effect free.&nbsp; That is, the expression
+corresponding to this parameter must not modify any state, so it
+does not matter how many times it is evaluated.&nbsp; The
+<span class="Annot"><span style=
+'font-size:10.0pt'>sef</span></span> annotation is used to denote a
+parameter that may not have any side effects:</p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp;
+extern int square (/*@sef@*/ int x);</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp; #
+define square(x) ((x) *(x))</span></p>
+<p class="afterlist">Now, Splint will not report an error checking
+the definition of <span class="CodeText"><span style=
+'font-size:10.0pt'>square</span></span> even though
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>x</span></span> is used more than
+      once.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A message will be reported, however, if
+<span class="CodeText"><span style=
+'font-size:10.0pt'>square</span></span> is invoked with a parameter
+that has a side effect.&nbsp; For the code fragment,</p>
+<p class="example">square (i++)</p>
+<p class="beforelist">Splint produces the message:</p>
+<p class="Verbatim">&nbsp;&nbsp; <span style=
+'font-family:Arial'>Parameter 1 to square is declared sef,</span>
+<span style='font-family:Arial'>but the argument may modify:
+i++</span></p>
+<p class="betweenlists">It is also an error to pass a macro
+parameter that is not annotated with <span class=
+"Annot"><span style='font-size:10.0pt'>sef</span></span> as a
+<span class="Annot"><span style=
+'font-size:10.0pt'>sef</span></span> macro parameter in the body of
+a macro definition.&nbsp; For example,</p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp;
+extern int sumsquares (int x, int y);</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp; #
+define sumsquares(x,y) (square(x) + square(y))</span></p>
+<p class="afterlist">Although <span class=
+      "CodeText"><span style='font-size:10.0pt'>x</span></span>
+      only appears once in the definition of <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>sumsquares</span></span> it will be
+      evaluated twice since <span class="CodeText"><span style=
+      'font-size:10.0pt'>square</span></span> is expanded.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">A parameter may be passed as a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>sef</span></span> parameter without an
+      error being reported, if Splint can determine that evaluating
+      the parameter has no side effects.&nbsp; For function calls,
+      the modifies clause is used to determine if a side effect is
+      possible.<a href="#_ftn16" name="_ftnref16" title=
+      ""><span class="MsoFootnoteReference"><span class=
+      "MsoFootnoteReference"><span style=
+      'font-size:11.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>&nbsp;&nbsp;
+      To prevent many spurious errors, if the called function has
+      no modifies clause, Splint will report an error only if
+      <span class="Flag"><span style=
+      'font-size: 10.0pt'>sef-uncon</span></span> is on.&nbsp;
+      Justifiably paranoid programmers will insist on setting
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>sef-uncon</span></span> on, and will add
+      modifies clauses to unconstrained functions that are used in
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>sef</span></span> macro arguments.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">One common application of macros is to get
+around the lack of polymorphism in C.&nbsp; We can use the
+<span class="Annot"><span style='font-size: 10.0pt'>/*@alt
+&lt;type&gt;,<sup>+</sup>@&gt;</span></span> syntax &nbsp;(see
+Section 4.4) to indicate that an alternate type may be used.&nbsp;
+For example,</p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp; extern int
+/*@alt float@*/ square (/*@sef@*/ int /*@alt float@*/
+x);</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp; # define
+square(x) ((x) *(x))</span></p>
+<p class="afterlist">declares <span class=
+      "CodeText"><span style='font-size:10.0pt'>square</span></span>
+      for both <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>s and <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>float</span></span>s.&nbsp; Note however,
+      that the return type is either <span class=
+      "CodeText"><span style='font-size:10.0pt'>int</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>float</span></span>, regardless of the
+      actual parameter type.&nbsp; This is weaker than what is
+      actually known about the return type.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975010"></a><a name="_Ref347227227">11.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Controlling Macro Checking</a></h2>
+<p class="TextFontCX">By default, Splint expands macros normally
+and checks the resulting code after macros have been
+expanded.&nbsp; Flags and control comments may be used to control
+which macros are expanded and which are checked as functions or
+constants.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">If the <span class="Flag"><span style=
+'font-size:10.0pt'>fcn-macros</span></span> flag is on, Splint
+assumes all macros defined with parameter lists implement functions
+and checks them accordingly.&nbsp; Parameterized macros are not
+expanded and are checked as functions with unknown result and
+parameter types (or using the types in the prototype, if one is
+given).&nbsp; The analogous flag for macros that define constants
+is <span class="Flag"><span style=
+'font-size:10.0pt'>const-macros</span></span>.&nbsp; If it is on,
+macros with no parameter lists are assumed to be constants, and
+checked accordingly.&nbsp; The <span class=
+      "Flag"><span style='font-size:10.0pt'>all-macros</span></span>
+      flag sets both <span class="Flag"><span style=
+      'font-size:10.0pt'>fcn-macros</span></span> and <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>const-macros</span></span>.&nbsp; If the
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>macro-fcn-decl</span></span>&nbsp;flag is
+      set, a message reports parameterized macros with no
+      corresponding function prototype.&nbsp; If the <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>macro-const-decl</span></span>&nbsp;flag
+      is set, a similar message reports macros with no parameters
+      that have no corresponding constant declaration.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">The macro checks described in the previous
+sections make sense only for macros that are intended to replace
+functions or constants.&nbsp; When <span class=
+      "Flag"><span style='font-size:10.0pt'>fcnmacros</span></span>
+      or <span class="Flag"><span style=
+      'font-size:10.0pt'>constmacros</span></span> is on, more
+      general macros need to be marked so they will not be checked
+      as functions or constants, and will be expanded
+      normally.&nbsp; Macros that are not meant to behave like
+      functions should be preceded by the /<span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>*@notfunction@*/</span></span>comment.&nbsp;
+      For example,</p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp;
+/*@notfunction@*/</span></p>
+<p class="Verbatim"><span style='font-size:9.5pt'>&nbsp;&nbsp; #
+define forever for(;;)</span></p>
+<p class="afterlist">Macros preceded by <span class=
+"Annot"><span style='font-size: 10.0pt'>notfunction</span></span>
+are expanded normally before regular checking is done.&nbsp; If a
+macro that is not syntactically equivalent to a statement without a
+semi-colon (e.g., a macro which enters a new scope) is not preceded
+by <span class="Annot"><span style=
+'font-size:10.0pt'>notfunction</span></span>, parse errors may
+result when <span class="Flag"><span style=
+'font-size:10.0pt'>fcn-macros</span></span>&nbsp;or
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>const-macros</span></span>&nbsp;is on.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref345771875"></a><a name="_Ref345489124"></a><a name=
+"_Toc344355423"></a><a name="_Toc534975011"></a><a name=
+"_Ref361651257"></a><a name="_Ref349897909"></a><a name=
+"_Ref344916532"></a><a name="_Ref344908410"></a><a name=
+"_Toc344355424">11.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Iterators</a></h2>
+<p class="TextFontCX">It is often useful to be able to execute the
+same code for many different values.&nbsp; For example, we may want
+to sum all elements in an <span class="CodeText"><span style=
+'font-size:10.0pt'>intSet</span></span> that represents a set of
+integers.&nbsp; If <span class="CodeText"><span style=
+'font-size:10.0pt'>intSet</span></span> is an abstract type, there
+is no easy way of doing this in a client module without depending
+on the concrete representation of the type.&nbsp; Instead, we could
+provide such a mechanism as part of the type&#8217;s
+implementation.&nbsp; We call a mechanism for looping through many
+values an <i>iterator</i>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The C language provides no mechanism for
+creating user-defined iterators.&nbsp; Splint supports a stylized
+form of iterators declared using syntactic comments and defined
+using macros.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Iterator declarations are similar to function
+declarations except instead of returning a value, they assign
+values to their <span class="Annot"><span style=
+'font-size:10.0pt'>yield</span></span> parameters in each
+iteration.&nbsp; For example, we could add this iterator
+declaration to <span class="Keyword"><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>intSet.h</span></span>:</p>
+<p class="example">/*@iter intSet_elements (intSet s, yield int
+el);@*/</p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>yield</span></span> annotation means that the
+variable passed as the second actual argument is declared as a
+local variable of type <span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span> and assigned a value in each
+loop iteration.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975012">11.4.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Defining
+Iterators</a></h3>
+<p class="beforelist">An iterator is defined using a macro.&nbsp;
+Here&#8217;s one (not particularly efficient) way of defining
+<span class="CodeText"><span style=
+'font-size:10.0pt'>intSet_elements</span></span>:</p>
+<p class="Verbatim">&nbsp;&nbsp; typedef /*@abstract@*/ struct
+{</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int
+nelements;</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int
+*elements;</p>
+<p class="Verbatim">&nbsp;&nbsp; } intSet;</p>
+<p class="Verbatim">&nbsp;&nbsp; &#8230;</p>
+<p class="Verbatim">&nbsp;&nbsp; # define intSet_elements(s,m_el)
+\</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp; { int m_i; \</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; for (m_i =
+(0); m_i &lt;= ((s)-&gt;nelements); m_i++) { \</p>
+<p class="Verbatim">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; int
+m_el = (s)-&gt;elements[(m_i)];</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">&nbsp;&nbsp; # define end_intSet_elements
+}}</p>
+<p class="afterlist">Each time through the loop, the yield
+parameter <span class="CodeText"><span style=
+'font-size:10.0pt'>m_el</span></span> is assigned to the next
+value.&nbsp; After each value has been assigned to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>m_el</span></span> for one iteration, the
+      loop terminates.&nbsp; Variables declared by the iterator
+      macro (including the <span class="Annot"><span style=
+      'font-size:10.0pt'>yield</span></span> parameter) are
+      preceded by the macro variable namespace prefix <span class=
+      "CodeText"><span style='font-size:10.0pt'>m_</span></span>
+      (see Section 11.2) to avoid conflicts with variables defined
+      in the scope where the iterator is used.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975013">11.4.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Using
+Iterators</a></h3>
+<p class="TextFontCX">The general structure for using an iterator
+is,</p>
+<p class="example"><i>iter</i> (<i>&lt;params&gt;</i>) stmt;
+end_<i>iter</i></p>
+<p class="beforelist">For example, a client could use
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>intSet_elements</span></span> to sum the
+      elements of an <span class="CodeText"><span style=
+      'font-size:10.0pt'>intSet</span></span>:</p>
+<p class="Verbatim">&nbsp;&nbsp; intSet s;</p>
+<p class="Verbatim">&nbsp;&nbsp; int sum = 0;</p>
+<p class="Verbatim">&nbsp;&nbsp; ...</p>
+<p class="Verbatim">&nbsp;&nbsp; intSet_elements (s, el) {</p>
+<p class="Verbatim" style='text-indent:.5in'>sum += el;</p>
+<p class="Verbatim">&nbsp;&nbsp; } end_intSet_elements;</p>
+<p class="afterlist">The actual parameter corresponding to a yield
+parameter, <span class="CodeText"><span style=
+'font-size:10.0pt'>el</span></span>, is not declared in the
+function scope.&nbsp; Instead, it is declared by the iterator and
+assigned to an appropriate value for each iteration.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">Splint will do the following checks for uses
+of stylized iterators:</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+An invocation of the iterator <span class=
+      "CodeText"><i><span style='font-size:10.0pt'>iter</span></i></span>
+      must be balanced by a corresponding end, named <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>end_<i>iter</i></span></span>.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+All actual parameters must be defined, except those corresponding
+to yield parameters.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Yield parameters must be new identifiers, not declared in the
+current scope or any enclosing scope.</p>
+<p class="afterlist">Iterators are a bit awkward to implement, but
+they enable compact, easily understood client code.&nbsp; For
+abstract collection types, an iterator can be used to enable
+clients to operate on elements of the collection without breaking
+data abstraction.<a name="_Ref348845281"></a><a name=
+"_Toc344355425"></a><a name="_Ref343247905"></a></p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975014"></a><a name="_Ref483663681"></a><a name=
+"_Ref350065611">12<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="naming" name="naming">
+Naming Conventions</a></a></h1>
+<p class="TextFontCX">Naming conventions tend to be a religious
+issue. Generally, it doesn't matter too much what naming convention
+is followed as long as one is chosen and followed
+religiously.&nbsp; There are two kinds of naming conventions
+supported by Splint.&nbsp; Type-based naming conventions (Section
+12.1) constrain identifier names according to the abstract
+types&nbsp;that are accessible where the identifier is
+defined.&nbsp; Prefix naming conventions (Section 12.2) constrain
+the initial characters of identifier names according to what is
+being declared and its scope.&nbsp; Naming conventions may be
+combined or different conventions may be selected for different
+kinds of identifiers.&nbsp; In addition, Splint supports checking
+that names do not conflict with names reserved for the standard
+library or implementation (Section 12.3) and are sufficiently
+distinguishable from other names.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975015"></a><a name="_Ref348079373"></a><a name=
+"_Ref347240654"></a><a name="_Toc344355426">12.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Type-Based Naming Conventions</a></h2>
+<p class="TextFontCX">Generic naming conventions constrain valid
+names of identifiers.&nbsp; By limiting valid names, namespaces may
+be preserved and programs may be more easily understood since the
+name gives clues as to how and where the name is defined and how it
+should be used.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Names may be constrained by the scope of the
+name (external, file static, internal), the file in which the
+identifier is defined, the type of the identifier, and global
+constraints.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975016"></a><a name=
+      "_Ref347994687">12.1.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
+      Czech Names</a></h3>
+<p class="TextFontCX">Czech<a href="#_ftn17" name="_ftnref17"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:11.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>
+   names denote operations and variables of abstract types by
+   preceding the names by <span class="CodeText"><i><span style=
+   'font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=
+   "CodeText"><span style='font-size:10.0pt'>_</span></span>.&nbsp;
+   The remainder of the name should begin with a lowercase
+   character, but may use any other character besides the
+   underscore.&nbsp; Types may be named using any non-underscore
+   characters.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" style='margin-bottom:6.0pt'>The Czech naming
+convention is selected by the <span class="Flag"><span style=
+'font-size:10.0pt'>czech</span></span>&nbsp;flag.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>access-czech</span></span> is on, a function,
+variable, constant or iterator named <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=
+"CodeText"><span style=
+'font-size:10.0pt'>_<i>&lt;name&gt;</i></span></span> has access to
+the abstract type <span class="CodeText"><i><span style=
+'font-size:10.0pt'>&lt;type&gt;</span></i></span>.&nbsp; Reporting
+of violations of the Czech naming convention is controlled by
+different flags depending on what is being declared:</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-fcns</span></span></p>
+<p class="TextFontCX" style='margin-left:13.5pt'>Functions and
+iterators.&nbsp; An error is reported for a function name of the
+form <span class="CodeText"><i><span style=
+'font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span class="CodeText">
+<span style='font-size:10.0pt'>_<i>&lt;name&gt;</i></span></span>
+where <span class="CodeText"><i><span style=
+'font-size:10.0pt'>&lt;prefix&gt;</span></i></span> is not the name
+of an accessible type.&nbsp; Note that if <span class=
+"Flag"><span style='font-size:10.0pt'>accessczech</span></span> is
+on, a type named <span class="CodeText"><i><span style=
+'font-size:10.0pt'>&lt;prefix&gt;</span></i></span> would be
+accessible in a function beginning with <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span class="CodeText">
+<span style='font-size:10.0pt'>_</span></span>.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>access-czech</span></span> is off, an error is
+reported instead.&nbsp; An error is reported for a function name
+that does not have an underscore if any abstract types&nbsp;are
+accessible where the function is defined.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-vars</span></span></p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-constants</span></span></p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-macros</span></span></p>
+<p class="IndentText">Variables, constants and expanded macros.
+&nbsp;An error is reported if the identifier name starts with
+<span class="CodeText"><i><span style=
+'font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span class="CodeText">
+<span style='font-size:10.0pt'>_</span></span>and
+      <span class="CodeText"><i><span style=
+      'font-size:10.0pt'>prefix</span></i></span> is not the name
+      of an accessible abstract type, or if an abstract type is
+      accessible and the identifier name does not begin with
+      <span class="CodeText"><i><span style=
+      'font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=
+      "CodeText"><span style='font-size:10.0pt'>_</span></span>
+      where <span class="CodeText"><i><span style=
+      'font-size:10.0pt'>type</span></i></span> is the name of an
+      accessible abstract type.&nbsp; If <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>access-czech</span></span>&nbsp;is on, the
+      representation of the type is visible in the constant or
+      variable definition.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-types</span></span></p>
+<p class="TextFontCX" style='margin-left:13.5pt'>User-defined
+types.&nbsp; An error is reported if a type name includes an
+underscore character.</p>
+<p class="Sidebar" align="right">Of course, this is a complete
+jumble to the uninitiated, and that&#8217;s the joke.</p>
+<p class="Sidebar" align="right" style='text-align:right'>
+<i>Charles Simonyi, on the Hungarian naming convention</i></p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975017"></a><a name=
+      "_Ref344878566">12.1.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
+      Slovak Names</a></h3>
+<p class="TextFontCX">Slovak names are similar to Czech names,
+except they are spelled differently.&nbsp; A Slovak name is of the
+form <span class="CodeText"><i><span style=
+'font-size:10.0pt'>&lt;type&gt;&lt;Name&gt;</span></i></span>.&nbsp;
+The type prefix may not use uppercase characters.&nbsp; The
+remainder of the name starts with the first uppercase
+character.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The <span class="Flag"><span style=
+'font-size:10.0pt'>slovak</span></span>&nbsp;flag selects the
+Slovak naming convention.&nbsp; Like Czech names, it may be used
+with <span class="Flag"><span style=
+'font-size:10.0pt'>access-slovak</span></span>&nbsp;to control
+access to abstract representations. The <span class=
+"Flag"><span style='font-size:10.0pt'>slovak-fcns</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>slovak-vars</span></span>, <span class=
+"Flag"><span style=
+'font-size:10.0pt'>slovak-constants</span></span>, and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>slovak-macros</span></span>&nbsp;flags are
+      analogous to the similar Czech flags.&nbsp; If <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>slovak-type</span></span> is on, an error
+      is reported if a type name includes an uppercase letter.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975018"></a><a name=
+      "_Ref347994743">12.1.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
+      Czechoslovak Names</a></h3>
+<p class="TextFontCX">Czechoslovak names are a combination of Czech
+names and Slovak names.&nbsp; Operations may be named either
+<span class="CodeText"><i><span style=
+'font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=
+"CodeText"><span style='font-size:10.0pt'>_</span></span> followed
+by any sequence of non-underscore characters, or <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>&lt;type&gt;</span></i></span> followed by an
+uppercase letter and any sequence of characters.&nbsp; Czechoslovak
+names have been out of favor since 1993, but may be necessary for
+checking legacy code. The <span class="Flag"><span style=
+'font-size:10.0pt'>czechoslovak-fcns</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-vars</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-macros</span></span>, and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-constants</span></span>
+      flags&nbsp;are analogous to the similar Czech flags.&nbsp; If
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-type</span></span>&nbsp;is
+      on, an error is reported if a type name contains either an
+      uppercase letter or an underscore character.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975019"></a><a name="_Ref347240687"></a><a name=
+"_Ref347222192">12.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Namespace Prefixes</a></h2>
+<p class="TextFontCX">Another way to restrict names is to constrain
+the leading character sequences of various kinds of
+identifiers.&nbsp; For example, the names of all user-defined types
+might begin with <span class="CodeText"><span style=
+'font-size:10.0pt'>T</span></span> followed by an uppercase letter
+and all file static names begin with an uppercase letter.&nbsp;
+This may be useful for enforcing a namespace (e.g., all names
+exported by the X-windows library should begin with
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>X</span></span>) or just making programs
+      easier to understand by establishing an enforced
+      convention.&nbsp; Splint can be used to constrain identifiers
+      in this way to detect identifiers inconsistent with
+      prefixes.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">All namespace flags are of the form,
+<span class="Flag"><span style=
+'font-size:10.0pt'>-<i>&lt;context&gt;</i>prefix
+<i>&lt;string&gt;</i></span></span>.&nbsp; For example, the macro
+variable namespace restricting identifiers declared in macro bodies
+to be preceded by <span class="CodeText"><span style=
+'font-size:10.0pt'>m_</span></span> would be selected by
+<span class="Flag"><span style=
+'font-size:10.0pt'>-macrovarprefix</span></span> <span class=
+"Flag"><span style='font-size:10.0pt'>"m_"</span></span>.&nbsp; The
+string may contain regular characters that may appear in a C
+identifier.&nbsp; These must match the initial characters of the
+identifier name.&nbsp; In addition, special characters (shown in
+Figure 23) can be used to denote a class of characters.<a href=
+"#_ftn18" name="_ftnref18" title=""><span class=
+"MsoFootnoteReference"><span class=
+"MsoFootnoteReference"><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>&nbsp;
+The <span class="CodeText"><span style=
+'font-size:10.0pt'>*</span></span> character may be used at the end
+of a prefix string to specify the rest of the identifier is zero or
+more characters matching the character immediately before the
+<span class="CodeText"><span style=
+'font-size:10.0pt'>*</span></span>.&nbsp; For example, the prefix
+string <span class="CodeText"><span style=
+'font-size:10.0pt'>T&amp;*</span></span> matches <span class=
+"CodeText"><span style='font-size:10.0pt'>T</span></span> or
+<span class="CodeText"><span style=
+'font-size:10.0pt'>TWINDOW</span></span> but not <span class=
+"CodeText"><span style='font-size:10.0pt'>Twin</span></span>.</p>
+<p class="beforelist">&nbsp;</p>
+<p class="beforelist">Different prefixes can be selected for the
+following identifier contexts:</p>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style='margin-left:.45in;border-collapse:collapse'>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-var-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any variable declared inside a macro
+body</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unchecked-macro-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any macro that is not checked as a function
+or constant (see Section 11.4)</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>tag-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Tags for <span class=
+      "CodeText"><span style='font-size:10.0pt'>struct</span></span>,
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>union</span></span> and <span class=
+      "CodeText"><span style='font-size:10.0pt'>enum</span></span>
+      declarations</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>enum-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Members of <span class=
+      "CodeText"><span style='font-size:10.0pt'>enum</span></span>
+      types</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>type-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Name of a user-defined type</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>file-static-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any identifier with file static
+scope</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>glob-var-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any variable (not of function type) with
+global scope</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>const-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any constant (see Section 11.1)</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iter-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">An iterator (see Section 11.4)</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>proto-param-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">A parameter in a function declaration
+prototype</p></td></tr>
+<tr>
+<td valign="top" style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>external-prefix</span></span></p></td>
+<td valign="top" style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any exported identifier</p></td></tr></table>
+<p class="afterlist">If an identifier is in more than one of the
+namespace contexts, the most specific defined namespace prefix is
+used (e.g., a global&nbsp;variable is also an exported identifier,
+so if <span class="Flag"><span style=
+'font-size:10.0pt'>global-var-prefix</span></span> is set, it is
+checked against the variable name; if not, the identifier is
+checked against the <span class="Flag"><span style=
+'font-size:10.0pt'>external-prefix</span></span>.)</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">For each prefix flag, a corresponding flag
+named <span class="Flag"><i><span style=
+'font-size:10.0pt'>&lt;prefixname&gt;</span></i></span><span class="Flag">
+<span style='font-size:10.0pt'>exclude</span></span> controls
+whether errors are reported if identifiers in a different namespace
+match the namespace prefix.&nbsp; For example, if
+      <span class="Flag"><span style=
+      'font-size: 10.0pt'>macro-var-prefix-exclude</span></span> is
+      on, Splint checks that no identifier that is not a variable
+      declared inside a macro body uses the macro variable
+      prefix.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">Here is a (somewhat draconian) sample naming
+convention:</p>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style='margin-left:5.4pt;border-collapse:collapse'>
+<tr>
+<td valign="top" style=
+'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>-unchecked-macro-prefix</span></span>
+<span class="Flag"><span style=
+'font-size:10.0pt'>"~*"</span></span></p></td>
+<td valign="top" style=
+'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Unchecked macros have no lowercase
+letters.</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>-type-prefix</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'>"T^&amp;*"</span></span></p></td>
+<td valign="top" style=
+'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">All type names begin with <span class=
+"CodeText"><span style='font-size:10.0pt'>T</span></span> followed
+by an uppercase letter.&nbsp; The rest of the name is all lowercase
+letters.</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>+type-prefix-exclude</span></span></p></td>
+<td valign="top" style=
+'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">No identifier that does not name a
+user-defined type name begins with the type name
+prefix.</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>-file-static-prefix</span></span>
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>"^&amp;&amp;&amp;"</span></span></p></td>
+<td valign="top" style=
+'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">File static scope variables begin with an
+uppercase letter and three lowercase letters.</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>-proto-param-prefix "p_"</span></span></p></td>
+<td valign="top" style=
+'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">All parameters in prototypes must begin with
+<span class="CodeText"><span style=
+'font-size:10.0pt'>p_</span></span>.</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>-glob-var-prefix "G"</span></span></p></td>
+<td valign="top" style=
+'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">All global variables start with
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>G</span></span>.</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>+glob-var-prefix-exclude</span></span></p></td>
+<td valign="top" style=
+'width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">No identifier that is not a
+global&nbsp;variable starts with <span class=
+      "CodeText"><span style='font-size:10.0pt'>G</span></span>.</p></td></tr></table>
+<p class="beforelist">&nbsp;</p>
+<p class="beforelist">The prefix for parameters in function
+prototypes is useful for making sure parameter names are not in
+conflict with macros defined before the function prototype.&nbsp;
+In most cases, it may be preferable to not name prototype
+parameters.&nbsp; If the <span class="Flag"><span style=
+'font-size:10.0pt'>proto-param-name</span></span>&nbsp;flag is set,
+an error is reported for any named parameter in a prototype
+declaration.&nbsp; If a <span class="Flag"><span style=
+'font-size:10.0pt'>proto-param-prefix</span></span>&nbsp;is set, no
+error is reported for unnamed parameters.</p>
+<p class="TextFontCX">It may also be useful to check the names of
+prototype parameters correspond to the names in definitions.&nbsp;
+While using header files as documentation is not generally
+recommended, it is common enough practice that it makes sense to
+check that parameter names are consistent.&nbsp; A discrepancy may
+indicate an error in the parameter order in the function
+prototype.&nbsp; If <span class="Flag"><span style=
+'font-size:10.0pt'>proto-param-match</span></span>&nbsp;is set,
+Splint will report an error if the name of a definition parameter
+does not match the corresponding prototype parameter (after
+removing the <span class="Flag"><span style=
+'font-size:10.0pt'>protoparamprefix</span></span>).</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'width:22.0pt;border-top:solid black 1.5pt; border-left:solid black 1.5pt;border-bottom:none;border-right:none; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="CodeText"><span style=
+'font-size:10.0pt'>^</span></span></p></td>
+<td valign="top" style=
+'width:401.55pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any uppercase letter, <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>A</span></span>-<span class=
+"CodeText"><span style=
+'font-size:10.0pt'>Z</span></span></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="CodeText"><span style=
+'font-size:10.0pt'>&amp;</span></span></p></td>
+<td valign="top" style=
+'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any lowercase letter, <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>a</span></span>-<span class=
+"CodeText"><span style=
+'font-size:10.0pt'>z</span></span></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="CodeText"><span style=
+'font-size:10.0pt'>%</span></span></p></td>
+<td valign="top" style=
+'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any character that is not an uppercase letter
+(allows lowercase letters, digits and underscore)</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="CodeText"><span style=
+'font-size:10.0pt'>~</span></span></p></td>
+<td valign="top" style=
+'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any character that is not a lowercase letter
+(allows uppercase letters, digits and underscore)</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="CodeText"><span style=
+'font-size:10.0pt'>$</span></span></p></td>
+<td valign="top" style=
+'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any letter (<span class=
+"CodeText"><span style=
+'font-size:10.0pt'>a</span></span>-<span class=
+"CodeText"><span style='font-size:10.0pt'>z</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>A</span></span>-<span class=
+"CodeText"><span style=
+'font-size:10.0pt'>Z</span></span>)</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="CodeText"><span style=
+'font-size:10.0pt'>/</span></span></p></td>
+<td valign="top" style=
+'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any letter or digit (<span class=
+"CodeText"><span style=
+'font-size:10.0pt'>A</span></span>-<span class=
+"CodeText"><span style='font-size:10.0pt'>Z</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>a</span></span>-<span class=
+"CodeText"><span style='font-size:10.0pt'>z</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>0</span></span>-<span class=
+"CodeText"><span style=
+'font-size:10.0pt'>9</span></span>)</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:22.0pt;border:none;border-left:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="CodeText"><span style=
+'font-size:10.0pt'>?</span></span></p></td>
+<td valign="top" style=
+'width:401.55pt;border:none;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX">Any character valid in a C
+identifier</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:22.0pt;border-top:none;border-left:solid black 1.5pt; border-bottom:solid black 1.5pt;border-right:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="CodeText"><span style=
+'font-size:10.0pt'>#</span></span></p></td>
+<td valign="top" style=
+'width:401.55pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" style='page-break-after: avoid'>Any digit,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>0</span></span>-<span class=
+"CodeText"><span style=
+'font-size:10.0pt'>9</span></span></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824625"></a><a name=
+"_Ref347220245"></a><a name="_Ref347220226"></a><a name=
+"_Toc347255399"></a><a name="_Ref347222037"></a><a name=
+"_Ref347222045"></a><a name="_Ref534824531">Figure 23</a>.&nbsp;
+Prefix Character Codes</p></td></tr></table></center>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975020"></a><a name="_Ref348079479"></a><a name=
+"_Ref347240790"></a><a name="_Toc344355427">12.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Naming Restrictions</a></h2>
+<p class="TextFontCX">Additional naming restrictions can be used to
+check that names do no conflict with names reserved for the
+standard library, and that identifier are sufficiently distinct
+(either for the compiler and linker, or for the programmer.)&nbsp;
+Restrictions may be different for names that are needed by the
+linker (<i>external</i> names) and names that are only needed
+during compilations (<i>internal</i> names).&nbsp; Names of
+non-<span class="CodeText"><span style=
+'font-size:10.0pt'>static</span></span> functions and global
+variables are external; all other names are internal.</p>
+<p class="Sidebar" align="right"><a name=
+"_Ref350062822"></a><a name="_Ref348845288"></a><a name=
+"_Toc344355429"></a><a name="_Ref343248602">&nbsp;</a></p>
+<p class="Sidebar" align="right">The decision to retain the old
+six-character case-insensitive restriction on significance was most
+painful.</p>
+<p class="Sidebar" align="right" style='text-align:right'><i>ANSI C
+Rationale</i></p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975021">12.3.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Reserved
+Names</a></h3>
+<p class="TextFontCX">Many names are reserved for the
+implementation and standard library.&nbsp; A complete list of
+reserved names can be found in [vdL, p. 126-128].&nbsp; Some name
+prefixes such as <span class="CodeText"><span style=
+'font-size:10.0pt'>str</span></span> followed by a lowercase
+character are reserved for future library extensions.&nbsp; Most C
+compilers do not detect naming conflicts, and they can lead to
+unpredictable program behavior.&nbsp; If <span class=
+"Flag"><span style='font-size:10.0pt'>ansi-reserved</span></span>
+is on, Splint warns about external names that conflict with
+reserved names.&nbsp; If <span class="Flag"><span style=
+'font-size:10.0pt'>ansi-reserved-internal</span></span>&nbsp;is on,
+warnings are also produced for internal names.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">If <span class="Flag"><span style=
+'font-size:10.0pt'>+cpp-names</span></span> is set, Splint warns
+about identifier names that are keywords or reserved words in
+C++.&nbsp; This is useful if the code may later be compiled with a
+C++ compiler (of course, this is not enough to ensure the meaning
+of the code is not changed when it is compiled as C++.)</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975022">12.3.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Distinct
+Names</a></h3>
+<p class="TextFontCX">Splint can check that names differ within a
+given number of characters, optionally ignoring alphabetic case and
+differences between characters that look similar.&nbsp; The number
+of significant characters may be different for external and
+internal names.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Using <span class="Flag"><span style=
+'font-size:10.0pt'>+distinct-external-names</span></span>&nbsp;sets
+the number of significant characters for external names to six and
+makes alphabetical case insignificant for external names.&nbsp;
+This is the minimum significance acceptable in an ANSI-conforming
+compiler.&nbsp; Most modern compilers exceed these minimums (which
+are particularly hard to follow if one uses the Czech or Slovak
+naming convention).&nbsp; The number of significant characters can
+be changed using the <span class="Flag"><span style=
+'font-size:10.0pt'>external-name-length
+<i>&lt;number&gt;</i></span></span> flag.&nbsp; If
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>external-name-case-insensitive</span></span>
+      is on, alphabetical case is ignored in comparing external
+      names. Splint reports identifiers that differ only in
+      alphabetic case.</p>
+<p class="TextFontCX">For internal identifiers, a conforming
+compiler must recognize at least 31 characters and treat
+alphabetical cases distinctly.&nbsp; Nevertheless, it may still be
+useful to check that internal names are more distinct then required
+by the compiler to minimize the likelihood that identifiers are
+confused in the program.&nbsp; Analogously to external names, the
+<span class="Flag"><span style=
+'font-size:10.0pt'>internal-name-length</span></span><span class="Flag">
+<span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span> flag
+sets the number of significant characters in an internal name and
+<span class="Flag"><span style=
+'font-size:10.0pt'>internal-name-case-insensitive</span></span>
+sets the case sensitivity.&nbsp; The <span class=
+      "Flag"><span style='font-size:10.0pt'>internal-name-look-alike</span></span>
+      flag further restricts distinctions between
+      identifiers.&nbsp; When set, similar-looking characters match
+      &#8212; the lowercase letter <span class=
+      "CodeText"><span style='font-size:10.0pt'>l</span></span>
+      matches the uppercase letter <span class=
+      "CodeText"><span style='font-size:10.0pt'>I</span></span> and
+      the number <span class="CodeText"><span style=
+      'font-size:10.0pt'>1</span></span>; the letter <span class=
+      "CodeText"><span style='font-size:10.0pt'>O</span></span> or
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>o</span></span> matches the number
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>0</span></span>; <span class=
+      "CodeText"><span style='font-size:10.0pt'>5</span></span>
+      matches <span class="CodeText"><span style=
+      'font-size:10.0pt'>S</span></span>; and <span class=
+      "CodeText"><span style='font-size:10.0pt'>2</span></span>
+      matches <span class="CodeText"><span style=
+      'font-size:10.0pt'>Z</span></span>.&nbsp; Identifiers that
+      are not distinct except for look-alike characters will
+      produce an error message.&nbsp; External names are also
+      internal names, so they must satisfy both the external and
+      internal distinct identifier checks.&nbsp; Figure 24 provides
+      some examples of distinct name checking.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'width:166.5pt;border:solid black 1.5pt; border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<span class="Keyword"><b><span style=
+'font-size:10.0pt; color:white'>names.c</span></b></span></p></td>
+<td valign="top" style=
+'width:256.5pt;border-top:solid black 1.5pt; border-left:none;border-bottom:none;border-right:solid black 1.5pt; background:black;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+<b><span style='color:white'>Running
+Splint</span></b></p></td></tr>
+<tr>
+<td valign="top" style=
+'width:166.5pt;border:solid black 1.5pt; border-top:none;padding:0in 5.4pt 0in 5.4pt'>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;</span></span>char *stringrev (char
+*s);</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>3</span></span> int f (int x)</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>&nbsp;</span></span>&nbsp;{</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>5</span></span> int lookalike = 1;</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>6</span></span> int looka1ike = 2;</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">&nbsp; if (x &gt; 3)</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp; {</p>
+<p class="Verbatim"><span class="Line"><span style=
+'font-size:8.0pt'>10</span></span>&nbsp;&nbsp;&nbsp; int x =
+lookalike;</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; x +=
+looka1ike;</p>
+<p class="Verbatim">&nbsp;&nbsp;&nbsp; }</p>
+<p class="Verbatim">&nbsp;</p>
+<p class="Verbatim">&nbsp; return x;</p>
+<p class="Verbatim">}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p></td>
+<td valign="top" style=
+'width:256.5pt;border-top:none;border-left: none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="lclintrun">&gt; splint names.c
++distinctinternalnames&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
+<p class="lclintrun">
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
++internalnamelookalike&nbsp; +isoreserved</p>
+<p class="lclintrun">&nbsp;</p>
+<p class="lclintrun">names.c:1: Name stringreverse is reserved for
+future</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; library extensions.&nbsp;
+Functions that begin with</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; "str" and a lowercase
+letter may be added to</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; &lt;stdlib.h&gt; or
+&lt;string.h&gt;. (ISO99:7.26.9)</p>
+<p class="lclintrun">names.c:6: Internal identifier looka1ike is
+not</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; distinguishable from
+lookalike except by lookalike</p>
+<p class="lclintrun">&nbsp;&nbsp;&nbsp; characters</p>
+<p class="lclintrun">&nbsp;&nbsp; names.c:5: Declaration of
+lookalike</p>
+<p class="lclintrun">names.c:10: Variable x shadows outer
+declaration</p>
+<p class="lclintrun" style='page-break-after:avoid'>&nbsp;&nbsp;
+names.c:3: Previous declaration of x: int</p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:5.05pt;padding-right: 9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Ref343085825"></a><a name=
+"_Ref343085797"></a><a name="_Ref343065542"></a><a name=
+"_Ref349992283"></a><a name="_Ref534642902"></a><a name=
+"_Ref534642319"></a><a name="_Toc534824626"></a><a name=
+"_Ref534823650">Figure 24</a>.&nbsp; Distinct
+Names</p></td></tr></table></center>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref534981356"></a><a name="_Ref534978939"></a><a name=
+"_Toc534975023">13<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="completeness" name="completeness">
+Completeness</a></a></h1>
+<p class="TextFontCX">Splint can report warnings for unused
+declarations&nbsp;and exported declarations&nbsp;that are not used
+externally.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975024"></a><a name="_Ref534744216">13.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Unused Declarations</a></h2>
+<p class="TextFontCX">Splint detects constants, functions,
+parameters, variables, types, enumerator members, and structure or
+union fields that are declared but never used.&nbsp; The flags
+<span class="Flag"><span style=
+'font-size:10.0pt'>constuse</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>fcnuse</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>paramuse</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>varuse</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>typeuse</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>enummemuse</span></span> and
+<span class="Flag"><span style=
+'font-size:10.0pt'>fielduse</span></span> control whether unused
+declaration errors are reported for each kind of declaration.&nbsp;
+Errors for exported declarations are reported only if
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>topuse</span></span> is on (see Section
+      13.2).</p>
+<p class="TextFontCX"><a name="_Ref349900444"></a><a name=
+"_Ref349850608"></a><a name="_Ref349850429">&nbsp;</a></p>
+<p class="TextFontCX">The <span class="Annot"><span style=
+'font-size:10.0pt'>/*@unused@*/</span></span>&nbsp;annotation can
+be used before a declaration to indicate that the item declared
+need not be used.&nbsp; Unused declaration errors are not reported
+for identifiers declared with <span class=
+      "Annot"><span style='font-size:10.0pt'>unused</span></span><a name="_Toc344355432">
+</a><a name="_Ref343110935">.</a></p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975025"></a><a name="_Toc344355433"></a><a name=
+"_Ref343110504">13.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Complete</a> Programs</h2>
+<p class="TextFontCX">Splint can be used on both complete and
+partial&nbsp;programs.&nbsp; When checking complete programs,
+additional checks can be done to ensure that every identifier
+declared by the program is defined and used, and that functions
+that do not need to be exported are declared <span class=
+"CodeText"><span style='font-size:10.0pt'>static</span></span>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint checks that all declared variables and
+functions are defined (controlled by <span class=
+      "Flag"><span style='font-size:10.0pt'>compdef</span></span><span class="Flag">
+<span style='font-size:10.0pt'>)</span></span>.&nbsp; Declarations
+of functions and variables that are defined in an external library,
+may be preceded by <span class="Annot"><span style=
+'font-size:10.0pt'>/*@external@*/</span></span>&nbsp;to suppress
+undefined declaration errors.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint reports external declarations that are
+unused (controlled by <span class="Flag"><span style=
+'font-size:10.0pt'>topuse</span></span>).&nbsp; Which declarations
+are reported also depends on the declaration use flags (Section
+13.1).&nbsp; The <span class="Flag"><span style=
+'font-size:10.0pt'>+partial</span></span>&nbsp;flag sets flags for
+checking a partial system.&nbsp; Top-level unused declarations,
+undefined declarations, and unnecessary external names are not
+reported if <span class="Flag"><span style=
+'font-size:10.0pt'>+partial</span></span> is set.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975026">13.2.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
+Unnecessarily External Names</a></h3>
+<p class="TextFontCX">Splint can report variables and functions
+that are declared with global scope (i.e., without using
+<span class="CodeText"><span style=
+'font-size:10.0pt'>static</span></span>), that are not used outside
+the file in which they are defined.&nbsp; In a stand-alone system,
+these identifiers should usually be declared using
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>static</span></span> to limit their
+      scope.&nbsp; If the <span class="Flag"><span style=
+      'font-size:10.0pt'>export-static</span></span> flag is on,
+      Splint will report declarations that could have file
+      scope.&nbsp; It should only be used when all relevant source
+      files are listed on the Splint command line; otherwise,
+      variables and functions may be incorrectly identified as only
+      used in the file scope since Splint did not process the other
+      file in which they are used.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975027">13.2.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
+Declarations Missing from Headers</a></h3>
+<p class="TextFontCX">A common practice in C programming styles, is
+that every function or variable exported by <span class=
+"Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
+is declared in <span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.&nbsp;
+If the <span class="Flag"><span style=
+'font-size:10.0pt'>export-header</span></span> flag is on, Splint
+will report exported declarations in <span class=
+"Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
+that are not declared in <span class=
+      "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
+M</span></i></span><span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.</p>
+<h1 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975028"></a><a name="_Ref534642392"></a><a name=
+"_Ref349900301">14<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="libraries" name="libraries">
+Libraries</a> and Header File Inclusion</a></h1>
+<p class="TextFontCX">Libraries can be used to record interface
+information.&nbsp; A library containing information about the
+standard C Library is used to enable checking of library
+calls.&nbsp; Program libraries can be created to enable fast
+checking of single modules in a large program.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975029"></a><a name="_Ref534035506"></a><a name=
+"_Ref348801560"></a><a name="_Ref347465531"></a><a name=
+"_Ref344887939"></a><a name="_Toc344355445">14.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Standard Librar</a>ies</h2>
+<p class="TextFontCX">In order to check calls to library functions,
+Splint uses an annotated standard library.&nbsp; This contains more
+information about function interfaces then is available in the
+system header files since it uses annotations.&nbsp; Further, it
+contains only those functions documented in the ISO C99
+standard.&nbsp; Many systems include extra functions in their
+system libraries; programs that use these functions cannot be
+compiled on other systems that do not provide them.&nbsp; Certain
+types defined by the library are treated as abstract&nbsp;types
+(e.g., a program should not rely on how the <span class=
+"CodeText"><span style='font-size:10.0pt'>FILE</span></span> type
+is implemented).&nbsp; When checking source code, Splint does
+include system headers corresponding to files in the library, but
+instead uses the library description of the standard library.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The Splint distribution includes several
+different standard libraries: the ANSI standard library, the POSIX
+standard library<a href="#_ftn19" name="_ftnref19" title=
+""><span class="MsoFootnoteReference"><span class=
+"MsoFootnoteReference"><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>,
+and a UNIX library based on the Open Group&#8217;s Single Unix
+Specification.&nbsp; Each library comes in two versions: the
+standard version and the strict version.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975030">14.1.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> ISO
+Standard Library</a></h3>
+<p class="TextFontCX">The default behavior of Splint is to use the
+ISO standard library (loaded from <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>standard.lcd</span></span>).&nbsp; This library
+is based on the standard library described in the ISO C99
+standard.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975031">14.1.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> POSIX
+Library</a></h3>
+<p class="TextFontCX">The POSIX library is selected by the
+<span class="Flag"><span style=
+'font-size:10.0pt'>+posixlib</span></span> flag.&nbsp;&nbsp; The
+POSIX library is based on the IEEE Std 1003.1-1990. &nbsp;</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975032">14.1.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> UNIX
+Library</a></h3>
+<p class="afterlist">The UNIX library is selected by the
+<span class="Flag"><span style=
+'font-size:10.0pt'>+unixlib</span></span> flag.&nbsp; This library
+is based on the Open Group&#8217;s Single Unix Specification,
+Version 2.&nbsp; In the UNIX library, <span class=
+"CodeText"><span style='font-size:10.0pt'>free</span></span> is
+declared with a non-null&nbsp;parameter.&nbsp; ISO specifies that
+<span class="CodeText"><span style=
+'font-size:10.0pt'>free</span></span> should handle the argument
+<span class="CodeText"><span style=
+'font-size:10.0pt'>NULL</span></span>, but several UNIX platforms
+crash if <span class="CodeText"><span style=
+'font-size:10.0pt'>NULL</span></span> is passed to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>free</span></span>.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975033">14.1.4<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Strict
+Libraries</a></h3>
+<p class="TextFontCX">Stricter versions of the libraries are used
+is the <span class="Flag"><span style=
+'font-size:10.0pt'>-ansi-strict</span></span>, <span class=
+"Flag"><span style=
+'font-size:10.0pt'>posix-strict-lib</span></span>&nbsp;or
+<span class="Flag"><span style=
+'font-size:10.0pt'>unix-strict-lib</span></span>&nbsp;flag is used.
+These libraries use a stricter interpretation of the library.&nbsp;
+They will detect more errors in some programs, but may to produce
+many spurious errors for typical code.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">The differences between the standard
+libraries and the strict libraries are:</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+The standard libraries declare the printing functions
+      (<span class="CodeText"><span style=
+      'font-size:10.0pt'>fprintf</span></span>, <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>printf</span></span>, and <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>sprintf</span></span>) that may return
+      error codes to return <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> or <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>void</span></span>.&nbsp; This prevents
+      typical programs from leading to deluge of ignored return
+      value errors, but may mean some relevant errors are not
+      detected.&nbsp; In the strict library, they are declared to
+      return <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>, so ignored return value
+      errors will be reported (depending on other flag
+      settings).&nbsp; Programs should check that this return value
+      is non-negative.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+The standard libraries declare some parameters and return values to
+be alternate types (<span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span> or <span class=
+"CodeText"><span style='font-size:10.0pt'>bool</span></span>, or
+<span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span> or <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>char</span></span>).&nbsp; The ISO C99 standard
+specifies these types as <span class="CodeText"><span style=
+'font-size: 10.0pt'>int</span></span> to be compatible with older
+versions of the library, but logically they make more sense as
+<span class="CodeText"><span style=
+'font-size:10.0pt'>bool</span></span> or <span class=
+"CodeText"><span style='font-size:10.0pt'>char</span></span>.&nbsp;
+In the strict library, the stronger type is used.&nbsp; The
+parameter to <span class="CodeText"><span style=
+'font-size:10.0pt'>assert</span></span>&nbsp;is <span class=
+"CodeText"><span style='font-size:10.0pt'>int</span></span> or
+<span class="CodeText"><span style=
+'font-size:10.0pt'>bool</span></span> in the standard library, and
+<span class="CodeText"><span style=
+'font-size:10.0pt'>bool</span></span> in the strict library.&nbsp;
+The parameter to the character functions <span class=
+"CodeText"><span style='font-size:10.0pt'>isalnum</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>isalpha</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>iscntrl</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>isdigit</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>isgraph</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>islower</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>isprint</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>ispunct</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>isspace</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>isupper</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>isxdigit</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>tolower</span></span>&nbsp;and
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>toupper</span></span>&nbsp;is <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>unsigned char</span></span> or
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> in the standard library
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>char</span></span> in the strict
+      library.&nbsp; The type of the return value of the character
+      classification functions (all of the previous character
+      functions except <span class="CodeText"><span style=
+      'font-size:10.0pt'>tolower</span></span> and <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>toupper</span></span>) is <span class=
+      "CodeText"><span style='font-size:10.0pt'>bool</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> in the standard library
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>bool</span></span> in the strict
+      library.&nbsp; The type of the first parameter to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>ungetc</span></span> is <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> in the standard library
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>char</span></span> in the strict library
+      (<span class="CodeText"><span style=
+      'font-size:10.0pt'>EOF</span></span> should not be passed to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>ungetc</span></span>).&nbsp; The second
+      parameter to <span class="CodeText"><span style=
+      'font-size:10.0pt'>strchr</span></span>&nbsp;and <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>strrchr</span></span>&nbsp;is <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      or <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> in the standard library
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>char</span></span> in the strict
+      library.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+The global variables <span class="CodeText"><span style=
+'font-size:10.0pt'>stdin</span></span>, <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>stdout</span></span>&nbsp;and <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>stderr</span></span>&nbsp;are declared as
+<span class="CodeText"><span style=
+'font-size:10.0pt'>unchecked</span></span> variables (see Section
+7.2) in the standard libraries.&nbsp; In the strict libraries, they
+are<span class="CodeText"><span style=
+'font-size:10.0pt'>checked</span></span>.</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+The global variable <span class="CodeText"><span style=
+'font-size:10.0pt'>errno</span></span>&nbsp;is declared
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>unchecked</span></span>&nbsp;in the
+      standard libraries, but declared <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>checkedstrict</span></span>&nbsp;in the
+      strict libraries.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">If no library flag is used, Splint will load
+the standard library, <span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>standard.lcd</span></span>.&nbsp;
+If <span class="Flag"><span style=
+'font-size:10.0pt'>+nolib</span></span> is set, no library is
+loaded.&nbsp; The library source files can easily be modified, and
+new libraries created to better suit a particular application.</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975034"></a><a name="_Toc344355447">14.2<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Generating Libraries</a></h2>
+<p class="TextFontCX">To enable running Splint on large systems,
+mechanisms are provided for creating libraries containing necessary
+information.&nbsp; This means source files can be checked
+independently, after a library has been created. The command line
+option <span class="Flag"><span style=
+'font-size:10.0pt'>-dump</span></span> <span class=
+"Flag"><span style='font-size:10.0pt'><i>library</i></span></span>
+stores information in the file <span class=
+      "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
+library</span></i></span> (the default extension <span class=
+"Keyword"><span style=
+'font-size:10.0pt;font-family:Arial; color:windowtext'>.lcd</span></span>
+is added). Then, <span class="Flag"><span style=
+'font-size:10.0pt'>-load</span></span> <span class=
+"Flag"><span style='font-size:10.0pt'><i>library</i></span></span>
+loads the library.&nbsp; The library contains interface information
+from the files checked when the library was created.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975035">14.2.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span> Generating
+the Standard Libraries</a></h3>
+<p class="TextFontCX">The standard libraries are generated from
+header files included in the Splint distribution.&nbsp; Some
+libraries are generated from more than one header file.&nbsp; Since
+the POSIX library subsumes the standard library, the headers for
+the standard and POSIX libraries are combined to produce the POSIX
+library.&nbsp; Similarly, the UNIX library is composed of the
+standard, POSIX and UNIX headers.&nbsp; The header files include
+some sections that are conditionally selected by defining
+<span class="CodeText"><span style=
+'font-size:10.0pt'>STRICT</span></span>.&nbsp; The commands to
+generate the standard libraries are:</p>
+<p class="example" style=
+'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
+splint -nolib ansi.h -dump ansi</p>
+<p class="example" style=
+'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
+splint -nolib -DSTRICT ansi.h -dump ansistrict</p>
+<p class="example" style=
+'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
+splint -nolib ansi.h posix.h -dump posix</p>
+<p class="example" style=
+'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
+splint -nolib -DSTRICT ansi.h posix.h -dump posixstrict</p>
+<p class="example" style=
+'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
+splint -nolib ansi.h posix.h unix.h -dump unix</p>
+<p class="example" style=
+'margin-top:0in;margin-right:.2in;margin-bottom:0in; margin-left:.2in;margin-bottom:.0001pt'>
+splint -nolib -DSTRICT ansi.h posix.h unix.h -dump unixstrict</p>
+<h2 style='margin-left:0in;text-indent:0in'><a name=
+"_Ref534979539"></a><a name="_Toc534975036"></a><a name=
+"_Ref348080056"></a><a name="_Toc344355448">14.3<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+Header File Inclusion</a></h2>
+<p class="TextFontCX">The standard behavior of Splint on
+encountering</p>
+<p class="example"><span class="Keyword"><span style=
+'font-size:10.0pt'>#include &lt;<i>X</i>.h&gt;</span></span></p>
+<p class="TextFontCX">is to search for a file named
+      <span class="Keyword"><i><span style=
+      'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+on the include search path (set using <span class=
+"Flag"><span style='font-size: 10.0pt'>&#8211;I</span></span>) and
+then the system base include path (read from the <span class=
+"CodeText"><span style='font-size:10.0pt'>include</span></span>
+environment variable if set or using a default value, usually
+<span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>).&nbsp;
+If <span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+is the name of a header file in a loaded standard library and
+<span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+is found in a directory that is a system directory (as set by the
+<span class="Flag"><span style=
+'font-size:10.0pt'>-sysdirs</span></span> flag; the default is
+<span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>),
+<span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial; color:windowtext'>X</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+will not be included if <span class="Flag"><span style=
+'font-size:10.0pt'>+skip-iso-headers</span></span>&nbsp;or
+<span class="Flag"><span style=
+'font-size:10.0pt'>+skip-posix-headers</span></span>&nbsp;(depending
+on whether <span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+is an ISO or POSIX header file) is on (both are on by
+default).&nbsp; To force all headers to be included normally, use
+<span class="Flag"><span style=
+'font-size: 10.0pt'>&#8209;skip-iso-headers</span></span>.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Sometimes headers in system directories
+contain non-standard syntax that Splint is unable to parse.&nbsp;
+The <span class="Flag"><span style=
+'font-size:10.0pt'>+skip-sys-headers</span></span>&nbsp;flag may be
+used to prevent any include file in a system directory from being
+included.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint is fast enough that it can be run on
+medium-size (10,000 line) programs without performance
+concerns.&nbsp; Libraries can be used to enable efficient checking
+of small modules in large programs.&nbsp; To further improve
+performance, header file inclusion can be optimized.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">When processing a complete system in which
+many files include the same headers, a large fraction of processing
+time is wasted re-reading header files unnecessarily.&nbsp; If you
+are checking a 100-file program, and every file includes
+<span class="Flag"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>utils.h</span></span>,
+Splint will have to process <span class=
+      "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
+utils.h</span></span> 100 times (as would most C compilers).&nbsp;
+If the <span class="Flag"><span style=
+'font-size:10.0pt'>+single-include</span></span> flag is used, each
+header file is processed only once.&nbsp; Single header file
+processing produces a significant efficiency improvement when
+checking large programs split into many files, but is only safe if
+the same header file included in different contexts always has the
+same meaning (i.e., it does not depend on preprocessor variable
+defined differently at different inclusion sites).</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">When processing a single file in a large
+system, a large fraction of the time is spent processing included
+header files.&nbsp; This can be avoided if the information in the
+header files is stored in a library instead.&nbsp; If
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>+never-include</span></span> is set,
+      inclusion of files ending in <span class="Flag"><span style=
+      'font-size: 10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+      is prevented.&nbsp; Files with different suffixes are
+      included normally.&nbsp; To do this the header files must not
+      include any expanded macros. That is, the header file must be
+      processed with <span class="Flag"><span style=
+      'font-size:10.0pt'>+all-macros</span></span>, and there must
+      be no <span class="Annot"><span style=
+      'font-size:10.0pt'>/*@notfunction@*/</span></span>&nbsp;control
+      comments in the header.&nbsp; Then, the <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>+never-include</span></span> flag may be
+      used to prevent inclusion of header files.&nbsp; Alternately,
+      non-function macros can be moved to a different file with a
+      name that does not end in <span class="Keyword"><span style=
+      'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.&nbsp;
+      Remember, that this file must be included directly from the
+      <span class="Keyword"><span style=
+      'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>
+      file, since if it is included from an <span class=
+      "Keyword"><span style=
+      'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+      file indirectly, that <span class="Keyword"><span style=
+      'font-size:10.0pt; font-family:Arial;color:windowtext'>.h</span></span>
+      file is ignored so the other file is never included.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">These options can be used for significant
+performance improvements on large systems.&nbsp; The performance
+depends on how the code is structured, but checking a single module
+in a large program is several times faster if libraries and
+<span class="Flag"><span style=
+'font-size:10.0pt'>+noinclude</span></span> are used.</p>
+<h3 style='margin-left:0in;text-indent:0in'><a name=
+"_Toc534975037">14.3.1<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;</span>
+Preprocessing Constants</a></h3>
+<p class="TextFontCX">Splint defines the preprocessor constant
+<span class="CodeText"><span style=
+'font-size:10.0pt'>S_SPLINT_S</span></span> when preprocessing
+source files.&nbsp; If you want to include code that is processed
+only when Splint is used, surround the code with</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+<span class="Keyword"><span style=
+'font-size:10.0pt'>&nbsp;</span></span></p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+<span class="Keyword"><span style='font-size:10.0pt'># ifdef
+S_SPLINT_S</span></span></p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;&nbsp;&nbsp;&nbsp; &#8230;</p>
+<p class="TextFontCX"><span class="Keyword"><span style=
+'font-size:10.0pt'># endif</span></span></p>
+<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975038"></a><a name="_Toc344355451"></a><a name=
+"_Ref343065611">Appendix A<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="availability" name="availability">
+Availability</a></a></p>
+<p class="afterlist">The web home page for Splint is
+      <span class="Keyword"><span style=
+      'font-size:10.0pt;font-family:Arial;color:windowtext'><a href=
+      "http://www.splint.org/">http://www.splint.org</a></span></span>.&nbsp;
+      It includes this guide in HTML format, samples demonstrating
+      Splint, and links to related web sites.&nbsp; Splint is
+      available as source code and binary executables for several
+      platforms.&nbsp; Splint may be freely distributed and
+      modified under the GNU General Public License.&nbsp; The
+      latest development code is available through SourceForge.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">Splint development is largely driven by
+suggestions and comments from users.&nbsp; We are also very
+interested in hearing about your experiences using Splint in
+developing or maintaining programs, enforcing coding standards, or
+teaching courses.&nbsp; For general information, suggestions, and
+questions on Splint send mail to <span class=
+      "Keyword"><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>
+splint@cs.virginia.edu</span></span>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">To report a bug in Splint send a message to
+<span class="Keyword"><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>splint-bug@cs.virginia.edu</span></span>.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">There are two mailing lists associated with
+Splint:</p>
+<p class="URL"><span class="Keyword"><span style=
+'font-family:Arial;color:windowtext'>splint-announce@virginia.edu</span></span></p>
+<p class="IndentText">Reserved for announcements of new releases
+and bug fixes.&nbsp; All users should add themselves to this
+list.&nbsp;</p>
+<p class="URL"><span class="Keyword"><span style=
+'font-family:Arial;color:windowtext'>splint-interest@virginia.edu</span></span></p>
+<p class="IndentText">Informal discussions on the use and
+development of Splint.&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX"><a name="_Ref344882161"></a><a name=
+"_Ref344871249"></a><a name="_Ref344870532"></a><a name=
+"_Ref344870294">To subscribe to a mailing list, send a message
+to</a> <span class="PlainText"><span style=
+'font-size:10.0pt;font-family:Arial'>majordomo@virginia.edu</span></span>
+containing the body</p>
+<p class="URL"><span class="Keyword"><span style=
+'font-family:Arial;color:windowtext'>subscribe
+splint-announce</span></span><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>or</span>
+<span class="Keyword"><span style=
+'font-family:Arial;color:windowtext'>subscribe
+splint-interest</span></span><a name=
+   "_Ref348343340"></a><a name="_Ref348330382">.</a></p>
+<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975039"></a><a name="_Ref397875360">Appendix
+B<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="flags" name="flags">
+Flags</a>
+</a><a name="_Toc344355437"></a></p>
+<p class="beforelist">There are four different types of flags:</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Global flags for controlling initializations and global
+behavior</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Message format flags for controlling how messages are displayed</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Mode selectors for coarse control of Splint checking</p>
+<p class="MsoListBullet"><span style=
+'font-family:Symbol'>&#183;<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+Checking flags that control checking and what classes of messages
+are reported.</p>
+<p class="afterlist">Global flags can be used in initialization
+files and at the command line; all other flags may also be used in
+control comments.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975050">Key</a></p>
+<p class="beforelist">To the left of each flag name is a flag
+descriptor encoding what kind of flag it is and its default
+value.&nbsp; The descriptions are:</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
+'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX">A <i>plain</i> flag.&nbsp; The value after
+the colon gives the default setting (e.g., this flag is
+off.)&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class="Flag"><span style=
+'font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX">A <i>mode checking flag</i>.&nbsp; The value
+of the flag is set by the mode selector.&nbsp; The four signs give
+the setting in the weak, standard, checks and strict modes. (e.g.,
+this flag is off in the weak and standard modes, and on in the
+checks and strict modes.)</p>
+<p class="TextFontCX">&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX">A <i>shortcut</i> flag.&nbsp; This flag sets
+other flags, so it has no default value.</p>
+<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975061">Flag Name Abbreviations</a></p>
+<p class="beforelist">Within a flag name, abbreviations may be
+used. &nbsp;Figure 25 shows the flag name abbreviations.&nbsp; The
+expanded and short forms are interchangeable in flag names.</p>
+<center>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'margin-left:99.9pt;border-collapse:collapse;margin-left:-2.25pt; margin-right:-2.25pt'>
+<tr>
+<td valign="top" style=
+'width:171.0pt;border:none;border-bottom:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+Expanded Form</p></td>
+<td valign="top" style=
+'width:67.5pt;border:none;border-bottom:solid black 1.5pt; padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="center" style='text-align:center'>
+Short Form</p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>constant</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>const</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>declaration</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>decl</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>function</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>fcn</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>global</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>glob</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>implicit</span></span><span class=
+"Flag"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>,</span></span>
+<span class="Flag"><span style=
+'font-size:10.0pt'>implied</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iterator</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iter</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>length</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>len</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>modifies</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mods</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>modify</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>memory</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mem</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>parameter</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>param</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>pointer</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" style='page-break-after: avoid'>
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>ptr</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>return</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ret</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>variable</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>var</span></span></p></td></tr>
+<tr>
+<td valign="top" style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unconstrained, unconst</span></span></p></td>
+<td valign="top" style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" style='page-break-after: avoid'>
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>uncon</span></span></p></td></tr></table>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0">
+<tr>
+<td valign="top" style=
+'padding-top:.1in;padding-right: 9.35pt;padding-bottom:.1in;padding-left:9.35pt'>
+<p class="MsoCaption"><a name="_Toc534824627"></a><a name=
+"_Ref534824456">Figure 25</a>.&nbsp; Flag Name
+Abbreviations</p></td></tr></table></center>
+<p class="beforelist">The expanded and short forms are
+interchangeable in flag names.</p>
+<p class="beforelist">For example, <span class=
+      "Flag"><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>
+      and <span class="Flag"><span style=
+      'font-size:10.0pt'>globalsimpliesmodifiesnothing</span></span>
+      denote the same flag.&nbsp; Abbreviations in flag names allow
+      pronounceable, descriptive names to be used without making
+      flag names excessively long (although one must admit even
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>globsimpmodsnothing</span></span> is a bit
+      of a mouthful.)</p>
+<p class="TextFontCX">To make flag names more readable, the space,
+dash (<span class="Flag"><span style=
+'font-size:10.0pt'>-</span></span>), and underscore
+      (<span class="Flag"><span style=
+      'font-size:10.0pt'>_</span></span>) characters may be used
+      inside a flag name.&nbsp; Hence, <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>globals-implies-modifies-nothing</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>glob_imps_&#173;mods&#173;nothing</span></span>
+      and <span class="Flag"><span style=
+      'font-size:10.0pt'>globsimpmodsnothing</span></span> are
+      equivalent.</p>
+<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975040">Global Flags</a></p>
+<p class="TextFontCX">Global flags can be set at the command line
+or in an options file, but cannot be set locally using stylized
+comments.&nbsp; These flags control on-line help, initialization
+files, pre-processor flags, libraries and output.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975041">Help</a></p>
+<p class="beforelist">On-line help provides documentation on Splint
+operation and flags.&nbsp; When a help flag is used, no checking is
+done by Splint.&nbsp; Help flags may be preceded by
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>-</span></span> or <span class=
+      "Flag"><span style='font-size:10.0pt'>+</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>help</span></span></p>
+<p class="IndentText">Display general help overview, including list
+of additional help topics.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>help</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'>&lt;topic&gt;</span></span></p>
+<p class="indentbefore">Display help on <i>&lt;topic&gt;</i>.
+Available topics:</p>
+<table class="MsoNormalTable" border="0" cellspacing="0"
+cellpadding="0" style=
+'width:400.5pt;margin-left:27.9pt;border-collapse:collapse'>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" style='text-indent:5.4pt'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>annotations</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>describe
+annotations</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>comments</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>describe
+control comments</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>flags</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>describe
+flag categories</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>flags
+<i>&lt;category&gt;</i></span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>all
+flags pertaining to &lt;category&gt; (one of the categories listed
+by <span class="Flag"><span style='font-size:10.0pt'>splint -help
+flags</span></span>)</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>flags alpha</span></span>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>all
+flags in alphabetical order</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>flags full</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>print a
+full description of all flags</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mail</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>print
+information on mailing lists</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>modes</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>flags
+settings in modes</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>prefixcodes</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>
+character codes for setting namespace prefixes</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>references</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>print
+references to relevant papers and web sites</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>vars</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>describe
+environment variables</p></td></tr>
+<tr>
+<td valign="top" style=
+'width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>version</span></span></p></td>
+<td valign="top" style=
+'width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>
+<p class="TextFontCX" align="left" style='text-align:left'>print
+maintainer and version information</p>
+<p class="TextFontCX" align="left" style='text-align:left'>
+&nbsp;</p></td></tr></table>
+<p class="afterlist"><span class="Flag"><span style=
+'font-size:10.0pt'>help</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'>&lt;flag&gt;</span></span></p>
+<p class="IndentText">Describe flag <i>&lt;flag&gt;</i>.&nbsp; (May
+list several flags.)</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>warn-flags</span></span></p>
+<p class="IndentText">Display a warning when a flag is set in a
+surprising way.&nbsp; An error is reported if an obsolete flag is
+set, a flag is set to its current value (i.e., the
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>+</span></span> or <span class=
+      "Flag"><span style='font-size:10.0pt'>-</span></span> may be
+      wrong), or a mode selector flag is set after mode checking
+      flags that will be reset by the mode were set.&nbsp; By
+      default, <span class="Flag"><span style=
+      'font-size:10.0pt'>+warn-flags</span></span> is on. &nbsp;To
+      suppress flag warnings, use <span class="Flag"><span style=
+      'font-size:10.0pt'>&#8209;warn-flags</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>warn-rc</span></span></p>
+<p class="IndentText">There was a problem reading an initialization
+file.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>bad-flag</span></span></p>
+<p class="IndentText">A flag is not recognized or used in an
+incorrect way.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>fileextensions</span></span></p>
+<p class="IndentText">Warn when command line file does not have a
+recognized extension.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975042">Initialization</a></p>
+<p class="beforelist">These flags control directories and files
+used by Splint.&nbsp; They may be used from the command line or in
+an options file, but may not be used as control comments in the
+source code.&nbsp; Except where noted. they have the same meaning
+preceded by <span class="Flag"><span style=
+'font-size:10.0pt'>-</span></span> or <span class=
+"Flag"><span style='font-size:10.0pt'>+</span></span>.&nbsp;</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>tmpdir</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;directory&gt;</i></span></span></p>
+<p class="IndentText">Set directory for writing temp files.&nbsp;
+Default is <span class="ProgramNameChar"><span style=
+'font-size:10.0pt'>/tmp/</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>I<i>&lt;directory&gt;</i></span></span></p>
+<p class="IndentText">Add directory to path searched for C include
+files.&nbsp; Note there is no space after the <span class=
+"Flag"><span style='font-size:10.0pt'>I</span></span>, to be
+consistent with C preprocessor flags.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>S<i>&lt;directory&gt;</i></span></span></p>
+<p class="IndentText">Add directory to path search for
+      <span class="ProgramNameChar"><span style=
+      'font-size:10.0pt'>.lcl</span></span> specification
+      files.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>larchpath</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;path&gt;</i></span></span></p>
+<p class="IndentText">Set path to search for library files.&nbsp;
+Overrides <span class="CodeText"><span style=
+'font-size:10.0pt'>LARCH_PATH</span></span>&nbsp;environment
+variable.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>lclimportdir</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;directory&gt;</i></span></span></p>
+<p class="IndentText">Set directory to search for LCL import
+files.&nbsp; Overrides<span class="CodeText"><span style=
+'font-size:10.0pt'>LCLIMPORTDIR</span></span> environment
+variable.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>f</span></span> <span class=
+      "Flag"><span style='font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
+<p class="MsoNormal" style='margin-left:13.5pt'>Load options from
+<span class="Flag"><i><span style=
+'font-size:10.0pt'>&lt;file&gt;</span></i></span>.&nbsp; If this
+flag is used from the command line, the default <span class=
+"FileNameChar"><span style=
+'font-size:10.0pt'>~/.splintrc</span></span> file is not
+loaded.&nbsp; This flag may be used in an options file to include
+another options file.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>i</span></span> <span class=
+      "Flag"><span style='font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
+<p class="MsoNormal" style='margin-left:13.5pt'>Set LCL
+initilization file.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>nof</span></span></p>
+<p class="IndentText">Prevents the default options files
+(<span class="FileNameChar"><span style=
+'font-size:10.0pt'>./.splintrc</span></span>and <span class=
+"FileNameChar"><span style=
+'font-size:10.0pt'>~/.splintrc</span></span>) from being
+loaded.&nbsp; (Setting <span class="Flag"><span style=
+'font-size:10.0pt'>-nof</span></span> overrides <span class=
+"Flag"><span style='font-size:10.0pt'>+nof</span></span>, causing
+the options files to be loaded normally.)</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sys-dirs</span></span></p>
+<p class="IndentText">Set directories for system files (default is
+<span class="FileNameChar"><span style=
+'font-size:10.0pt'>/usr/</span></span>).&nbsp; Separate directories
+with the path separator for your operating system (e.g.,
+semi-colons for Windows or colons for Unix: <span class=
+"FileNameChar"><span style=
+'font-size:10.0pt'>/usr/include:/usr/local/lib</span></span>).&nbsp;
+Flag settings propagate to files in a system directory.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>-sys-dir-errors</span></span> is set, no errors
+are reported for files in system directories.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975043"></a><a name=
+"_Ref345883190">Pre-processor</a></p>
+
+<p class="beforelist">These flags are used to define or undefine
+pre-processor constants.&nbsp; The <span class=
+      "Flag"><span style='font-size:10.0pt'>-I<i>&lt;directory&gt;</i></span></span>
+      flag is also passed to the C pre-processor.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>D&lt;initializer&gt;</span></span></p>
+<p class="IndentText">Passed to the C pre-processor.</p>
+
+<p class="FileName0" style='margin-left:0in'><span class=
+"Flag">U&lt;initializer&gt;</span></p>
+<p class="IndentText">Passed to the C pre-processor.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unrecogdirective</span></span></p>
+<p class="IndentText">Preprocessor directive is not recognized.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>preproc</span></span></p>
+<p class="IndentText">Preprocessing error.
+</p>
+
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975044">Libraries</a></p>
+<p class="beforelist">These flags control the creation and use of
+libraries.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>dump</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>
+<p class="IndentText">Save state in <span class=
+"Flag"><i><span style=
+'font-size: 10.0pt'>&lt;file&gt;</span></i></span> for
+loading.&nbsp; The default extension <span class=
+"ProgramNameChar"><span style='font-size:10.0pt'>.lcd</span></span>
+is added if <span class="Flag"><i><span style=
+'font-size:10.0pt'>&lt;file&gt;</span></i></span> has no
+extension.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>load</span></span><span class=
+      "Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;file&gt;</i></span></span></p>
+<p class="IndentText">Load state from <span class=
+"Flag"><i><span style=
+'font-size: 10.0pt'>&lt;file&gt;</span></i></span> (created by
+<span class="Flag"><span style=
+'font-size:10.0pt'>-dump</span></span>).&nbsp; The default
+extension <span class="FileNameChar"><span style=
+'font-size:10.0pt'>.lcd</span></span> is added if
+      <span class="Flag"><i><span style=
+      'font-size:10.0pt'>&lt;file&gt;</span></i></span> has no
+      extension.&nbsp; Only one library file may be loaded.</p>
+<p class="betweenlists">By default, the standard library is loaded
+if the <span class="Flag"><span style=
+'font-size:10.0pt'>-load</span></span> flag is not used to load a
+user library.&nbsp; If no user library is loaded, one of the
+following flags may be used to select a different standard
+library.&nbsp; Precede the flag by <span class=
+      "Flag"><span style='font-size:10.0pt'>+</span></span> to load
+      the described library (or to prevent a library from being
+      loaded using <span class="Flag"><span style=
+      'font-size:10.0pt'>no-lib</span></span>). See Section 14.1
+      for information on the provided libraries.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>no-lib</span></span></p>
+<p class="IndentText">Do not load any library.&nbsp; This prevents
+the standard library from being loaded.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ansi-lib</span></span></p>
+<p class="IndentText">Use the ANSI standard library (selected by
+default).</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>strict-lib</span></span></p>
+<p class="IndentText">Use strict version of the ANSI standard
+library.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>posix-lib</span></span></p>
+<p class="IndentText">Use the POSIX standard library.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>posix-strict-lib</span></span></p>
+<p class="IndentText">Use the strict version of the POSIX standard
+library.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unix-lib</span></span></p>
+<p class="IndentText">Use UNIX version of standard library.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unix-strict-lib</span></span></p>
+<p class="IndentText">Use the strict version of the UNIX standard
+library.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>which-lib</span></span></p>
+<p class="IndentText">Print out the standard library filename and
+creation information.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>newdecl</span></span></p>
+<p class="IndentText">There is a new declaration that is not declared in a loaded library or
+   earlier file.  (Use this flag to check for consistency against a library.) 
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>impconj</span></span></p>
+<p class="IndentText">Make all alternate types implicit (useful for making system libraries). 
+</p>
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975045">Output</a></p>
+<p class="beforelist">These flags control what additional
+information Splint prints.&nbsp; Setting <span class=
+"Flag"><span style=
+'font-size:10.0pt'>+<i>&lt;flag&gt;</i></span></span> causes the
+described information to be printed; setting <span class=
+"Flag"><span style=
+'font-size:10.0pt'>-<i>&lt;flag&gt;</i></span></span> prevents
+it.&nbsp; By default, all these flags are off.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>use-stderr</span></span></p>
+<p class="IndentText">Send error messages to standard error
+(instead of standard output).</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>show-summary</span></span></p>
+<p class="IndentText">Show a summary of all errors reported and
+suppressed.&nbsp; Counts of suppressed errors are not necessarily
+correct since turning a flag off may prevent some checking from
+being done to save computation, and errors that are not reported
+may propagate differently from when they are reported.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>show-scan</span></span></p>
+<p class="IndentText">Show file names are they are processed.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>show-all-uses</span></span></p>
+<p class="IndentText">Show list of uses of all external identifiers
+sorted by number of uses.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>stats</span></span></p>
+<p class="IndentText">Display number of lines processed and
+checking time.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>time-dist</span></span></p>
+<p class="IndentText">Display distribution of where checking time
+is spent.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>quiet</span></span></p>
+<p class="IndentText">Suppress herald and error count.&nbsp; (If
+<span class="Flag"><span style=
+'font-size:10.0pt'>quiet</span></span> is not set, Splint prints
+out a herald with version information before checking begins, and a
+line summarizing the total number of errors reported.)</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>which-lib</span></span></p>
+<p class="IndentText">Print out the standard library filename and
+creation information.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>limit</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">At most <span class=
+      "Flag"><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>
+      similar errors are reported consecutively.&nbsp; Further
+      errors are suppressed, and a message showing the number of
+      suppressed messages is printed.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975046">Expected Errors</a></p>
+<p class="beforelist">Normally, Splint will expect to report no
+errors.&nbsp; The exit status will be success (<span class=
+"Keyword"><span style='font-size:10.0pt'>0</span></span>) if no
+errors are reported, and failure if any errors are reported.&nbsp;
+Flags can be used to set the expected number of reported
+errors.&nbsp; Because of the provided error suppression mechanisms,
+these options should probably not be used for final checking real
+programs but may be useful in developing programs using make.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>expect</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Exactly <span class=
+      "Flag"><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>
+      code errors are expected.&nbsp; Splint will exit with failure
+      exit status unless <span class="Flag"><i><span style=
+      'font-size:10.0pt'>&lt;number&gt;</span></i></span> code
+      errors are detected.</p>
+<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975047">Message Format</a></p>
+<p class="beforelist">These flags control how messages are
+printed.&nbsp; They may be set at the command line, in options
+files, or locally in syntactic comments.&nbsp; The
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>line-len</span></span> and <span class=
+      "Flag"><span style='font-size:10.0pt'>limit</span></span>
+      flags may be preceded by <span class="Flag"><span style=
+      'font-size:10.0pt'>+</span></span> or <span class=
+      "Flag"><span style='font-size:10.0pt'>-</span></span> with
+      the same meaning; for the other flags, <span class=
+      "Flag"><span style='font-size: 10.0pt'>+</span></span> turns
+      on the describe printing and <span class="Flag"><span style=
+      'font-size:10.0pt'>-</span></span> turns it off.&nbsp; The
+      box to the left of each flag gives its default value.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>show-column</span></span></p>
+<p class="IndentText">Show column number where error is found.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>show-func</span></span></p>
+<p class="IndentText">Show name of function (or macro) definition
+containing error.&nbsp; The function name is printed once before
+the first message detected in that function.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>show-all-conjs</span></span></p>
+<p class="IndentText">Show all possible alternate types (see
+Section 4.4).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>paren-file-format</span></span></p>
+<p class="IndentText">Use <span class="Flag"><i><span style=
+'font-size:10.0pt'>&lt;file&gt;</span></i></span><span class=
+"CodeText"><span style=
+'font-size:10.0pt'>(</span></span><span class=
+      "Flag"><i><span style='font-size:10.0pt'>&lt;line&gt;</span></i></span><span class="CodeText">
+<span style='font-size:10.0pt'>)</span></span> format in
+messages.&nbsp; (Default is + for Win32 for compatibility with
+Microsoft VisualStudio.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>hints</span></span></p>
+<p class="IndentText">Provide hints describing an error and how a
+message may be suppressed for the first error reported in each
+error class.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>force-hints</span></span></p>
+<p class="IndentText">Provide hints for all errors reported, even
+if the hint has already been displayed for the same error
+class.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>80</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>line-len</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Set length of maximum message line to
+<span class="Flag"><i><span style=
+'font-size:10.0pt'>&lt;number&gt;</span></i></span>
+characters.&nbsp; Splint will split messages longer than
+<span class="Flag"><i><span style=
+'font-size: 10.0pt'>&lt;number&gt;</span></i></span> characters
+long into multiple lines.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span class=
+"Flag"><span style=
+'font-size:10.0pt'>3</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>indentspaces</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">
+Set the number of spaces to indent sub-messages.
+</p>
+<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975048">Mode Selector Flags</a></p>
+<p class="TextFontCX">Mode selects flags set the mode checking
+flags to predefined values.&nbsp; They provide a quick coarse-grain
+way of controlling what classes of errors are reported. Specific
+checking flags may be set after a mode flag to override the mode
+settings.&nbsp; Mode flags may be used locally, however the mode
+settings will override specific command line flag settings.&nbsp; A
+warning is produced if a mode flag is used after a mode checking
+flag has been set.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">These are brief descriptions to give a
+general idea of what each mode does.&nbsp; To see the complete flag
+settings in each mode, use <span class="Flag"><span style=
+'font-size:10.0pt'>splint -help modes</span></span>. A mode flag
+has the same effect when used with either <span class=
+"Flag"><span style='font-size:10.0pt'>+</span></span> or
+<span class="Flag"><span style=
+'font-size:10.0pt'>-</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>weak</span></span></p>
+<p class="IndentText">Weak checking, intended for typical
+unannotated C code.&nbsp; No modifies checking, macro checking, rep
+exposure, or clean interface checking is done.&nbsp; Return values
+of type <span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span> may be ignored.&nbsp; The
+types <span class="CodeText"><span style=
+'font-size:10.0pt'>bool</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>int</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>char</span></span> and user-defined
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>enum</span></span> types are all
+      equivalent.&nbsp; Old style declarations are unreported.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>standard</span></span></p>
+<p class="IndentText">The default mode.&nbsp; All checking done by
+<span class="Flag"><span style=
+'font-size:10.0pt'>weak</span></span>, plus modifies checking,
+global, alias checking, use all parameters, using released storage,
+ignored return values or any type, macro checking, unreachable
+code, infinite loops, and fall through cases.&nbsp; The types
+<span class="CodeText"><span style=
+'font-size:10.0pt'>bool</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>int</span></span> and
+<span class="CodeText"><span style=
+'font-size:10.0pt'>char</span></span> are distinct.&nbsp; Old style
+declarations are reported.</p>
+<p class="TextFontCX">&nbsp;<span class="Flag"><span style=
+'font-size:10.0pt'>checks</span></span></p>
+<p class="IndentText">Moderately strict checking.&nbsp; All
+checking done by <span class="Flag"><span style=
+'font-size:10.0pt'>standard</span></span>, plus must modification
+checking, rep exposure, return alias, memory management and
+complete interfaces.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>strict</span></span></p>
+<p class="IndentText">Absurdly strict checking.&nbsp; All checking
+done by <span class="Flag"><span style=
+'font-size:10.0pt'>checks</span></span>, plus modifications and
+global variables used in unspecified functions, strict standard
+library, and strict typing of C operators. A special reward will be
+presented to the first person to produce a real program that
+produces no errors with <span class="Flag"><span style=
+'font-size:10.0pt'>strict</span></span> checking.</p>
+<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
+<a name="_Ref344798116"></a><a name="_Toc534975049">Checking
+Flags</a></p>
+<p class="TextFontCX">These flags control checking done by
+Splint.&nbsp; They may be set locally using syntactic comments,
+from the command line, or in an options file.&nbsp; Some flags
+directly control whether a certain class of message is
+reported.&nbsp; Preceding the flag by <span class=
+"Flag"><span style='font-size:10.0pt'>+</span></span> turns
+reporting on, and preceding the flag by <span class=
+"Flag"><span style='font-size:10.0pt'>-</span></span> turns
+reporting off.&nbsp; Other flags control checking less directly by
+determining default values (what annotations are implicit), making
+types equivalent (to prevent certain type errors), controlling
+representation access, etc.&nbsp; For these flags, the effect of
+<span class="Flag"><span style='font-size:10.0pt'>+</span></span>
+is described, and the effect of <span class=
+      "Flag"><span style='font-size:10.0pt'>-</span></span> is the
+      opposite (or explicitly explained if there is no clear
+      opposite).&nbsp; The organization of this section mirrors
+      Sections 2-14.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975051"></a>
+<a name="_Toc534975056">Null
+Dereferences</a> <span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+2)</span></span></p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>null</span></span></p>
+<p class="IndentText">A possibly null pointer may be dereferenced,
+or used somewhere a non-null pointer is expected. (sets nulldref, nullpass, nullassign, and nullstate</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+nullderef</span>
+</span></p>
+<p class="IndentText">A possibly null pointer is dereferenced.  Value is either the result of a function which may return null (in which case,
+code should check it is not null), or a global, parameter or structure field declared with the null qualifier.
+</P>
+
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+nullpass</span>
+</span></p>
+<p class="IndentText">
+A possibly null pointer is passed as a parameter corresponding to a formal parameter with no /*@null@*/ annotation.  If NULL may be
+used for this parameter, add a /*@null@*/ annotation to the function parameter declaration. 
+</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+nullret</span>
+</span></p>
+<p class="IndentText">
+Function returns a possibly null pointer, but is not declared using /*@null@*/ annotation of result.  If function may return NULL, add /*@null@*/ annotation to the return value declaration.
+</P>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+nullstate</span>
+</span></p>
+<p class="IndentText">
+A possibly null pointer is reachable from a parameter or global variable that is not declared using a /*@null@*/ annotation.
+</P>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+nullassign</span>
+</span></p>
+<p class="IndentText">
+A reference with no null annotation is assigned or initialized to NULL.  Use /*@null@*/ to declare the reference as a possibly null pointer.
+</P>
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975055">Use Before Definition</a>
+      <span class="TextFontCXChar"><span style=
+      'font-size:11.0pt; font-weight:normal'>(Section
+      3)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>usedef</span></span></p>
+<p class="IndentText">The value of a location that may not be
+initialized on some execution path is used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>impouts</span></span></p>
+<p class="IndentText">Allow unannotated pointer parameters to
+functions to be implicit out parameters.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>compdef</span></span></p>
+<p class="IndentText">Storage derivable from a parameter, return
+value or global variable is not completely defined.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>uniondef</span></span></p>
+<p class="IndentText">No field of a union is defined.&nbsp; (No
+error is reported if at least one union field is defined.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mustdefine</span></span></p>
+<p class="IndentText">Parameter declared with <span class=
+"Keyword"><span style='font-size:10.0pt'>out</span></span> is not
+defined before return or scope exit.</p>
+
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+fullinitblock
+</span></span></p>
+<p class="IndentText">
+Initializer does not set every field in the structure.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+initallelments
+</span></span></p>
+<p class="IndentText">
+Initializer does not define all elements of a declared array.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+initsize
+</span></span></p>
+<p class="IndentText">
+Initializer block contains more elements than the size of a declared array. 
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+impouts
+</span></span></p>
+<p class="IndentText">
+Pointer parameters to unspecified functions may be implicit <span class=
+"Keyword"><span style='font-size:10.0pt'>out</span></span> parameters.
+</p>
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+Declarations<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'></span></span>
+<span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+incondefs
+</span></span></p>
+<p class="IndentText">
+A function, variable or constant is redefined with a different type.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+functionderef
+</span></span></p>
+<p class="IndentText">
+A function type is dereferenced.  The ANSI standard allows this because of
+ implicit conversion of function designators, however the dereference is unnecessary. 
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+redundantsharequal
+</span></span></p>
+<p class="IndentText">
+A declaration of an immutable object uses a redundant observer qualifier. 
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+misplacedsharequal
+</span></span></p>
+<p class="IndentText">
+A declaration of an unsharable object uses a sharing annotation. 
+</p>
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+Types <span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section</span></span>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>4</span></span>
+<span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<p class="IndentText">&nbsp;</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+type
+</span></span></p>
+<p class="IndentText">Type mismatch.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+string-literal-too-long
+</span></span></p>
+<p class="IndentText">
+A string literal is assigned to a char array too small to hold it. 
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+string-literal-too-no-room
+</span></span></p>
+<p class="IndentText">
+A string literal is assigned to a char array that is not big enough to hold the null terminator. 
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+string-literal-smaller
+</span></span></p>
+<p class="IndentText">
+A string literal is assigned to a char array that smaller than the string literal needs.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+enum-members
+</span></span></p>
+<p class="IndentText">
+Type of initial values for enum members must be int. 
+</p>
+
+<p class="Heading10">Boolean Types <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>4.2</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<p class="TextFontCX">These flags control the type name used to
+represent Booleans, and whether the Boolean type is abstract.</p>
+<p class="TextFontCX">&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>bool</span></span></p>
+<p class="IndentText">Boolean type is an abstract type.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
+'font-size:10.0pt'>bool</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>booltype</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;name&gt;</i></span></span></p>
+<p class="IndentText">Set name of Boolean type to
+<i>&lt;name&gt;</i>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span><span class="Flag"><span style=
+'font-size:10.0pt'>FALSE</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>boolfalse</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;name&gt;</i></span></span></p>
+<p class="IndentText">Set name of Boolean false to
+<i>&lt;name&gt;</i>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
+'font-size:10.0pt'>TRUE</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>booltrue</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;name&gt;</i></span></span></p>
+<p class="IndentText">Set name of Boolean true to
+<i>&lt;name&gt;</i>.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+likelybool
+</span></span></p>
+<p class="IndentText">
+Splint has found a type which appears to be the boolean type.  Use the -booltype, -boolfalse and -booltrue flags to change the name of the default boolean type.
+</p>
+
+
+<p class="Heading10"><a name="_Ref344871224">Predicates</a></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>pred-bool-ptr</span></span></p>
+<p class="IndentText">Type of condition test is a pointer.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>pred-bool-int</span></span></p>
+<p class="IndentText">Type of condition test is an integral
+type.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>pred-bool-others</span></span></p>
+<p class="IndentText">Type of condition test is not a Boolean,
+pointer or integral type.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>pred-bool</span></span></p>
+<p class="IndentText">Sets <span class="Flag"><span style=
+'font-size:10.0pt'>predboolint</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>predboolptr</span></span> and
+<span class="Flag"><span style=
+'font-size:10.0pt'>preboolothers</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>pred-assign</span></span></p>
+<p class="IndentText">The condition test is an assignment
+expression. If an assignment is intended, add an extra parentheses
+nesting (e.g., <span class="CodeText"><span style=
+'font-size:10.0pt'>if ((a = b))</span></span> ...).</p>
+<p class="Heading10">Primitive Operations</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ptr-arith</span></span></p>
+<p class="IndentText">Arithmetic involving pointer and integer.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+nullptrarith
+</span></span></p>
+<p class="IndentText">
+Pointer arithmetic using a possibly null pointer and integer. 
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+boolops
+</span></span></p>
+<p class="IndentText">
+The operand of a boolean operator is not a boolean. Use +ptrnegate to allow ! to be used on pointers. 
+</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ptr-negate</span></span></p>
+<p class="IndentText">Allow the operand of the <span class=
+"CodeText"><span style='font-size:10.0pt'>!</span></span> operator
+to be a pointer.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>bitwise-signed</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;</span></span></p>
+<p class="IndentText">An operand to a bitwise operator is not an
+unsigned value. This may have unexpected results depending on the
+signed representations.</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+shiftimplementation 
+</span></span></p>
+<p class="IndentText">
+The left operand to a shift operator may be negative (behavior is implementation-defined). 
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+shiftnegative
+</span></span></p>
+<p class="IndentText">
+The right operand to a shift operator may be negative (behavior undefined).
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>shift-signed</span></span></p>
+<p class="IndentText">The left operand to a shift operator is not
+an unsigned value.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>strict-ops</span></span></p>
+<p class="IndentText">Primitive operation does not type check
+strictly.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sizeof-type</span></span></p>
+<p class="IndentText">Operand of <span class=
+      "CodeText"><span style='font-size:10.0pt'>sizeof</span></span>
+      operator is a type.&nbsp; (Safer to use <span class=
+      "CodeText"><span style='font-size:10.0pt'>int *x = sizeof
+      (*x);</span></span> instead of <span class=
+      "CodeText"><span style='font-size:10.0pt'>sizeof
+      (int)</span></span>.)</p>
+<p class="Heading10">Array Formal Parameters</p>
+<p class="TextFontCX">These flags control reporting of common
+errors caused by confusion about the semantics of array formal
+parameters.</p>
+<p class="TextFontCX">&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sizeof-formal-array</span></span></p>
+<p class="IndentText">The <span class="CodeText"><span style=
+'font-size:10.0pt'>sizeof</span></span> operator is used on a
+parameter declared as an array.&nbsp; (In many instances this has
+unexpected behavior, since the result is the size of a pointer to
+the element type, not the number of elements in the array.)</p>
+<p class="IndentText">&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>fixed-formal-array</span></span></p>
+<p class="IndentText">An array formal parameter is declared with a
+fixed size (e.g., <span class="CodeText"><span style=
+'font-size:10.0pt'>int x[20]</span></span>).&nbsp; This is likely
+to be confusing, since the size is ignored.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>formal-array</span></span></p>
+<p class="IndentText">A formal parameter is declared as an
+array.&nbsp; This is probably not a problem, but can be confusing
+since it is treated as a pointer.&nbsp;</p>
+<p class="Heading10">Format Codes</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>format-code</span></span></p>
+<p class="IndentText">Invalid format code in format string for
+<span class="Annot"><span style=
+'font-size:10.0pt'>printflike</span></span> or <span class=
+"Annot"><span style='font-size:10.0pt'>scanflike</span></span>
+function.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>format-type</span></span></p>
+<p class="IndentText">Type-mismatch in parameter corresponding to
+format code in a <span class="Annot"><span style=
+'font-size:10.0pt'>printflike</span></span> or <span class=
+"Annot"><span style='font-size:10.0pt'>scanflike</span></span>
+function.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>format-const</span></span></p>
+<p class="IndentText">Format parameter is not known at compile-time.  This can lead to security vulnerabilities because the arguments cannot be type checked.</p>
+
+<p class="Heading10">Main</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>main-type</span></span></p>
+<p class="IndentText">Type of <span class=
+      "CodeText"><span style='font-size:10.0pt'>main</span></span>
+      does not match expected type (function returning an
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>, taking no parameters or
+      two parameters of type <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> and <span class=
+      "CodeText"><span style='font-size:10.0pt'>char
+      **</span></span>.)</p>
+<p class="Heading10">Comparisons</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><a name=
+"boolcompare"></a><a name="boolprose"><span style=
+'font-size:10.0pt'>m:</span></a><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>bool-compare</span></span></p>
+<p class="IndentText">Comparison between Boolean values.&nbsp; This
+is dangerous since there may be multiple true values as any
+non-zero value is interpreted as true.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>real-compare</span></span></p>
+<p class="IndentText">Comparison involving <span class=
+"CodeText"><span style='font-size:10.0pt'>float</span></span> or
+<span class="CodeText"><span style=
+'font-size:10.0pt'>double</span></span> values.&nbsp; This is
+dangerous since it may produce unexpected results because floating
+point representations are inexact.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ptr-compare</span></span></p>
+<p class="IndentText">Comparison between pointer and number.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unsigned-compare</span></span></p>
+<p class="IndentText">
+An unsigned value is used in a comparison with zero in a way that is either a bug or confusing.
+</p>
+
+<p class="Heading10">Type Equivalence</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><a name=
+"globs"></a><span style=
+      'font-size:10.0pt'>m:</span><span class="Keyword"><span style='font-size: 10.0pt'>
++---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>void-abstract</span></span></p>
+<p class="IndentText">Allow <span class=
+      "CodeText"><span style='font-size:10.0pt'>void
+      *</span></span> to match pointers to abstract types.&nbsp;
+      (Casting a pointer to an abstract type to a pointer to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>void</span></span> is okay if <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>+void-abstract</span></span> is set.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>cast-fcn-ptr</span></span></p>
+<p class="IndentText">&nbsp;A pointer to a function is cast to (or
+used as) a pointer to void (or vice versa).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>forward-decl</span></span></p>
+<p class="IndentText">Forward declarations of pointers to abstract
+representation match abstract type.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-type</span></span></p>
+<p class="IndentText">A variable declaration has no explicit
+type.&nbsp; The type is implicitly int.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>incomplete-type</span></span></p>
+<p class="IndentText">A formal parameter is declared with an
+incomplete type (e.g., <span class="Keyword"><span style=
+'font-size:10.0pt'>int[][]</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>char-index</span></span></p>
+<p class="IndentText">Allow <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      to index arrays.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>enum-index</span></span></p>
+<p class="IndentText">Allow members of <span class=
+"CodeText"><span style='font-size:10.0pt'>enum</span></span>type to
+index arrays.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>bool-int</span></span></p>
+<p class="IndentText">Make <span class=
+      "CodeText"><span style='font-size:10.0pt'>bool</span></span>
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> are equivalent.&nbsp;
+      (No type errors are reported when a Boolean is used where an
+      integral type is expected and vice versa.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>char-int</span></span></p>
+<p class="IndentText">Make <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> types equivalent</p>
+      
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>charunsignedchar</span></span></p>
+<p class="IndentText">To allow <span class=
+      "CodeText"><span style='font-size:10.0pt'>char</span></span>
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>unsigned char</span></span> types to match use
+<span class="Flag"><span style=
+'font-size:10.0pt'>+charunsignedchar</span></span>
+</p>
+      
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>enum-int</span></span></p>
+<p class="IndentText">Make <span class=
+      "CodeText"><span style='font-size:10.0pt'>enum</span></span>
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span> types equivalent</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>float-double</span></span></p>
+<p class="IndentText">Make <span class=
+      "CodeText"><span style='font-size:10.0pt'>float</span></span>
+      and <span class="CodeText"><span style=
+      'font-size:10.0pt'>double</span></span> types equivalent</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ignore-quals</span></span></p>
+<p class="IndentText">Ignore type qualifiers (<span class=
+"CodeText"><span style='font-size:10.0pt'>long</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>short</span></span>, <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>unsigned</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++--</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>relax-quals</span></span></p>
+<p class="IndentText">Report qualifier mismatches only if dangerous
+(information may be lost since a larger type is assigned to (or
+passed as) a smaller one or a comparison uses <span class=
+"CodeText"><span style='font-size:10.0pt'>signed</span></span> and
+<span class="CodeText"><span style=
+'font-size:10.0pt'>unsigned</span></span> values.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ignore-signs</span></span></p>
+<p class="IndentText">Ignore signs in type comparisons
+      (<span class="CodeText"><span style=
+      'font-size:10.0pt'>unsigned</span></span> matches
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>signed</span></span>).</p>
+<p class="IndentText">&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>long-integral</span></span></p>
+<p class="IndentText">Allow long type to match an arbitrary
+integral type (e.g., <span class="CodeText"><span style=
+'font-size:10.0pt'>dev_t</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>long-unsigned-integral</span></span></p>
+<p class="IndentText">Allow unsigned long type to match an
+arbitrary integral type (e.g., <span class=
+      "CodeText"><span style='font-size:10.0pt'>dev_t</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>match-any-integral</span></span></p>
+<p class="IndentText">Allow any integral type to match an
+arbitrary</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>long-unsigned-unsigned-integral</span></span></p>
+<p class="IndentText">Allow unsigned long type to match an
+arbitrary unsigned integral type (e.g., <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>size_t</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+---</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>long-signed-integral</span></span></p>
+<p class="IndentText">Allow long type to match an arbitrary signed
+integral type (e.g., <span class="CodeText"><span style=
+'font-size:10.0pt'>ssize_t</span></span>).</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>&nbsp;</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>num-literal</span></span></p>
+<p class="IndentText">Integer literals can be used as floats.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>char-int-literal</span></span></p>
+<p class="IndentText">A character constant may be used as an
+<span class="CodeText"><span style=
+'font-size:10.0pt'>int</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>zero-ptr</span></span></p>
+<p class="IndentText">Literal <span class=
+      "CodeText"><span style='font-size:10.0pt'>0</span></span> may
+      be used as a pointer.</p>
+div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>zero-bool</span></span></p>
+<p class="IndentText">Treat <span class=
+      "CodeText"><span style='font-size:10.0pt'>0</span></span> as a boolean.
+ </p>     
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>relax-types</span></span></p>
+<p class="IndentText">Allow all numeric types to match.</p>
+<p class="Heading10"><a name="_Toc534975052">Abstract Types</a>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section</span></span>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>4.3</span></span><span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>abstract</span></span></p>
+<p class="IndentText">A data abstraction barrier is violated</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
+'font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-abstract</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>abstract</span></span>
+      annotation for type declarations that do not use <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>concrete</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class="Flag"><span style=
+'font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mut-rep</span></span></p>
+<p class="IndentText">Representation of mutable type has sharing
+semantics.</p>
+<p class="Heading10">Access <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+4.3.1)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>access-module</span></span></p>
+<p class="IndentText">An abstract type defined in
+      <span class="ProgramNameChar"><i>M</i></span><span class=
+      "ProgramNameChar">.h</span> (or specified in <span class=
+      "ProgramNameChar"><i>M</i></span><span class=
+      "ProgramNameChar">.lcl</span>) is accessible in <span class=
+      "ProgramNameChar"><i>M</i></span><span class=
+      "ProgramNameChar">.c</span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>access-file</span></span></p>
+<p class="IndentText">An abstract type named <span class=
+"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
+is accessible in files named <span class=
+"ProgramNameChar"><i>type</i></span><span class=
+"ProgramNameChar">.*</span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="MsoListBullet"><span class="Flag"><span style=
+'font-size:10.0pt'>access-czech</span></span></p>
+<p class="IndentText">An abstract type named <span class=
+"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
+may be accessible in a function named <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>type_name</span></i></span>. (Section
+12.1.1)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="MsoListBullet"><span class="Flag"><span style=
+'font-size:10.0pt'>access-slovak</span></span></p>
+<p class="IndentText">An abstract type named <span class=
+"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
+may be accessible in a function named <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>typeName</span></i></span>.&nbsp;
+(Section.12.1.2)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="MsoListBullet"><span class="Flag"><span style=
+'font-size:10.0pt'>access-czechoslovak</span></span></p>
+<p class="IndentText">An abstract type named <span class=
+"CodeText"><i><span style='font-size:10.0pt'>type</span></i></span>
+may be accessible in a function named <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>type_name</span></i></span> or
+      <span class="CodeText"><i><span style=
+      'font-size:10.0pt'>typeName</span></i></span>.&nbsp; (Section
+      12.1.3)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>access-all</span></span></p>
+<p class="IndentText">Sets <span class="Flag"><span style=
+'font-size:10.0pt'>access-module</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>access-file</span></span> and
+<span class="Flag"><span style=
+'font-size:10.0pt'>access-czech</span></span>.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975053">Memory Management</a> <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section</span></span>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>5</span></span><span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<p class="TextFontCX">Reporting of memory management errors is
+controlled by flags setting checking and implicit annotations and
+code annotations.&nbsp;</p>
+<p class="Heading10">Deallocation Errors <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+5.2)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>use-released</span></span></p>
+<p class="IndentText">Storage used after it may have been
+released.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>strict-use-released</span></span></p>
+<p class="IndentText">An array element used after it may have been
+released.</p>
+<p class="Heading10">Inconsistent Branches</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>branch-state</span></span></p>
+<p class="IndentText">Storage has inconsistent states of alternate
+paths through a branch (e.g., it is released in the true branch of
+an if-statement, but there is no else branch.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>strict-branch-state</span></span></p>
+<p class="IndentText">Storage through array fetch has inconsistent
+states of alternate paths through a branch.&nbsp; Since array
+elements are not checked accurately, this may lead to spurious
+errors.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>dep-arrays</span></span></p>
+<p class="IndentText">Treat array elements as <span class=
+"Annot"><span style='font-size:10.0pt'>dependent</span></span>
+storage.&nbsp; Checking of array elements cannot be done accurately
+by Splint.&nbsp; If <span class="Flag"><span style=
+'font-size:10.0pt'>dep-arrays</span></span> is not set, array
+elements are assumed to be independent, so code that releases the
+same element more than once will produce no error.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>dep-arrays</span></span> is set, array elements
+are assumed to be dependent, so code that releases the same element
+more that once will produce an error, but code that releases
+different elements correctly will produce a spurious error.</p>
+<p class="Heading10">Memory Leaks</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>must-free</span></span></p>
+<p class="IndentText">Allocated storage was not released before
+return or scope exit.&nbsp; Errors are reported for
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>only</span></span>, <span class=
+      "Annot"><span style='font-size:10.0pt'>fresh</span></span> or
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>owned</span></span> storage.</p>
+      
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mustfreefresh</span></span></p>
+<p class="IndentText">
+Allocated storage was not released before return or scope exit.  Errors are reported for 
+       <span class="Annot"><span style='font-size:10.0pt'>fresh</span></span> storage
+      </p>
+      
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mustfreeonly</span></span></p>
+<p class="IndentText">
+Allocated storage was not released before return or scope exit.  Errors are reported for 
+       <span class="Annot"><span style='font-size:10.0pt'>only</span></span> storage
+      </p>
+      
+  <div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span><span class=
+      "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>memchecks</span></span></p>
+<p class="IndentText">
+Sets all dynamic memory checking flags
+(<span class=
+      "Flag"><span style='font-size:10.0pt'>memimplicit, mustfree, mustdefine,   mustnotalias, null, memtrans</span> </span>). 
+      </p>
+          
+      <div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>comp-destroy</span></span></p>
+<p class="IndentText">All only references derivable from
+<span class="Annot"><span style='font-size:10.0pt'>out
+only</span></span> parameter of type <span class=
+"CodeText"><span style='font-size:10.0pt'>void *</span></span> must
+be released.&nbsp; (This is the type of the parameter to
+<span class="CodeText"><span style=
+'font-size:10.0pt'>free</span></span>, but may also be used for
+user-defined deallocation functions.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>strict-destroy</span></span></p>
+<p class="IndentText">Report complete destruction errors for array
+elements that may have been released.&nbsp; (If <span class=
+"Flag"><span style='font-size:10.0pt'>strict-destroy</span></span>
+is not set, Splint will assume that if any array element was
+released, the entire array was correctly released.)</p>
+<p class="Heading10">Transfer Errors</p>
+<p class="beforelist">A transfer error is reported when storage is
+transferred (by an assignment, passing a parameter, or returning)
+in a way that is inconsistent.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mem-trans</span></span></p>
+<p class="IndentText">Sets all memory transfer errors flags.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>only-trans</span></span></p>
+<p class="IndentText">Only storage transferred to non-only
+reference (memory leak).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ownedtrans</span></span></p>
+<p class="IndentText">Owned storage transferred to non-owned
+reference (memory leak).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>fresh-trans</span></span></p>
+<p class="IndentText">Newly-allocated storage transferred to
+non-only reference (memory leak).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>shared-trans</span></span></p>
+<p class="IndentText">Shared storage transferred to non-shared
+reference</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>dependent-trans</span></span></p>
+<p class="IndentText">Inconsistent <span class=
+      "Annot"><span style='font-size:10.0pt'>dependent</span></span>
+      transfer. Dependent storage is transferred to a non-dependent
+      reference.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>temp-trans</span></span></p>
+<p class="IndentText">Temporary storage (associated with a
+<span class="Annot"><span style=
+'font-size:10.0pt'>temp</span></span> formal parameter) is
+transferred to a non-temporary reference.&nbsp; The storage may be
+released or new aliases created.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>kept-trans</span></span></p>
+<p class="IndentText">Kept storage (storage what was passed as
+<span class="Annot"><span style=
+'font-size:10.0pt'>keep</span></span>) transferred to non-temporary
+reference.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>keep-trans</span></span></p>
+<p class="IndentText">Keep storage is transferred in a way that may
+add a new alias to it, or release it.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>refcount-trans</span></span></p>
+<p class="IndentText">Reference counted storage is transferred in
+an inconsistent way.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>newref-trans</span></span></p>
+<p class="IndentText">A new reference transferred to a reference
+counted reference (reference count is not set correctly).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>immediate-trans</span></span></p>
+<p class="IndentText">An immediate address (result of
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>&amp;</span></span>) is transferred
+      inconsistently.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>static-trans</span></span></p>
+<p class="IndentText">Static storage is transferred in an
+inconsistent way.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>expose-trans</span></span></p>
+<p class="IndentText">Inconsistent exposure transfer. Exposed
+storage is transferred to a non-<span class=
+      "Annot"><span style='font-size:10.0pt'>exposed</span></span>,
+      non-<span class="Annot"><span style=
+      'font-size:10.0pt'>observer</span></span> reference.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>observer-trans</span></span></p>
+<p class="IndentText">Inconsistent <span class=
+      "Annot"><span style='font-size:10.0pt'>observer</span></span>
+      transfer. Observer storage is transferred to a non-observer
+      reference.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unqualified-trans</span></span></p>
+<p class="IndentText">Unqualified storage is transferred in an
+inconsistent way.</p>
+<p class="Heading11">Initializers</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>only-unq-global-trans</span></span></p>
+<p class="IndentText">Only storage transferred to an unqualified
+global or static reference. This may lead to a memory leak, since
+the new reference is not necessarily released.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>static-init-trans</span></span></p>
+<p class="IndentText">Static storage is used as an initial value in
+an inconsistent way.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unqualified-init-trans</span></span></p>
+<p class="IndentText">Unqualified storage is used as an initial
+value in an inconsistent way.</p>
+<p class="Heading11">Derived Storage</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>comp-mem-pass</span></span></p>
+<p class="IndentText">Storage derivable from a parameter does not
+match the alias kind expected for the formal parameter.</p>
+<p class="Heading11">Stack References</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>stack-ref</span></span></p>
+<p class="IndentText">A stack reference is pointed to by an
+external reference when the function returns.&nbsp; Since the call
+frame will be destroyed when the function returns the return value
+will point to dead storage. (Section 5.2.6)</p>
+<p class="Heading10">Implicit Memory Annotations <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>5.3</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>all-imp-only</span></span></p>
+<p class="IndentText">Sets
+<span class="Flag"><span style=
+'font-size:10.0pt'>
+glob-imp-only, ret-imp-only, struct-imp-only, specglobimponly, specretimponly
+</span></span>
+and
+<span class="Flag"><span style=
+'font-size:10.0pt'>
+specstructimponly
+</span></span>.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>glob-imp-only</span></span></p>
+<p class="IndentText">Assume unannotated global storage is
+only.</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>param-imp-temp</span></span></p>
+<p class="IndentText">Assume unannotated parameter is
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>temp</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ret-imp-only</span></span></p>
+<p class="IndentText">Assume unannotated returned storage is
+<span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>struct-imp-only</span></span></p>
+<p class="IndentText">Assume unannotated structure or union field
+is <span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>code-imp-only</span></span></p>
+<p class="IndentText">Sets <span class="Flag"><span style=
+'font-size:10.0pt'>glob-imp-only</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>ret-imp-only</span></span>
+and <span class="Flag"><span style=
+'font-size:10.0pt'>struct-imp-only</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mem-imp</span></span></p>
+<p class="IndentText">Report memory errors for unqualified
+storage.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>pass-unknown</span></span></p>
+<p class="IndentText">Passing a value as an unannotated parameter
+clears its annotation.&nbsp; This will prevent many spurious errors
+from being report for unannotated programs, but eliminates the
+possibility of detecting many errors.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975054">Sharing</a> <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+6)</span></span></p>
+<p class="Heading10">Aliasing <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section</span></span>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>6.1</span></span><span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>alias-unique</span></span></p>
+<p class="IndentText">An actual parameter that is passed as a
+<span class="Annot"><span style=
+'font-size:10.0pt'>unique</span></span> formal parameter is aliased
+by another parameter or global variable.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>may-alias-unique</span></span></p>
+<p class="IndentText">An actual parameter that is passed as a
+<span class="Annot"><span style=
+'font-size:10.0pt'>unique</span></span> formal parameter may be
+aliased by another parameter or global variable.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>must-not-alias</span></span></p>
+<p class="IndentText">An alias has been added to a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>temp</span></span>-qualifier&nbsp;parameter
+      or global that is visible externally when the function
+      returns.&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ret-alias</span></span></p>
+<p class="IndentText">A function returns an alias to parameter or
+global.</p>
+<p class="Heading10">Exposure <span class=
+      "HeadingNote"><span style='font-size: 10.5pt;font-weight:normal;font-style:normal'>
+(Section</span></span> <span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>6.2</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>rep-expose</span></span></p>
+<p class="IndentText">The internal representation of an abstract
+type is visible to the caller.&nbsp; This means clients may have
+access to a pointer into the abstract representation.&nbsp; (Sets
+<span class="Flag"><span style=
+'font-size:10.0pt'>assign-expose</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>ret-expose</span></span>, and
+<span class="Flag"><span style=
+'font-size:10.0pt'>cast-expose</span></span>.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>assign-expose</span></span></p>
+<p class="IndentText">Abstract representation is exposed by an
+assignment or passed parameter.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>cast-expose</span></span></p>
+<p class="IndentText">Abstract representation is exposed through a
+cast.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ret-expose</span></span></p>
+<p class="IndentText">Abstract representation is exposed by a
+return value.</p>
+<p class="Heading11">Observer Modifications</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-observer</span></span></p>
+<p class="IndentText">Possible modification of observer
+storage.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-observer-uncon</span></span></p>
+<p class="IndentText">Storage declared with observer may be
+modified through a call to an unconstrained function.</p>
+<p class="Heading11">String Literals <span class=
+"TextFontCXChar"><span style=
+'font-weight: normal;font-style:normal'>(Section
+6.2.1)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>read-only-trans</span></span></p>
+<p class="IndentText">Report memory transfer errors for
+initializations to read-only string literals</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>read-only-strings</span></span></p>
+<p class="IndentText">String literals are read-only (ISO
+semantics).&nbsp; An error is reported if a string literal may be
+modified or released.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+Function Interfaces <span class="TextFontCXChar"><span style=
+'font-size:11.0pt;font-weight:normal'>(Section</span></span>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>7</span></span><span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<p class="Heading10">Modification <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+7.1)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>modifies</span></span></p>
+<p class="IndentText">Undocumented modification of caller-visible
+state.&nbsp; Without <span class="Flag"><span style=
+'font-size:10.0pt'>+moduncon</span></span>, modification errors are
+only reported in the definitions of functions declared with a
+modifies clause (or specified).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>must-mod</span></span></p>
+<p class="IndentText">Documented modification is not
+detected.&nbsp; An object listed in the modifies clause for a
+function, is not modified by the implementation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-uncon</span></span></p>
+<p class="IndentText">Report modification errors in functions
+declared without a modifies clause.(Sets <span class=
+"Flag"><span style='font-size:10.0pt'>mod-nomods</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>mod-globs-nomods</span></span> and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>mod-strict-globs-nomods</span></span>.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-nomods</span></span></p>
+<p class="IndentText">Report modification errors (not involving
+global variables) in functions declared without a modifies
+clause.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-uncon-nomods</span></span></p>
+<p class="IndentText">An unconstrained function is called in a
+function body where modifications are checked.&nbsp; Since the
+unconstrained function may modify anything, there may be undetected
+modifications in the checked function.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-internal-strict</span></span></p>
+<p class="IndentText">A function that modifies <span class=
+"Annot"><span style='font-size:10.0pt'>internalState</span></span>
+is called from a function that does not list <span class=
+"Annot"><span style='font-size:10.0pt'>internalState</span></span>
+in its modifies clause.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-file-sys</span></span></p>
+<p class="IndentText">A function modifies the file system but does
+not list <span class="Annot"><span style=
+'font-size:10.0pt'>fileSystem</span></span>&nbsp;in its modifies
+clause.</p>
+<p class="Heading10">Global Variables <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>7.2</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<p class="beforelist"><a name="globflags"></a>Errors involving the
+use and modification of global and file static variables are
+reported depending on flag settings, annotations where the global
+variable is declared, and whether or not the function where the
+global is used was declared with a globals clause.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>globs</span></span></p>
+<p class="IndentText">Undocumented use of a checked global variable
+in a function with a globals list.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>glob-use</span></span></p>
+<p class="IndentText">A global listed in the globals list is not
+used in the implementation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>glob-noglobs</span></span></p>
+<p class="IndentText">Use of a checked global in a function with no
+globals list.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>internal-globs</span></span></p>
+<p class="IndentText">Undocumented use of internal state (should
+have <span class="Annot"><span style='font-size:10.0pt'>globals
+internalState</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>internal-globs-noglobs</span></span></p>
+<p class="TextFontCX">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+Use of internal state in function with no globals list.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>glob-state</span></span></p>
+<p class="IndentText">A function returns with global in
+inconsistent state (null or undefined)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>all-globs</span></span></p>
+<p class="IndentText">Report use and modification errors for
+globals not annotated with <span class="Annot"><span style=
+'font-size:10.0pt'>unchecked</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>check-strict-globs</span></span></p>
+<p class="IndentText">Report use and modification errors for
+<span class="Annot"><span style=
+'font-size:10.0pt'>checkedstrict</span></span> globals.</p>
+<p class="Heading11">Modification of Global Variables</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-globs</span></span></p>
+<p class="IndentText">Undocumented modification of a checked global
+variable.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-globs-unchecked</span></span></p>
+<p class="IndentText">Undocumented modification of an
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>unchecked</span></span>
+      global&nbsp;variable.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-globs-nomods</span></span></p>
+<p class="IndentText">Undocumented modification of a checked global
+variable in a function with no modifies clause.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mod-strict-globs-nomods</span></span></p>
+<p class="IndentText">Undocumented modification of a
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>checkedstrict</span></span>
+      global&nbsp;variable in a function declared with no modifies
+      clause.</p>
+<p class="Heading11">Globals Lists and Modifies Clauses</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>warn-missing-globs</span></span></p>
+<p class="IndentText">Global variable used in modifies clause is
+not listed in globals list.&nbsp; (The global is added to the
+globals list.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>warn-missing-globs-noglobs</span></span></p>
+<p class="IndentText">Global variable used in modifies clause of a
+function with no globals list.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>globs-imp-mods-nothing</span></span></p>
+<p class="IndentText">A function declared with a globals list but
+no modifies clause is assumed to modify nothing.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>mods-imp-noglobs</span></span></p>
+<p class="IndentText">A function declared with a modifies clause
+but no globals list is assumed to use no globals.</p>
+<p class="Heading11">Implicit Checking Annotations</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checked-globs</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checked</span></span>&nbsp;annotation
+      on global variables with no checking annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checked-statics</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checked</span></span>&nbsp;qualifier
+      file static scope variables with no checking annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checkmod-globs</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
+      qualifier on global variables with no checking
+      annotation.</p>
+<p class="IndentText"><span class="Flag"><span style=
+'font-size:10.0pt'>&nbsp;</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checkmod-statics</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
+      qualifier file static scope variables with no checking
+      annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checkedstrict-globs</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checked</span></span>
+      qualifier on global variables with no checking
+      annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checkedstrict-statics</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checked</span></span>
+      qualifier file static scope variables with no checking
+      annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checkmod-internals</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
+      qualifier on function scope static variables with no checking
+      annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="IndentText" style='margin-left:0in'><span class=
+"Keyword"><span style='font-size:10.0pt'>&nbsp;</span></span></p>
+<p class="Heading11">Global Aliasing</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>glob-alias</span></span></p>
+<p class="IndentText">Function returns with global aliasing
+external state (sets <span class="Flag"><span style=
+'font-size:10.0pt'>checkstrict-glob-alias</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>checked-glob-alias</span></span>,
+      c<span class="Flag"><span style=
+      'font-size:10.0pt'>heckmod-glob-alias</span></span>&nbsp;and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>unchecked-glob-alias</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>checkstrict-glob-alias</span></span></p>
+<p class="IndentText">Function returns with a <span class=
+"Annot"><span style='font-size:10.0pt'>checkedstrict</span></span>
+global&nbsp;aliasing external state.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>checked-glob-alias</span></span></p>
+<p class="IndentText">Function returns with a <span class=
+"Annot"><span style='font-size:10.0pt'>checked</span></span>
+global&nbsp;aliasing external state.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>checkmod-glob-alias</span></span></p>
+<p class="IndentText">Function returns with a <span class=
+"Annot"><span style='font-size:10.0pt'>checkmod</span></span>
+global&nbsp;aliasing external state.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unchecked-glob-alias</span></span></p>
+<p class="IndentText">Function returns with an <span class=
+"Annot"><span style='font-size:10.0pt'>unchecked</span></span>
+global&nbsp;aliasing external state.</p>
+<p class="Heading10">Declaration Consistency <span style=
+'font-weight:normal'>(Section 7.3)</span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>incon-defs</span></span></p>
+<p class="IndentText">Identifier redeclared or redefined with
+inconsistent type.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>incon-defs-lib</span></span></p>
+<p class="IndentText">Identifier defined in a library is redefined
+with inconsistent type.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>overload</span></span></p>
+<p class="IndentText">Standard library function overloaded.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>match-fields</span></span></p>
+<p class="IndentText">A <span class="CodeText"><span style=
+'font-size:10.0pt'>struct</span></span> or <span class=
+"CodeText"><span style='font-size:10.0pt'>enum</span></span> type
+is redefined with inconsistent fields or members.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975057">Macros</a> <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section</span></span>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>11</span></span><span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<p class="TextFontCX">These flags control expansion and checking of
+macro definitions and invocations.</p>
+<p class="Heading10">Macro Expansion</p>
+<p class="beforelist">These flags control which macros are checked
+as functions or constants, and which are expanded in the
+pre-processing phase.&nbsp; Macros preceded by <span class=
+"Annot"><span style=
+'font-size:10.0pt'>/*@notfunction@*/</span></span> are never
+expanded regardless of these flag settings. &nbsp;These flags may
+be used in source-file control comments.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>fcn-macros</span></span></p>
+<p class="IndentText">Macros defined with parameter lists are not
+expanded and are checked as functions.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>const-macros</span></span></p>
+<p class="IndentText">Macros defined without parameter lists are
+not expanded and are checked as constants.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>all-macros</span></span></p>
+<p class="IndentText">Sets <span class="Flag"><span style=
+'font-size:10.0pt'>fcn-macros</span></span> and <span class=
+"Flag"><span style=
+'font-size:10.0pt'>const-macros</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>lib-macros</span></span></p>
+<p class="IndentText">Macros defining identifiers declared in a
+loaded library are not expanded and are checked according to the
+library information.<span class="Flag"><span style=
+'font-size:10.0pt'>&nbsp;</span></span></p>
+<p class="Heading10">Macro Definitions</p>
+<p class="beforelist">These flags control what errors are reported
+in macro definitions.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-stmt</span></span></p>
+<p class="IndentText">Macro definition is not syntactically
+equivalent to function.&nbsp; This means if the macro is used as a
+statement (e.g., <span class="CodeText"><span style=
+'font-size:10.0pt'>if (test) macro();</span></span>) unexpected
+behavior may result.&nbsp; One fix is to surround the macro body
+with <span class="CodeText"><span style='font-size:10.0pt'>do {
+&#8230; } while (FALSE)</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-return</span></span></p>
+<p class="IndentText">
+The body of a macro declared as a function uses a
+<span class="CodeText"><span style='font-size:10.0pt'>return</span></span>
+statement. This exhibits behavior that could not be implemented by a function.
+</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-assign</span></span></p>
+<p class="IndentText">A macro parameter is used as the left side of
+an assignment expression.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-parens</span></span></p>
+<p class="IndentText">A macro parameter is used without parentheses
+(in potentially dangerous context).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-empty</span></span></p>
+<p class="IndentText">Macro definition of a function is
+empty.&nbsp;&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-redef</span></span></p>
+<p class="IndentText">Macro is redefined.&nbsp; There is another
+macro defined with the same name.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-unrecog</span></span>&nbsp;</p>
+<p class="IndentText">An unrecognized identifier appears in a macro
+definition.&nbsp; Since the identifier may be defined where the
+macro is used, this could be okay, but Splint will not be able to
+check the unrecognized identifier appropriately.</p>
+<p class="Heading11">Corresponding Declarations</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-match-name</span></span></p>
+<p class="IndentText">An <span class="Annot"><span style=
+'font-size:10.0pt'>iter</span></span>&nbsp;or <span class=
+"Annot"><span style=
+'font-size:10.0pt'>constant</span></span>&nbsp;macro is defined
+using a different name from the one used in the previous syntactic
+comment</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-decl</span></span></p>
+<p class="IndentText">A macro definition has no corresponding
+declaration.&nbsp; (Sets <span class="Flag"><span style=
+'font-size:10.0pt'>macrofcndecl</span></span>&nbsp;and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>macroconstdecl</span></span>.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-fcn-decl</span></span></p>
+<p class="IndentText">Macro definition with parameter list has no
+corresponding function prototype. Without a prototype, the types of
+the macro result and parameters are unknown.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-const-decl</span></span></p>
+<p class="IndentText">A macro definition without parameter list has
+no corresponding constant declaration.<span class=
+"Flag"><span style=
+'font-size: 10.0pt'>&nbsp;&nbsp;&nbsp;</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>next-line-macros</span></span></p>
+<p class="IndentText">A constant or iter declaration is not
+immediately followed by a macro definition.</p>
+<p class="Heading10">Side Effect Free Parameters <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>11.2.1</span></span><span class="HeadingNote">
+<span style=
+'font-size: 10.5pt;font-weight:normal;font-style:normal'>)</span></span></p>
+<p class="beforelist">These flags control error reporting for
+parameters with inconsistent side effects in invocations of checked
+function macros and function calls.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sef-params</span></span></p>
+<p class="IndentText">An actual parameter with side effects is
+passed as a formal parameter declared with <span class=
+"Annot"><span style='font-size:10.0pt'>sef</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sef-uncon</span></span></p>
+<p class="IndentText">An actual parameter involving a call to an
+unconstrained function (declared without modifies clause) that may
+modify anything is passed as a <span class=
+      "Annot"><span style='font-size:10.0pt'>sef</span></span>
+      parameter.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975058">Iterators</a></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iterbalance</span></span></p>
+<p class="IndentText">Iter is not balanced with end
+<span class="CodeText"><span style='font-size:10.0pt'> &ltiter&gt</span></span>.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iteryield</span></span></p>
+<p class="IndentText">Iter yield parameter is inappropriate.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>has-yield</span></span></p>
+<p class="IndentText">An iterator has been declared with no
+parameters annotated with <span class="Annot"><span style=
+'font-size:10.0pt'>yield</span></span>.</p>
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975059">Naming Conventions</a> <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+12)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>name-checks</span></span></p>
+<p class="IndentText">Turns all name checking on or off without
+changing other settings.</p>
+<p class="Heading10">Type-Based Naming Conventions
+      <span style='font-size:10.5pt; font-weight:normal'>(Section
+      12.1)</span></p>
+<p class="Heading11">Czech Naming Convention</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech</span></span></p>
+<p class="IndentText">Selects complete Czech naming convention
+(sets <span class="Flag"><span style=
+'font-size:10.0pt'>access-czech</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>czech-fcns</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>czech-vars</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>czech-consts</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>czech-macros</span></span>, and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czech-types</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>access-czech</span></span></p>
+<p class="IndentText">Allow access to abstract types&nbsp;following
+Czech naming convention.&nbsp; The representation of an abstract
+type named <span class="CodeText"><i><span style=
+'font-size:10.0pt'>t</span></i></span> is accessible in the
+definition of a function or constant named <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>t_name</span></i></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-fcns</span></span></p>
+<p class="IndentText">Function or iterator name is not consistent
+with Czech naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-vars</span></span></p>
+<p class="IndentText">&nbsp;Variable name is not consistent with
+Czech naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-macros</span></span></p>
+<p class="IndentText">&nbsp;Expanded macro name is not consistent
+with Czech naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-consts</span></span></p>
+<p class="IndentText">Constant name is not consistent with Czech
+naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czech-types</span></span></p>
+<p class="IndentText">Type name is not consistent with Czech naming
+convention.&nbsp; Czech type names must not use the underscore
+character.</p>
+<p class="Heading11">Slovak Naming Convention</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>slovak</span></span></p>
+<p class="IndentText">Selects complete Slovak naming convention
+(sets <span class="Flag"><span style=
+'font-size:10.0pt'>access-slovak</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>slovak-fcns</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>slovak-vars</span></span>, <span class=
+"Flag"><span style='font-size:10.0pt'>slovak-consts</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>slovak-macros</span></span>, and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>slovak-types</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>access-slovak</span></span></p>
+<p class="IndentText">Allow access to abstract types&nbsp;following
+Slovak naming convention. The representation of an abstract type
+named <span class="CodeText"><i><span style=
+'font-size:10.0pt'>t</span></i></span> is accessible in the
+definition of a function or constant named <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>tName</span></i></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>slovak-fcns</span></span></p>
+<p class="IndentText">Function or iterator name is not consistent
+with Slovak naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>slovak-macros</span></span></p>
+<p class="IndentText">Expanded macro name is not consistent with
+Slovak naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>slovak-vars</span></span></p>
+<p class="IndentText">&nbsp;Variable name is not consistent with
+Slovak naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>slovak-consts</span></span></p>
+<p class="IndentText">&nbsp;Constant name is not consistent with
+Slovak naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>slovak-types</span></span></p>
+<p class="IndentText">Type name is not consistent with Slovak
+naming convention.&nbsp; Slovak type names may not include
+uppercase letters.</p>
+<p class="Heading11">Czechoslovak Naming Convention</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czechoslovak</span></span></p>
+<p class="IndentText">Selects complete Czechoslovak naming
+convention (sets <span class="Flag"><span style=
+'font-size:10.0pt'>access-czechoslovak</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-fcns</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-vars</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-consts</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-macros</span></span>, and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>czechoslovak-types</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>access-czechoslovak</span></span></p>
+<p class="IndentText">Allow access to abstract types&nbsp;by
+Czechoslovak naming convention. The representation of an abstract
+type named <span class="CodeText"><i><span style=
+'font-size:10.0pt'>t</span></i></span> is accessible in the
+definition of a function or constant named <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>t_name</span></i></span> or <span class=
+"CodeText"><i><span style=
+'font-size:10.0pt'>tName</span></i></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czechoslovak-fcns</span></span></p>
+<p class="IndentText">&nbsp;Function name is not consistent with
+Czechoslovak naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czechoslovak-macros</span></span></p>
+<p class="IndentText">Expanded macro name is not consistent with
+Czechoslovak naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czechoslovak-vars</span></span></p>
+<p class="IndentText">Variable name is not consistent with
+Czechoslovak naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czechoslovak-consts</span></span></p>
+<p class="IndentText">Constant name is not consistent with
+Czechoslovak naming convention.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>czechoslovak-types</span></span></p>
+<p class="IndentText">Type name is not consistent with Czechoslovak
+naming convention. Czechoslovak type names may not include
+uppercase letters or the underscore character.</p>
+<p class="Heading10">Namespace Prefixes <span style=
+'font-size:10.5pt; font-weight:normal'>(Section 12.2)</span></p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-var-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for variables declared
+in a macro body.&nbsp; (Default is <span class=
+"CodeText"><span style='font-size:10.0pt'>m_</span></span>.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'>P: <span class=
+"Keyword"><span style=
+'font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>macro-var-prefix-exclude</span></span></p>
+<p class="IndentText">A variable declared outside a macro body
+starts with the <span class="Flag"><span style=
+'font-size:10.0pt'>macro-var-prefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>tag-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix of <span class=
+"CodeText"><span style='font-size:10.0pt'>struct</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>union</span></span> or <span class=
+"CodeText"><span style='font-size:10.0pt'>enum</span></span> tag
+identifiers.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>tag-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not a tag starts with
+the <span class="Flag"><span style=
+'font-size:10.0pt'>tagprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>enum-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for <span class=
+"CodeText"><span style='font-size:10.0pt'>enum</span></span>
+members.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>enum-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not an
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>enum</span></span> member starts with the
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>enumprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>file-static-prefix</span></span><span class="Flag">
+<span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for file
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>static</span></span> declarations.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>file-static-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not file static starts
+with the <span class="Flag"><span style=
+'font-size:10.0pt'>filestaticprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>global-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for global
+variables.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>global-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not a global variable
+starts with the <span class="Flag"><span style=
+'font-size:10.0pt'>globalprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>type-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for user-defined
+types.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>type-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not a type name starts
+with the <span class="Flag"><span style=
+'font-size:10.0pt'>typeprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>external-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for external
+identifiers.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>external-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not external starts
+with the <span class="Flag"><span style=
+'font-size:10.0pt'>externalprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>local-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for local variables.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>local-prefix-exclude</span></span></p>
+<p class="IndentText">&nbsp;An identifier that is not a local
+variable starts with the <span class="Flag"><span style=
+'font-size:10.0pt'>localprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unchecked-macro-prefix</span></span><span class="Flag">
+<span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for unchecked
+macros.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unchecked-macro-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not the name of an
+unchecked macro starts with the <span class=
+      "Flag"><span style='font-size:10.0pt'>uncheckedmacroprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>const-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for constants.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>const-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not a constant starts
+with the <span class="Flag"><span style=
+'font-size:10.0pt'>constantprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iter-prefix</span></span><span class=
+"Flag"><span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for iterators.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iter-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not an
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>iter</span></span>&nbsp;starts with the
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>iterprefix</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>proto-param-prefix</span></span><span class="Flag">
+<span style='font-size:10.0pt'>&nbsp;<i>&lt;prefix
+string&gt;</i></span></span></p>
+<p class="IndentText">Set namespace prefix for parameters in
+function prototypes.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>proto-param-prefix-exclude</span></span></p>
+<p class="IndentText">An identifier that is not a parameter in a
+function prototype starts with the <span class=
+      "Flag"><span style='font-size:10.0pt'>protoprarmprefix</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>proto-param-name</span></span></p>
+<p class="IndentText">A parameter in a function prototype has a
+name (can interfere with macro definitions).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>proto-param-match</span></span></p>
+<p class="IndentText">The name of a parameter in a function
+definition does not match the corresponding name of the parameter
+in a function prototype (after removing the <span class=
+"Flag"><span style=
+'font-size:10.0pt'>protoparamprefix</span></span>).</p>
+<p class="Heading10">Naming Restrictions <span style=
+'font-size:10.5pt; font-weight:normal'>(Section 12.3)</span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>shadow</span></span></p>
+<p class="IndentText">Declaration reuses name visible in outer
+scope.</p>
+<p class="Heading11">Reserved Names</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ansi-reserved</span></span></p>
+<p class="IndentText">External name conflicts with name reserved
+for the compiler or standard library.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ansi-reserved-internal</span></span></p>
+<p class="IndentText">&nbsp;Internal name conflicts with name
+reserved for the compiler or standard library.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iso-reserved</span></span></p>
+<p class="IndentText">
+External name is reserved for system use by ISO C99 standard.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iso-reserved-internal</span></span></p>
+<p class="IndentText">
+Internal name is reserved for system in ISO C99 standard (this should not be necessary unless you are worried about C library implementations that violate the standard and use  macros).
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>cpp-names</span></span></p>
+<p class="IndentText">Internal or external name conflicts with a
+C++ reserved word.&nbsp; (Will cause problems if program is
+compiled with a C++ compiler.)</p>
+<p class="Heading11">Distinct External Names</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>distinct-external-names</span></span></p>
+<p class="IndentText">An external name is not distinguishable from
+another external name using <span class="Flag"><span style=
+'font-size:10.0pt'>externalnamelen</span></span><i>&nbsp;</i>significant
+characters.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P: 6</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>external-name-len</span></span><span class="Flag">
+<span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Sets the number of significant characters in
+an external name (ANSI default minimum is 6).&nbsp; Sets
+<span class="Flag"><span style=
+'font-size:10.0pt'>+distinct-external-names</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>external-name-case-insensitive</span></span></p>
+<p class="IndentText">Make alphabetic case insignificant in
+external names.&nbsp; According to ANSI standard, case need not be
+significant in an external name.&nbsp; If <span class=
+"Flag"><span style=
+'font-size:10.0pt'>+distinct-external-names</span></span>&nbsp;is
+not set, sets <span class="Flag"><span style=
+'font-size:10.0pt'>+distinct-external-names</span></span> with
+unlimited external name length.</p>
+<p class="Heading11">Distinct Internal Names</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>distinct-internal-names</span></span></p>
+<p class="IndentText">An internal name is not distinguishable from
+another internal name using <span class="Flag"><span style=
+'font-size:10.0pt'>internalnamelen</span></span>&nbsp;significant
+characters.&nbsp;&nbsp; (Also effected by <span class=
+"Flag"><span style=
+'font-size:10.0pt'>internal-name-case-insensitive</span></span>&nbsp;and
+<span class="Flag"><span style=
+'font-size:10.0pt'>internal-name-lookalike</span></span>.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
+'font-size:10.0pt'>31</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>internal-name-len</span></span><span class="Flag">
+<span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Set the number of significant characters in
+an internal name. Sets <span class="Flag"><span style=
+'font-size:10.0pt'>+distinct-internal-names</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>internal-name-case-insensitive</span></span></p>
+<p class="IndentText">Set whether case is significant an internal
+names (<span class="Flag"><span style=
+'font-size:10.0pt'>-internal-name-case-insensitive</span></span>&nbsp;means
+case is significant).&nbsp; If <span class=
+      "Flag"><span style='font-size:10.0pt'>+distinct-internal-names</span></span>&nbsp;is
+      not set, sets <span class="Flag"><span style=
+      'font-size:10.0pt'>+distinct-internal-names</span></span>
+      with unlimited internal name length.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>internal-name-lookalike</span></span></p>
+<p class="IndentText">&nbsp;Set whether similar looking characters
+(e.g., &#8220;<span class="Keyword"><span style=
+'font-size:10.0pt'>1</span></span>&#8221; and
+      &#8220;<span class="Keyword"><span style=
+      'font-size:10.0pt'>l</span></span>&#8221;) match in internal
+      names.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+Control Flow <span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+8)</span></span></p>
+<p class="Heading10">Undefined Evaluation Order <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>8.2</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="Heading10" style='margin:0in;margin-bottom:.0001pt'>
+<span class="Flag"><span style=
+'font-size:10.0pt;font-weight:normal'>eval-order</span></span></p>
+<p class="IndentText">Behavior of an expression is unspecified or
+implementation-dependent because sub-expressions contain
+interfering side effects that may be evaluated in any order.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>eval-order-uncon</span></span></p>
+<p class="IndentText">An expression may be undefined because a
+sub-expression contains a call to an unconstrained function (no
+modifies clause) that may modify something that may be modified or
+used by another sub-expression.</p>
+<p class="Heading10">Problematic Control Structures
+      <span class="HeadingNote"><span style=
+      'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+      <span class="HeadingNote"><span style=
+      'font-size:10.5pt;font-weight:normal;font-style: normal'>8.3</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>inf-loops</span></span></p>
+<p class="IndentText">Likely infinite loop is detected (Section
+8.3.1).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>inf-loops-uncon</span></span></p>
+<p class="IndentText">Likely infinite loop is detected.&nbsp; Loop
+test or body calls an unconstrained function that may produce an
+undetected modification.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>elseif-complete</span></span></p>
+<p class="IndentText">There is no finals else following an else if
+construct (Section 8.3.5).</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>case-break</span></span></p>
+<p class="IndentText">There is a non-empty case in a switch not
+followed by a <span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span><span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-style:normal'>8.3.2</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt;font-style:normal'>).</span></span></p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>first-case</span></span></p>
+<p class="IndentText">
+The first statement after a switch is not a case.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>Duplicate-case</span></span></p>
+<p class="IndentText">
+Duplicate cases in switch.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>miss-case</span></span></p>
+<p class="IndentText">A switch on an <span class=
+"CodeText"><span style='font-size: 10.0pt'>enum</span></span> type
+is missing a case for a member of the enumerator.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>emptyreturn
+</span></span></p>
+<p class="IndentText">Empty return in function declared to return value.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>alwaysexits
+</span></span></p>
+<p class="IndentText">
+Loop predicate always exits. 
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span><span class=
+      "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>loop-exec</span></span></p>
+<p class="IndentText">Assume all loops execute at least once.&nbsp;
+This effects use-before-definition&nbsp;and memory checking.&nbsp;
+It should probably not be used globally, but may be used
+surrounding a particular loop that is known to always execute to
+prevent spurious messages.
+ (sets
+<span class="Flag"><span style=
+'font-size:10.0pt'>
+ for-loop-exec, while-loop-exec and iter-loop-exec
+</span></span>
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>for-loop-exec
+</span></span></p>
+<p class="IndentText">
+Assume all<span class=
+"CodeText"><span style='font-size: 10.0pt'>
+for
+</span></span>
+ loops execute at least once.  This effects use-before-definition
+and memory checking.  It should probably not be used globally, but may be used
+surrounding a particular loop that is known to always execute to prevent spurious messages.
+</p>
+
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>while-loop-exec
+</span></span></p>
+<p class="IndentText">
+Assume all<span class=
+"CodeText"><span style='font-size: 10.0pt'>
+while
+</span></span>
+ loops execute at least once.  This effects use-before-definition
+and memory checking.  It should probably not be used globally, but may be used
+surrounding a particular loop that is known to always execute to prevent spurious messages.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iter-loop-exec
+</span></span></p>
+<p class="IndentText">
+Assume all<span class=
+"CodeText"><span style='font-size: 10.0pt'>
+iter
+</span></span>
+ loops execute at least once.  This effects use-before-definition
+and memory checking.  It should probably not be used globally, but may be used
+surrounding a particular loop that is known to always execute to prevent spurious messages.
+</p>
+
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>obvious-loop-exec
+</span></span></p>
+<p class="IndentText">
+Assume loop that can be determined to always execute always does.
+</p>
+
+<p class="Heading10">Deep Break <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section</span></span>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>8.3.3</span></span><span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>deep-break</span></span></p>
+<p class="IndentText">Report errors for <span class=
+"CodeText"><span style='font-size:10.0pt'>break</span></span>
+statements inside a nested <span class=
+      "CodeText"><span style='font-size:10.0pt'>while</span></span>,
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>for</span></span> or <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>switch</span></span>.&nbsp; (Sets all
+      nested break and continue flags.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="MsoListBullet"><span class="Flag"><span style=
+'font-size:10.0pt'>loop-loop-break</span></span></p>
+<p class="IndentText"><span class="TextFontCXChar">There is
+a</span> <span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> inside a <span class=
+"CodeText"><span style='font-size:10.0pt'>while</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>for</span></span> or iterator loop that is
+inside a <span class="CodeText"><span style=
+'font-size: 10.0pt'>while</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>for</span></span> or
+iterator loop. Mark with <span class="Annot"><span style=
+'font-size:10.0pt'>/*@innerbreak@*/</span></span> to suppress the
+message.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="MsoListBullet"><span class="Flag"><span style=
+'font-size:10.0pt'>switch-loop-break</span></span></p>
+<p class="IndentText"><span class="TextFontCXChar">There is
+a</span><span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> inside a <span class=
+"CodeText"><span style='font-size:10.0pt'>while</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>for</span></span> or iterator loop that is
+inside a <span class="CodeText"><span style=
+'font-size: 10.0pt'>switch</span></span> statement.&nbsp; Mark with
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="MsoListBullet"><span class="Flag"><span style=
+'font-size:10.0pt'>loop-switch-break</span></span></p>
+<p class="IndentText"><span class="TextFontCXChar">There is
+a</span><span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> inside a <span class=
+"CodeText"><span style='font-size:10.0pt'>switch</span></span>
+statement that is inside a <span class=
+      "CodeText"><span style='font-size:10.0pt'>while</span></span>,
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>for</span></span> or iterator loop.&nbsp;
+      Mark with /<span class="Annot"><span style=
+      'font-size:10.0pt'>*@switchbreak@*/</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
+<span class="Flag"><span style=
+'font-size:10.0pt'>switch-switch-break</span></span></p>
+<p class="IndentText"><span class="TextFontCXChar">There is
+a</span><span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> inside a <span class=
+"CodeText"><span style='font-size:10.0pt'>switch</span></span>
+statement that is inside another <span class=
+      "CodeText"><span style='font-size: 10.0pt'>switch</span></span>
+      statement.&nbsp; Mark with <span class="Annot"><span style=
+      'font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>loop-loop-continue</span></span></p>
+<p class="IndentText">There is a <span class=
+      "CodeText"><span style='font-size: 10.0pt'>continue</span></span>
+      inside a while, for or iterator loop that is inside a while,
+      for or iterator loop.&nbsp; Mark with <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>/*@innercontinue@*/</span></span>.</p>
+<p class="Heading10">Loop and if Bodies <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+8.3.4)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>all-empty</span></span></p>
+<p class="IndentText">An if, while or for statement has no body
+(sets <span class="Flag"><span style=
+'font-size:10.0pt'>if-empty</span></span>, <span class=
+"Flag"><span style=
+'font-size:10.0pt'>while-empty</span></span>&nbsp;and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>for-empty</span></span>.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>all-block</span></span></p>
+<p class="IndentText">The body of an <span class=
+"CodeText"><span style='font-size: 10.0pt'>if</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>while</span></span> or <span class=
+"CodeText"><span style='font-size:10.0pt'>for</span></span>
+statement is not a block (sets <span class=
+      "Flag"><span style='font-size:10.0pt'>if-block</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>while-block</span></span>&nbsp;and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>for-block</span></span>.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>while-empty</span></span></p>
+<p class="IndentText">A while statement has no body.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>while-block</span></span></p>
+<p class="IndentText">&nbsp;The body of a <span class=
+"CodeText"><span style='font-size: 10.0pt'>while</span></span>
+statement is not a block</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>for-empty</span></span></p>
+<p class="IndentText">A <span class="CodeText"><span style=
+'font-size:10.0pt'>for</span></span> statement has no body.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>for-block</span></span></p>
+<p class="IndentText">The body of a <span class=
+"CodeText"><span style='font-size: 10.0pt'>for</span></span>
+statement is not a block.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>if-empty</span></span></p>
+<p class="IndentText">An <span class="CodeText"><span style=
+'font-size:10.0pt'>if</span></span> statement has no body.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ifblock</span></span></p>
+<p class="IndentText">The body of an <span class=
+"CodeText"><span style='font-size: 10.0pt'>if</span></span>
+statement is not a block.</p>
+<p class="Heading10">Suspicious Statements <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+8.4)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unreachable</span></span></p>
+<p class="IndentText">Code is not reached on any possible
+execution.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>noeffect</span></span></p>
+<p class="IndentText">Statement has no effect.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>noeffect-uncon</span></span></p>
+<p class="IndentText">Statement involving call to unconstrained
+function may have no effect.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>noret</span></span></p>
+<p class="IndentText">There is a path with no <span class=
+"Keyword"><span style='font-size:10.0pt'>return</span></span> in a
+function declared to return a non-<span class=
+      "Keyword"><span style='font-size:10.0pt'>void</span></span>
+      value.</p>
+<p class="Heading10">Ignored Return Values <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section</span></span>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>8.4.2</span></span><span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<p class="beforelist">These flags control when errors are reported
+for function calls that do not use the return value.&nbsp; Casting
+the function call to <span class="CodeText"><span style=
+'font-size:10.0pt'>void</span></span> or declaring the called
+function to return <span class="Annot"><span style=
+'font-size:10.0pt'>/*@alt void@*/</span></span>.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ret-val-bool</span></span></p>
+<p class="IndentText">Return value of type <span class=
+"CodeText"><span style='font-size:10.0pt'>bool</span></span>
+ignored.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ret-val-int</span></span></p>
+<p class="IndentText">Return value of type <span class=
+"CodeText"><span style='font-size:10.0pt'>int</span></span>
+ignored.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ret-val-other</span></span></p>
+<p class="IndentText">Return value of type other than
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>bool</span></span>&nbsp;or <span class=
+      "CodeText"><span style='font-size:10.0pt'>int</span></span>
+      ignored.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ret-val</span></span></p>
+<p class="IndentText">Return value ignored (Sets <span class=
+"Flag"><span style='font-size:10.0pt'>retvalbool</span></span>,
+<span class="Flag"><span style=
+'font-size:10.0pt'>retvalint</span></span>, <span class=
+"Flag"><span style=
+'font-size:10.0pt'>retvalother</span></span>.)</p>
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+Memory Bounds <span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>9</span></span>)
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>bounds</span></span></p>
+<p class="IndentText">
+Memory read or write may be out of bounds of allocated storage
+(sets <span class=
+"Flag"><span style='font-size:10.0pt'>boundsread</span></span>
+and
+<span class="Flag"><span style=
+'font-size:10.0pt'>boundswrite</span></span>
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag"><span style=
+            'font-size:10.0pt'>boundsread</span></span></p>
+            <p class="IndentText">
+            A memory read references memory beyond the allocated storage
+            (also sets <span class=
+            "Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>.
+            </p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag"><span style=
+            'font-size:10.0pt'>boundswrite</span></span></p>
+            <p class="IndentText">
+            A memory write may write to an address beyond the allocated buffer
+            (also sets <span class=
+            "Flag"><span style='font-size:10.0pt'>likelyboundswrite</span></span>.
+            </p>
+            
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>likelybounds</span></span></p>
+<p class="IndentText">
+Likely memory read or write is likely to be out of bounds of allocated storage
+(sets <span class=
+"Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>
+and
+<span class="Flag"><span style=
+'font-size:10.0pt'>likelyboundswrite)</span></span>
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag"><span style=
+            'font-size:10.0pt'>likelyboundsread</span></span></p>
+            <p class="IndentText">
+            A likely memory read references memory beyond the allocated storage
+            (also sets <span class=
+            "Flag"><span style='font-size:10.0pt'>likelyboundsread</span></span>.
+            </p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag"><span style=
+            'font-size:10.0pt'>likelyboundswrite</span></span></p>
+            <p class="IndentText">
+            A memory write is likely to write to an address beyond the allocated buffer.
+           </p>
+            
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">fcnpost<span style=
+            'font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+            Display function post conditions.
+            </p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">redundantconstraints<span style=
+            'font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+            Display seemingly redundant conditions.
+            </p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">checkpost<span style=
+            'font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+            The functions implementation may not satidfy a post condition given in an ensures clause.
+           </p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>P-</span><span class=
+             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">showconstraintparens<span style=
+            'font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+Display parentheses around constraint terms.
+           </p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>P+</span><span class=
+             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">showconstraintlocation<span style=
+            'font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+Display location for every constraint generated.
+           </p>
+<br>
+<p class="beforelist">     
+The following flags are mainly of interest to Splint developers.  The default values are adequate in normal use.  They are included for completeness.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>P-</span><span class=
+             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">
+debugfcnconstraint
+<span style='font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+Perform buffer overflow checking even if the errors would be inhibited.
+           </p>
+
+           
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>P-</span><span class=
+             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">
+implictconstraints
+<span style='font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+Generate implicit constraints for functions.&nbsp;  This is an experimental option.&nbsp; 
+Currently this option reduces the number of bounds errors but causes real error to be missed. 
+           </p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>P-</span><span class=
+             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">
+orconstraint
+<span style='font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+This flags affects the internal constraint resolution.&nbsp  If set, the internal constraint resolution is more accurate.&nbsp The performance impact is minimal so there is little reason not to have this flag set.</p>
+
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+Extensible Checking <span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>13</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>P-</span><span class=
+             "Keyword"><span style='font-size:10.0pt'></span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">
+mts &ltfilename&gt
+<span style='font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+Load meta state declaration and corresponding xh file.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">
+statetransfer
+<span style='font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+Transfer violates user-defined state rules.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+       <tr>
+       <td valign="top" align="left" height="14" style=
+       'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+       <p class="TextFontCX" align="center" style=
+       'text-align:center;background:#CCCCCC'><span style=
+       'font-size:10.0pt'>m:</span><span class=
+             "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+            <p class="TextFontCX"><span class="Flag">
+statemerge
+<span style='font-size:10.0pt'></span></span></p>
+            <p class="IndentText">
+Control path merge violates user-defined state merge rules. 
+</p>
+           
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+Completeness <span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>13</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
+<p class="Heading10">Unused Declarations <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>13.1</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
+<p class="beforelist">These flags control when errors are reported
+for declarations that are never used.&nbsp; The <span class=
+"Annot"><span style='font-size:10.0pt'>unused</span></span>
+annotation can be used to prevent unused errors from being report
+for a particular declaration.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>top-use</span></span></p>
+<p class="IndentText">An external declaration is not used in any
+file.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>const-use</span></span></p>
+<p class="IndentText">Constant never used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>enum-mem-use</span></span></p>
+<p class="IndentText">Member of enumerator never used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>var-use</span></span></p>
+<p class="IndentText">Variable never used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>param-use</span></span></p>
+<p class="IndentText">Function parameter never used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>fcn-use</span></span></p>
+<p class="IndentText">Function is never used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>++++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>type-use</span></span></p>
+<p class="IndentText">Defined type never used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>field-use</span></span></p>
+<p class="IndentText">Field of structure or union type is never
+used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unused-special</span></span></p>
+<p class="IndentText">Declaration in a special file (corresponding
+to <span class="ProgramNameChar">.l</span> or <span class=
+"ProgramNameChar">.y</span> file) is unused.</p>
+<p class="Heading10">Complete Programs <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+13.2)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>decl-undef</span></span></p>
+<p class="IndentText">Function, variable, iterator or constant
+declared but never defined.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>partial</span></span></p>
+<p class="IndentText">Check as partial system (sets
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>-decl-undef</span></span>, <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>-export-local</span></span>&nbsp;and
+      prevents checking of macros in headers without corresponding
+      <span class="ProgramNameChar">.c</span> files.)</p>
+<p class="Heading10">Exports</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-local</span></span></p>
+<p class="IndentText">A declaration is exported but not used
+outside this module.&nbsp; (Declaration can use the
+      <span class="CodeText"><span style=
+      'font-size: 10.0pt'>static</span></span> qualifier.)</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-header</span></span></p>
+<p class="IndentText">A declaration (other than a variable) is
+exported but does not appear in a header file.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-header-var</span></span></p>
+<p class="IndentText">A variable declaration is exported but does
+not appear in a header file.</p>
+<p class="Heading10">Unrecognized Identifiers</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unrecog</span></span></p>
+<p class="IndentText">An unrecognized identifier is used.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sys-unrecog</span></span></p>
+<p class="IndentText">Report unrecognized identifiers that start
+with the system prefix, <span class="Keyword"><span style=
+'font-size:10.0pt'>__</span></span> (two underscores).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>repeat-unrecog</span></span></p>
+<p class="IndentText">Report multiple messages for unrecognized
+identifiers.&nbsp; If <span class="Flag"><span style=
+'font-size:10.0pt'>repeatunrecog</span></span> is not set, an error
+is reported only the first time a particular unrecognized
+identifier appears in the file.</p>
+<p class="Heading10">Multiple Definition and Declarations</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>redef</span></span></p>
+<p class="IndentText">A function or variable is defined more than
+once.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>redecl</span></span></p>
+<p class="IndentText">An identifier is declared more than once.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>nested-extern</span></span></p>
+<p class="IndentText">An <span class="Keyword"><span style=
+'font-size:10.0pt'>extern</span></span> declaration is used inside
+a function body.</p>
+<p class="Heading10">ISO Conformance</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>noparams</span></span></p>
+<p class="IndentText">A function is declared without a parameter
+list prototype.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>old-style</span></span></p>
+<p class="IndentText">Function definition is in old style
+syntax.&nbsp; Standard prototype syntax is preferred.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>exit-arg</span></span></p>
+<p class="IndentText">Argument to <span class=
+"CodeText"><span style=
+'font-size: 10.0pt'>exit</span></span>&nbsp;has implementation
+defined behavior.&nbsp; The only valid arguments to
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>exit</span></span> are <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>EXIT_SUCCESS</span></span>, <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>EXIT_FAILURE</span></span> and
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>0</span></span>.&nbsp; An error is
+      reported if Splint can determine statically that the argument
+      to <span class="CodeText"><span style=
+      'font-size:10.0pt'>exit</span></span> is not one of
+      these.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>use-varargs</span></span></p>
+<p class="IndentText">Report if <span class=
+      "CodeText"><span style='font-size:10.0pt'>&lt;varargs.h&gt;</span></span>
+      is used (should use <span class=
+      "ProgramNameChar"><span style='font-size:10.0pt'>stdarg.h</span></span>).</p>
+<p class="Heading10">Limits</p>
+<p class="beforelist">The ANSI Standard includes limits on minimum
+numbers that a conforming compiler must support.&nbsp; Whether of
+not a particular compiler exceeds these limits, it is worth
+checking that a program does not exceed them so that other
+compilers may safely compile it.&nbsp; In addition, exceeding a
+limit may indicate a problem in the code (e.g., it is too complex
+if the control nest depth limit is exceeded) that should be fixed
+regardless of the compiler.&nbsp; Splint checks the following
+limits.&nbsp; For each limit, the maximum value may be set from the
+command line (or locally using a stylized comment).&nbsp; The
+minimum limits were increased for the ISO C99 specification.&nbsp;
+If the <span class="Flag"><span style=
+'font-size:10.0pt'>iso99-limits</span></span> flag is used, all
+limits are checked with the minimum values of an ISO C99 conforming
+compiler.&nbsp; If the <span class="Flag"><span style=
+'font-size:10.0pt'>ansi89-limits</span></span> flag is used, all
+limits are checked with the minimum values of an ANSI C89
+conforming compiler.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ansi89-limits</span></span></p>
+<p class="IndentText">Check for violations of minimum limits
+prescribed by ANSI C89 standard (sets <span class=
+"Flag"><span style=
+'font-size:10.0pt'>control-nest-depth</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>string-literal-len</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>include-nest</span></span>, <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>num-struct-fields</span></span>, and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>num-enum-members</span></span>).</p>
+ <div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>iso99-limits</span></span></p>
+<p class="IndentText">Check for violations of minimum limits
+prescribed by ISO C99 standard (sets <span class=
+"Flag"><span style=
+'font-size:10.0pt'>control-nest-depth</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>string-literal-len</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>include-nest</span></span>, <span class=
+      "Flag"><span style=
+      'font-size:10.0pt'>num-struct-fields</span></span>, and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>num-enum-members</span></span>).</p>
+           
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>control-nest-depth</span></span><span class="Flag">
+<span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Set maximum nesting depth of compound
+statements, iteration control structures, and selection control
+structures (ISO C99 minimum is 63; ANSI C89 minimum is 15).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>string-literal-len</span></span><span class="Flag">
+<span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Set maximum length of string literals (ISO
+C99 minimum is 4095; ANSI C89 minimum is 509).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>num-struct-fields</span></span><span class="Flag">
+<span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Set maximum number of fields in a
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>struct</span></span> or <span class=
+      "CodeText"><span style='font-size:10.0pt'>union</span></span>
+      (ISO C99 minimum is 1023; ANSI minimum is 127).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>num-enum-members</span></span><span class=
+"Flag"><span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Set maximum number of members of an
+<span class="CodeText"><span style=
+'font-size:10.0pt'>enum</span></span> type (ISO C99 minimum is
+1023; ANSI minimum is 127).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>--++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>include-nest</span></span><span class=
+"Flag"><span style=
+'font-size:10.0pt'>&nbsp;<i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Set maximum number of nested
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>#include</span></span> files (ISO C99
+      minimum is 63; ANSI minimum is 8).</p>
+<p class="Heading10">Header Inclusion <a name=
+"_Ref344793948"><span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section</span></span></a>
+<span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>14.3</span></span><span class="TextFontCXChar">
+<span style=
+'font-size:11.0pt; font-weight:normal'>)</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>skip-ansi-headers</span></span></p>
+<p class="IndentText">Prevent inclusion of header files in a system
+directory with names that match standard ANSI headers. The
+symbolic information in the standard library is used instead.&nbsp;
+Flag in effect only if a library that includes the standard library is
+used.&nbsp; The ANSI headers are: <span class=
+"CodeText"><span style='font-size:10.0pt'>assert</span></span>,
+<span class=
+"CodeText"><span style='font-size:10.0pt'>ctype</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>errno</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>float</span></span>,
+<span class=
+"CodeText"><span style='font-size:10.0pt'>limits</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>locale</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>math</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>setjmp</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>signal</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>stdarg</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>stddef</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>stdio</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>stdlib</span></span>,
+<span class=
+"CodeText"><span style='font-size:10.0pt'>strings</span></span>,
+<span class=
+"CodeText"><span style='font-size:10.0pt'>string</span></span>,
+ <span class=
+"CodeText"><span style='font-size:10.0pt'>time</span></span>,
+and <span class="CodeText"><span style=
+'font-size:10.0pt'>wchar</span></span>.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>skip-iso-headers</span></span></p>
+<p class="IndentText">Prevent inclusion of header files in a system
+directory with names that match standard ISO C99 headers. The
+symbolic information in the standard library is used instead.&nbsp;
+In effect only if a library that includes the standard library is
+used.&nbsp; The ISO C99 headers are: <span class=
+"CodeText"><span style='font-size:10.0pt'>assert</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>complex</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>ctype</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>errno</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>fenv</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>float</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>inttypes</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>iso646</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>limits</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>locale</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>math</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>setjmp</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>signal</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>stdarg</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>stdbool</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>stddef</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>stdio</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>stdlib</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>string</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>tgmath</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>time</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>wchar</span></span>, and <span class=
+"CodeText"><span style='font-size:10.0pt'>wctype</span></span>.</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>skip-posix-headers</span></span></p>
+<p class="IndentText">Prevent inclusion of header files in a system
+directory with names that match standard POSIX headers. The
+symbolic information in the standard library is used instead.&nbsp;
+In effect only if a library that includes the POSIX library is
+used.&nbsp; The skipped POSIX headers are: <span class=
+"CodeText"><span style='font-size:10.0pt'>dirent</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>fcntl</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>grp</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>pwd</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>termios</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>sys/stat</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>sys/times</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>sys/types</span></span>, <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>sys/utsname</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>sys/wait</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>unistd</span></span>, and <span class=
+"CodeText"><span style='font-size:10.0pt'>utime</span></span>.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>warn-posix-headers</span></span></p>
+<p class="IndentText">Report use of a POSIX header when checking a
+program with a non-POSIX library.</p>
+<p class="IndentText">&nbsp;</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>warn-unix-headers</span></span></p>
+<p class="IndentText">
+Warn the user that the unix library may not be compatible with all platforms.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>skip-sys-headers</span></span></p>
+<p class="IndentText">Prevent inclusion of all header files in
+system directories.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sys-dir-expand-macros</span></span></p>
+<p class="IndentText">Expand macros in system directories
+regardless of other settings, except for macros corresponding to
+names defined in a load library.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sys-dir-errors</span></span></p>
+<p class="IndentText">Report errors in files in system directories
+(set by <span class="Flag"><span style=
+'font-size:10.0pt'>-sys-dirs</span></span>).&nbsp;&nbsp;</p>
+<p class="IndentText"><span class="HeadingNote"><span style=
+'font-size:10.5pt; font-style:normal'>&nbsp;</span></span></p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+warn-sys-files
+</span></span></p>
+<p class="IndentText">
+Warn when a system file was listed as a command line file but Splint
+is not set to report errors for system files.  This prevents accidentally missing warnings
+in system files when Splint is run in a system directory.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>global:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>single-include</span></span></p>
+<p class="IndentText">Optimize header inclusion to only include
+each header file once.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>global:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>never-include</span></span></p>
+<p class="IndentText">Use library information instead of including
+header files.</p>
+<p class="Heading10">Comments</p>
+<p class="beforelist">These flags control how syntactic comments
+are interpreted.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class="Flag"><span style=
+'font-size:10.0pt'>@</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>comment-char</span></span> <span class=
+"Flag"><i><span style=
+'font-size:10.0pt'>&lt;char&gt;</span></i></span></p>
+<p class="IndentText">Set the marker character for syntactic
+comments.&nbsp; Comments beginning with <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>/*</span></span><span class=
+"Flag"><i><span style=
+'font-size:10.0pt'>&lt;char&gt;</span></i></span> are interpreted
+by Splint.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>noaccess</span></span></p>
+<p class="IndentText">Ignore access comments.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>nocomments</span></span></p>
+<p class="IndentText">Ignore all stylized comments.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>sup-counts</span></span></p>
+<p class="IndentText">Actual number of errors does not match number
+in <span class="Annot"><span style=
+'font-size:10.0pt'>/*@i</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt'>&lt;n&gt;@*/</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>lint-comments</span></span></p>
+<p class="IndentText">Interpret traditional lint comments
+(<span class="CodeText"><span style=
+'font-size:10.0pt'>/*FALLTHROUGH*/</span></span>,
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>/*NOTREACHED*/</span></span>, <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>/*PRINTFLIKE*/</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>warn-lint-comments</span></span></p>
+<p class="IndentText">Print a warning and suggest an alternative
+when a traditional lint comment is used. &nbsp;&nbsp;</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>unrecog-comments</span></span></p>
+<p class="IndentText">Stylized comment is unrecognized.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>annotationerror
+</span></span></p>
+<p class="IndentText">
+A declaration uses an invalid annotation.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>commenterror
+</span></span></p>
+<p class="IndentText">
+A syntactic comment is used inconsistently.
+</p>
+
+<p class="Heading10">Parsing</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>continue-comment</span></span></p>
+<p class="IndentText">A line continuation marker
+      (<span class="CodeText"><span style=
+      'font-size:10.0pt'>\</span></span>) appears inside a comment
+      on the same line as the comment close. Preprocessors should
+      handle this correctly, but it causes problems for some
+      preprocessors.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>nest-comment</span></span></p>
+<p class="IndentText">A comment open sequence (<span class=
+"CodeText"><span style='font-size:10.0pt'>/*</span></span>) appears
+inside a comment.&nbsp; This usually indicates that an earlier
+comment was not closed.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>slashslashcomment</span></span></p>
+<p class="IndentText">A
+<span class=
+"CodeText"><span style='font-size:10.0pt'>//</span></span>
+comment is used.&nbsp ISO C99 allows
+<span class=
+"CodeText"><span style='font-size:10.0pt'>//</span></span>
+comments, but earlier standards did not.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P: +</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>duplicate-quals</span></span></p>
+<p class="IndentText">Report duplicate type qualifiers (e.g.,
+<span class="CodeText"><span style='font-size:10.0pt'>unsigned
+unsigned</span></span>).</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>gnu-extensions</span></span></p>
+<p class="IndentText">Support some GNU and Microsoft language
+extensions.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>syntax</span></span></p>
+<p class="IndentText">Parse error.</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>try-to-recover</span></span></p>
+<p class="IndentText">Try to recover from a parse error.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>trytorecover</span></span> is not set, Splint
+will abort checking after a parse error is detected.&nbsp; If it is
+set, Splint will attempt to recover, but Splint does performs only
+minimal error recovery.&nbsp; It is likely that trying to recover
+after a parse error will lead to an internal assertion failing.</p>
+
+
+<p class="Heading10">Warn use</p>
+       
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+bufferoverflow
+</span></span></p>
+<p class="IndentText">
+Use of function that may lead to buffer overflow.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>++++
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+bufferoverflowhigh
+</span></span></p>
+<p class="IndentText">
+Use of function that may lead to buffer overflow.
+</p>
+
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>--++
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+implementationoptional
+</span></span></p>
+<p class="IndentText">
+Use of a declarator that is implementation optional, not required by ISO99.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>--++
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+multithreaded
+</span></span></p>
+<p class="IndentText">
+Non-reentrant function should not be used in multithreaded code.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>--++
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+portability
+</span></span></p>
+<p class="IndentText">
+Use of function that may have implementation-dependent behavior.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>--++
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+superuser
+</span></span></p>
+<p class="IndentText">
+Call to function restricted to superusers.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>---+
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+toctou
+</span></span></p>
+<p class="IndentText">
+Possible time of check, time of use vulnerability.
+</p>
+
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>----
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+unixstandard
+</span></span></p>
+<p class="IndentText">
+Use of function that need not be provided by UNIX implementations
+</p>
+
+<p class="Heading10">ITS4 compatibility flags</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+its4mostrisky
+</span></span></p>
+<p class="IndentText">
+Security vulnerability classified as most risky in its4 database.
+</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+its4veryrisky
+</span></span></p>
+<p class="IndentText">
+Security vulnerability classified as very risky in its4 database.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+its4risky
+</span></span></p>
+<p class="IndentText">
+Security vulnerability classified as risky in its4 database.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+its4moderate
+</span></span></p>
+<p class="IndentText">
+Security vulnerability classified as moderate risk in its4 database.
+</p>
+
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+its4low
+</span></span></p>
+<p class="IndentText">
+Security vulnerability classified as risky in its4 database.
+</p>
+
+<p class="Heading10">Debug flags</p>
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>3
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+bugslimit
+</span></span></p>
+<p class="IndentText">
+Set maximum number of bugs detected before giving up.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>----
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+debugfcnconstraint
+</span></span></p>
+<p class="IndentText">
+Perform buffer overflow checking even if the errors would be surpressed. 
+</p>
+
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+grammar
+</span></span></p>
+<p class="IndentText">
+Debug parsing.  Prints bison generated debuging information.
+</p>
+
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+keep
+</span></span></p>
+<p class="IndentText">
+Do not delete temporary files.
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+nopp
+</span></span></p>
+<p class="IndentText">
+Do not pre-process input files. 
+</p>
+
+
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-
+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>
+showsourceloc
+</span></span></p>
+<p class="IndentText">
+Display the source code location where a warning is produced. 
+</p>
+
+
+
+
+<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975062"></a><a name="_Ref348845752">Appendix
+C<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="annotations" name="annotations">
+Annotations</a></a></p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975063"></a><a name="_Ref348010146">Suppressin</a>g
+Warnings</p>
+<p class="beforelist">Several annotations are provided for
+suppressing messages.&nbsp; In general, it is usually better to use
+specific flags to suppress a particular error permanently, but the
+general error suppression flags may be more convenient for quickly
+suppressing messages for code that will be corrected or documented
+later.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>ignore</span></span></p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>end</span></span></p>
+<p class="IndentText">No errors will be reported in code regions
+between <span class="Annot"><span style=
+'font-size:10.0pt'>/*@ignore@*/</span></span> and
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>/*@end@*/</span></span>.&nbsp; These
+      comments can be used to easily suppress an unlimited number
+      of messages, but are dangerous since if real errors are
+      introduced in the <span class="Flag"><span style=
+      'font-size:10.0pt'>ignore</span></span>&#8230;<span class=
+      "Flag"><span style='font-size:10.0pt'>end</span></span>
+      region they will not be reported. The <span class=
+      "Annot"><span style='font-size:10.0pt'>ignore</span></span>
+      and <span class="Annot"><span style=
+      'font-size:10.0pt'>end</span></span> comments must be matched
+      &#8212; a warning is printed if the file ends in an ignore
+      region or if <span class="Flag"><span style=
+      'font-size:10.0pt'>ignore</span></span> is used inside ignore
+      region.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>i</span></span></p>
+<p class="IndentText">No errors will be reported from an
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*@i@*/</span></span> comment to the end of the
+line.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>i</span></span><span class=
+      "Flag"><span style='font-size:10.0pt'><i>&lt;n&gt;</i></span></span></p>
+<p class="IndentText">No errors will be reported from an
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*@i<i>&lt;n&gt;</i>@*/</span></span> (e.g.,
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*@i3@*/</span></span>) comment to the end of
+the line.&nbsp; If there are not exactly <i>n</i> errors suppressed
+from the comment point to the end of the line, Splint will report
+an error.&nbsp; This is more robust than <span class=
+"Annot"><span style='font-size:10.0pt'>i</span></span> or
+<span class="Annot"><span style=
+'font-size:10.0pt'>ignore</span></span> since a message is
+generated if the expected number errors is not present.&nbsp; Since
+errors are not necessarily detected until after this file is
+processed (for example, and unused variable error), suppress count
+errors are reported after all files have been processed. &nbsp;The
+<span class="Flag"><span style=
+'font-size: 10.0pt'>&#8209;supcounts</span></span> flag may be used
+to suppress these errors.&nbsp; This is useful when a system if
+being rechecked with different flag settings.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>t</span></span></p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>t<i>&lt;n&gt;</i></span></span></p>
+<p class="IndentText">Like <span class="Annot"><span style=
+'font-size:10.0pt'>i</span></span> and <span class=
+"Annot"><span style=
+'font-size:10.0pt'>i<i>&lt;n&gt;</i></span></span>, except
+controlled by <span class="Flag"><span style=
+'font-size:10.0pt'>+tmpcomments</span></span> flag.&nbsp; These can
+be used to temporarily suppress certain errors.&nbsp; Then,
+<span class="Flag"><span style=
+'font-size:10.0pt'>-tmpcomments</span></span> can be set to find
+them again.</p>
+<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975064">Syntactic Annotations</a></p>
+<p class="TextFontCX">The grammar below is the C syntax from
+[K&amp;R,A13] modified to show the syntax of syntactic
+comments.&nbsp; Only productions effected by Splint annotations are
+shown.&nbsp; In the annotations, the <span class=
+"Annot"><span style='font-size:10.0pt'>@</span></span> represents
+the comment marker char, set by <span class=
+      "Flag"><span style='font-size:10.0pt'>-commentchar</span></span>&nbsp;(default
+      is <span class="Annot"><span style=
+      'font-size:10.0pt'>@</span></span>).</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975065">Functions</a></p>
+<p class="TextFontCX"><i>direct-declarator</i> <span style=
+'font-family:Symbol'>&#222;</span></p>
+<p class="TextFontCX" style='text-indent:.5in'><i>&nbsp;&nbsp;
+direct-declarator</i> <span class="Annot"><span style=
+'font-size:10.0pt'>(</span></span><i>parameter-type-list<sub>opt</sub></i>
+<span class="Annot"><span style='font-size: 10.0pt'>)</span></span>
+<i>stateClause*<sub>opt</sub> globals<sub>opt</sub>
+modifies<sub>opt</sub></i></p>
+<p class="TextFontCX" style='text-indent:.5in'><i>|&nbsp;
+direct-declarator</i> <span class="Annot"><span style=
+'font-size:10.0pt'>(</span></span><i>identifier-list<sub>opt</sub></i>
+<span class="Annot"><span style='font-size: 10.0pt'>)</span></span>
+<i>stateClause*<sub>opt</sub> globals<sub>opt</sub>
+modifies<sub>opt</sub></i></p>
+<p class="TextFontCX"><i>&nbsp;</i></p>
+<p class="TextFontCX"><i>stateClause</i> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size:10.0pt'>/*@</span></span> (
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>uses</span></span> <i>|</i> <span class=
+      "Annot"><span style='font-size:10.0pt'>sets</span></span>
+      <i>|</i> <span class="Annot"><span style=
+      'font-size:10.0pt'>defines</span></span> <i>|</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>allocates</span></span> <i>|</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>releases</span></span>)
+      <i>reference,<sup>+</sup></i> <span class=
+      "Annot"><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>@*/</span></span></p>
+<p class="TextFontCX" align="right" style='text-align: right'>
+<i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+&nbsp;&nbsp; |</i> <span class="Annot"><span style=
+'font-size:10.0pt'>/*@</span></span> ( <span class=
+"Annot"><span style='font-size:10.0pt'>ensures</span></span> |
+<span class="Annot"><span style=
+'font-size:10.0pt'>requires</span></span> ) <i>stateTag</i>
+<i>reference,<sup>+</sup></i> <span class=
+      "Annot"><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>@*/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>
+      (Section 7.4)</p>
+<p class="TextFontCX"><i>&nbsp;</i></p>
+<p class="TextFontCX"><i>stateTag</i> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>only</span></span>
+      <i>|</i> <span class="Annot"><span style=
+      'font-size: 10.0pt'>shared</span></span> <i>|</i>
+      <span class="Annot"><span style=
+      'font-size: 10.0pt'>owned</span></span> <i>|</i> <span class=
+      "Annot"><span style=
+      'font-size: 10.0pt'>dependent</span></span> <i>|</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>observer</span></span> <i>|</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>exposed</span></span> <i>|</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>isnull</span></span> <i>|</i> <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>notnull</span></span></p>
+<p class="TextFontCX" align="right" style=
+'text-align: right;text-indent:.5in'><i>&nbsp;&nbsp;&nbsp;&nbsp; |
+identifier&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</i>
+(Annotation defined by metastate definition, Section 10)</p>
+<p class="TextFontCX" style='text-indent:.5in'>
+<i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</i></p>
+<p class="TextFontCX"><i>globals</i> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>/*@globals</span></span>
+      <i>globitem,<sup>+</sup></i> <span class="Annot"><span style=
+      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>@*/</span></span> <i>|</i> <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>/*@globals</span></span><i>declaration-list<sub>opt&nbsp;</sub></i>
+      <span class="Annot"><span style=
+      'font-size: 10.0pt'>;</span></span><i><sub>opt</sub></i><span class="Annot">
+<span style='font-size:10.0pt'>@*/</span></span><span class=
+"Keyword"><span style='font-size:10.0pt'>&nbsp;</span></span></p>
+<p class="TextFontCX"><i>globitem</i> <span style=
+'font-family:Symbol'>&#222;</span> [ ( <span class=
+"Annot"><span style='font-size:10.0pt'>undef</span></span> |
+<span class="Annot"><span style=
+'font-size:10.0pt'>killed</span></span> )* ] <span class=
+"Keyword"><i><sub><span style=
+'font-size:10.5pt;font-family:"Times New Roman"'>&nbsp;</span></sub></i></span><i>
+&nbsp;identifier |&nbsp;</i> <span class="Annot"><span style=
+'font-size:10.0pt'>internalState</span></span><i>|&nbsp;</i>
+<span class="Annot"><span style=
+'font-size:10.0pt'>fileSystem</span></span></p>
+<p class="TextFontCX"><i>&nbsp;</i></p>
+<p class="TextFontCX"><i>modifies</i> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size:10.0pt'>/*@modifies</span></span>
+      (<span class="Annot"><span style=
+      'font-size:10.0pt'>nothing</span></span> <i>|</i>
+      (<i>expression</i> | <span class="Annot"><span style=
+      'font-size:10.0pt'>internalState</span></span> | <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>fileSystem</span></span>)<i><sup>+</sup></i><span class="Annot">
+<span style=
+'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i>)
+<span class="Annot"><span style=
+'font-size:10.0pt'>@*/</span></span><span class=
+"Keyword"><span style=
+'font-size:10.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></p>
+<p class="TextFontCX" align="right" style='text-align: right'>
+<span class="Keyword"><span style=
+'font-size:10.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;</span></span> <i>|</i>
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*@*/</span></span><span class=
+"Keyword"><span style='font-size:10.0pt'>&nbsp;&nbsp;
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span>(Abbreviation for
+no globals and modifies nothing.)</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975066">Iterators</a> <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+11.4)</span></span></p>
+<p class="beforelist">The globals and modifies clauses for an
+iterator are the same as those for a function, except they are not
+enclosed by a comment, since the iterator is already a comment.</p>
+<p class="TextFontCX"><i>direct-declarator</i></p>
+<p class="TextFontCX" style='text-indent:.5in'><span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>/*@iter</span></span>
+      <i>identifier</i> <span class="Annot"><span style=
+      'font-size:10.0pt'>(</span></span><i>parameter-type-list<sub>opt</sub></i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>)</span></span>
+      <i>iterGlobals<sub>opt</sub> iterModifies<sub>opt</sub></i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>@*/</span></span></p>
+<p class="TextFontCX"><i>&nbsp;</i></p>
+<p class="TextFontCX"><i>iter-globals</i> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>globals</span></span>
+      <i>declaration-list<sub>opt</sub></i> <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>
+<p class="TextFontCX"><i>iter-modifies</i> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>modifies</span></span><i>&nbsp;
+      moditem,+</i><span class="Annot"><span style=
+      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><i>|</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>&nbsp;modifies
+      nothing</span></span><span class="Annot"><span style=
+      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975067">Constants</a> <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+11.1)</span></span></p>
+<p class="TextFontCX"><i>external-declaration</i>
+      <span style='font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style=
+      'font-size: 10.0pt'>/*@constant</span></span> <i>declaration
+      <sub>&nbsp;</sub></i><span class="Annot"><span style=
+      'font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><span class="Annot">
+<span style='font-size:10.0pt'>@*/</span></span></p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975068"></a><a name="_Ref344807420">Alternate
+Types</a> <span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+4.4)</span></span></p>
+<p class="beforelist">Alternate types may be used in the type
+specification of parameters and return values.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+<i>extended-type</i><span style='font-family:Symbol'>&#222;</span>
+<i>type-specifier alt-type <sub>opt</sub></i></p>
+<p class="TextFontCX"><i>alt-type</i> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>/*@alt</span></span>
+      <i>basic-type,<sup>+</sup></i> <span class=
+      "Annot"><span style='font-size:10.0pt'>@*/</span></span></p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975069">Declarator Annotations</a></p>
+<p class="TextFontCX">General annotations appear after
+<i>storage-class-specifier</i>s and before
+<i>type-specifier</i>s.&nbsp; Multiple annotations may be used in
+any order.&nbsp; Here, annotations are without the surrounding
+comment.&nbsp; In a declaration, the annotation would be surrounded
+by <span class="Annot"><span style=
+'font-size:10.0pt'>/*@</span></span> and <span class=
+"Annot"><span style='font-size:10.0pt'>@*/</span></span>.&nbsp; In
+a globals or modifies clause or iterator or constant declaration,
+no surrounding comments would be used since they are within a
+comment.</p>
+<p class="Heading10" align="left" style='text-align:left'>Type
+Definitions <span class="TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+4.3)</span></span></p>
+<p class="beforelist">A type definition may use any either
+<span class="Annot"><span style=
+'font-size:10.0pt'>abstract</span></span> or <span class=
+"Annot"><span style='font-size:10.0pt'>concrete</span></span>,
+either <span class="Annot"><span style=
+'font-size:10.0pt'>mutable</span></span>&nbsp;or <span class=
+"Annot"><span style='font-size:10.0pt'>immutable</span></span>, and
+<span class="Annot"><span style=
+'font-size:10.0pt'>refcounted</span></span>.&nbsp; Only a pointer
+to a <span class="Annot"><span style=
+'font-size:10.0pt'>struct</span></span> may be declared with
+<span class="Annot"><span style=
+'font-size:10.0pt'>refcounted</span></span>.&nbsp; Mutability
+annotations may not be used with concrete types since concrete
+types inherit their mutability from the actual type.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>abstract</span></span></p>
+<p class="MsoNormal" style='margin-left:13.5pt'>Type is abstraction
+(representation is hidden from clients.)</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>concrete</span></span></p>
+<p class="MsoNormal" style='margin-left:13.5pt'>Type is concrete
+(representation is visible to clients.)</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>immutable</span></span></p>
+<p class="MsoNormal" style='margin-left:13.5pt'>Instances of the
+type cannot change value.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>mutable</span></span></p>
+<p class="MsoNormal" style='margin-left:13.5pt'>Instances of the
+type can change value.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>refcounted</span></span></p>
+<p class="IndentText">Reference counted (Section 5.4).</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975070">Type Access</a></p>
+<p class="TextFontCX">Control comments may also be used to override
+type access settings.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>&nbsp;</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@access
+<i>&lt;type&gt;</i>,<sup>+</sup>@*/</span></span><span class=
+"Annot"><span style='font-size:10.0pt'>&nbsp;</span></span></p>
+<p class="IndentText">Allows the following code to access the
+representation of <span class="Annot"><i><span style=
+'font-size:10.0pt'>&lt;type&gt;</span></i></span>.&nbsp; Type
+access applies from the point of the comment to the end of the file
+or the next access control comment for this type.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@noaccess</span></span> <span class=
+"Annot"><span style=
+'font-size:10.0pt'><i>&lt;type&gt;</i>,<sup>+</sup>@*/</span></span></p>
+<p class="IndentText">Restricts access to the representation of
+<span class="Annot"><i><span style=
+'font-size:10.0pt'>&lt;type&gt;</span></i></span>.&nbsp; The type
+in a <span class="Annot"><span style=
+'font-size:10.0pt'>noaccess</span></span> comment must have been
+declared as an abstract type.&nbsp;</p>
+<p class="Heading10">Global Variables&nbsp; <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>7.2</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
+<p class="beforelist">One check annotation may be used on a global
+or file-static variable declaration.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>unchecked</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Weakest checking
+for global use.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>checkmod</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Check
+modification by not use of global.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>checked</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Check use and
+modification of global.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>checkedstrict</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Check use of
+global, even in functions with no global list.</span></span></p>
+<p class="Heading10">Memory Management&nbsp; <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>3</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>dependent</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>A reference to
+externally-owned storage.&nbsp; (Section</span></span>
+      <span class="Annot"><span style=
+      'font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>keep</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>A parameter that
+is kept by the called function.&nbsp; The caller may use the
+storage after the call, but the called function is responsible for
+making sure it is deallocated.&nbsp; (Section</span></span>
+<span class="Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>5.2.4</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>killref</span></span></p>
+<p class="IndentText">A <span class="Annot"><span style=
+'font-size:10.0pt'>refcounted</span></span> parameter.&nbsp; This
+reference is killed by the call. (Section 5.4)</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>only</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>An unshared
+reference.&nbsp; Associated memory must be released before
+reference is lost.&nbsp;
+      (Section&nbsp;</span></span><span class="Annot"><span style=
+      'font-size:10.0pt;font-family:"Times New Roman"'>5.2</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>owned</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Storage may be
+shared by dependent references, but associated memory must be
+released before this reference is lost.&nbsp;
+(Section</span></span> <span class="Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>shared</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Shared reference
+that is never deallocated.&nbsp; (Section</span></span>
+      <span class="Annot"><span style=
+      'font-size:10.0pt;font-family:"Times New Roman"'>5.2.5</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>temp</span></span></p>
+<p class="IndentText">A temporary parameter.&nbsp; May not be
+released, and new aliases to it may not be created.&nbsp; (Section
+5.2.2)</p>
+<p class="Heading10">Aliasing&nbsp; <span class=
+"HeadingNote"><span style=
+'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>6</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<p class="beforelist">Both alias annotations may be used on a
+parameter declaration.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>unique</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Parameter that
+may not be aliased by any other reference visible to the function.
+(Section&nbsp;</span></span><span class="Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>6.1.1</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>returned</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Parameter that
+may be aliased by the return value.&nbsp; (Section</span></span>
+<span class="Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>6.1.2</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="Heading10">Exposure&nbsp; <span class=
+"HeadingNote"><span style=
+'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>6.2</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>observer</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Reference that
+cannot be modified.&nbsp; (Section</span></span> <span class=
+"Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>6.2.1</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>exposed</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Exposed reference
+to storage in another object. (Section</span></span>
+      <span class="Annot"><span style=
+      'font-size:10.0pt;font-family:"Times New Roman"'>6.2</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="Heading10">Definition State <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>3</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>out</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Storage reachable
+from reference need not be defined.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>in</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>All storage
+reachable from reference must be defined.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>partial</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Partially
+defined.&nbsp; A structure may have undefined fields.&nbsp; No
+errors reported when fields are used.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>reldef</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Relax definition
+checking.&nbsp; No errors when reference is not defined, or when it
+is used.</span></span></p>
+<p class="Heading10">Global State <span class=
+"TextFontCXChar"><span style=
+'font-size:11.0pt; font-weight:normal'>(Section
+7.2.2)</span></span></p>
+<p class="TextFontCX">These annotations may only be used in globals
+lists.&nbsp; Both annotations may be used for the same variable, to
+mean the variable is undefined before and after the call.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>undef</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Variable is
+undefined before the call.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>killed</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Variable is
+undefined after the call.</span></span></p>
+<p class="Heading10">Null State <span class=
+"HeadingNote"><span style=
+'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>2</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>null</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Possibly null
+pointer.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>notnull</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt'>&nbsp;&nbsp;</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Non-null
+pointer.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>relnull</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Relax null
+checking.&nbsp; No errors when</span></span> <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>NULL</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>is assigned to it,
+or when it is used as a non-null pointer.</span></span></p>
+<p class="Heading10">Null Predicates <span class=
+"HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>2.1.1</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<p class="beforelist">A null predicate annotation may be used of
+the return value of a function returning a Boolean type, taking a
+possibly-null pointer for its first argument.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>nullwhentrue</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>If result is
+true, first parameter is</span></span> <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>NULL</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>falsewhennull</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>If result
+is</span></span> <span class="CodeText"><span style=
+'font-size:10.0pt'>TRUE</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>, first parameter
+is not</span></span> <span class="CodeText"><span style=
+'font-size:10.0pt'>NULL</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
+<p class="Heading10">Execution&nbsp; <span class=
+"HeadingNote"><span style=
+'font-size: 10.5pt;font-weight:normal;font-style:normal'>(Section</span></span>
+<span class="HeadingNote"><span style=
+'font-size:10.5pt;font-weight:normal;font-style: normal'>8.1</span></span><span class="HeadingNote">
+<span style=
+'font-size:10.5pt; font-weight:normal;font-style:normal'>)</span></span></p>
+<p class="beforelist">The <span class="Annot"><span style=
+'font-size:10.0pt'>noreturn</span></span>, <span class=
+"Annot"><span style='font-size:10.0pt'>maynotreturn</span></span>
+and <span class="Annot"><span style=
+'font-size:10.0pt'>alwaysreturn</span></span> annotations may be
+used on any function.&nbsp; The <span class=
+      "Annot"><span style='font-size:10.0pt'>noreturnwhentrue</span></span>
+      and <span class="Annot"><span style=
+      'font-size:10.0pt'>noreturnwhenfalse</span></span>
+      annotations may only be used on functions whose first
+      argument is a Boolean.&nbsp;&nbsp;</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>noreturn</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Function never
+returns.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>maynotreturn</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Function may or
+may not return.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>noreturnwhentrue</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Function does not
+return if first parameter is</span></span> <span class=
+"Keyword"><span style=
+'font-size:10.0pt'>TRUE</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>noreturnwhenfalse</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Function does not
+return if first parameter if</span></span> <span class=
+"Keyword"><span style=
+'font-size:10.0pt'>FALSE</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>alwaysreturn</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Function always
+returns.</span></span></p>
+<p class="Heading10">Side Effects <span style=
+'font-size:10.5pt;font-weight: normal'>(Section 11.2.1)</span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>sef</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>Corresponding
+actual parameter has no side effects.</span></span></p>
+<p class="Heading10">Declarations</p>
+<p class="beforelist">These annotations can be used on a
+declaration to control unused or undefined error reporting.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>unused</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Identifier need
+not be used (no unused errors reported.)&nbsp;
+(Section</span></span> <span class="Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>13.1</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>external</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Identifier is
+defined externally (no undefined error reported.)
+(Section</span></span> <span class="Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>13.2</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>
+<p class="Heading10">Switch Statements</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>fallthrough</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>Fall through
+case.&nbsp; No message is reported if the previous case may fall
+through into the one immediately after the</span></span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>fallthrough</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>
+<p class="Heading10">Break and Continue Statements
+      <span class="TextFontCXChar"><span style=
+      'font-size:11.0pt; font-weight:normal'>(Section
+      8.3.3)</span></span></p>
+<p class="beforelist">These annotations are used before a
+<span class="CodeText"><span style=
+'font-size:10.0pt'>break</span></span> or <span class=
+"CodeText"><span style='font-size:10.0pt'>continue</span></span>
+statement.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>innerbreak</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
+an inner loop or switch.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>loopbreak</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
+a loop.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>switchbreak</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Break is breaking
+a switch.</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>innercontinue</span></span><span class=
+"Annot"><span style=
+'font-size:10.0pt'><i>&nbsp;</i></span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Continue is
+continuing an inner loop.</span></span></p>
+<p class="Heading10">Unreachable Code</p>
+<p class="beforelist">This annotation is used before a statement to
+prevent unreachable code errors.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>notreached</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Statement may be
+unreachable.</span></span></p>
+<p class="Heading10">Format String Arguments&nbsp;</p>
+<p class="beforelist">These annotations are used immediately before
+a function declaration.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>printflike</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Check variable
+arguments like</span></span> <span class=
+      "CodeText"><span style='font-size:10.0pt'>printf</span></span><span class="Annot">
+<span style=
+'font-size:10.0pt;font-family:"Times New Roman"'>library
+function.&nbsp;&nbsp;</span></span></p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>scanflike</span></span></p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt;font-family: "Times New Roman"'>Check variable
+arguments like</span></span> <span class=
+      "CodeText"><span style='font-size:10.0pt'>scanf</span></span><a name="_Toc344355453">
+</a><a name="_Ref343091002"></a><a name=
+      "_Ref343065628"><span class="Annot"><span style=
+      'font-size:10.0pt;font-family:"Times New Roman"'>library
+      function.</span></span></a></p>
+<p class="Heading10"><a name="_Ref348789839">Use Warnings</a></p>
+<p class="beforelist">These annotations are used immediately before
+a function, variable or type declaration.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>warn <i>&lt;flag-specifier&gt;</i>
+<i>&lt;message&gt;</i></span></span></p>
+<p class="IndentText">Issue a warning (controlled by
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>flag-specifier</span></span>) where this
+      declarator is used.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975071">Macro Expansion</a></p>
+<p class="TextFontCX"><a href=
+"mailto:/*@notfunction@*/"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@notfunction@*/</span></span></a></p>
+<p class="IndentText">The next macro definition is not intended to
+be a function, and should be expanded in line instead of checked as
+a macro function definition.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975072">Arbitrary Integral Types</a></p>
+<p class="TextFontCX">These annotations are used to represent
+arbitrary integral types.&nbsp; Syntactically, they replace the
+implicit <span class="Flag"><span style=
+'font-size:10.0pt'>int</span></span> type.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@integraltype@*/</span></span></p>
+<p class="IndentText">An arbitrary integral type.&nbsp; The actual
+type may be any one of <span class="CodeText"><span style=
+'font-size:10.0pt'>short</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>int</span></span>,
+<span class="CodeText"><span style=
+'font-size:10.0pt'>long</span></span>, <span class=
+"CodeText"><span style='font-size:10.0pt'>unsigned
+short</span></span>, <span class="CodeText"><span style=
+'font-size:10.0pt'>unsigned</span></span>, or <span class=
+"CodeText"><span style='font-size:10.0pt'>unsigned
+long</span></span>.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>
+<p class="IndentText">An arbitrary unsigned integral type.&nbsp;
+The actual type may be any one of <span class=
+"CodeText"><span style='font-size:10.0pt'>unsigned
+short</span></span>, <span class="CodeText"><span style=
+'font-size:10.0pt'>unsigned</span></span>, or <span class=
+"CodeText"><span style='font-size:10.0pt'>unsigned
+long</span></span>.</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>
+<p class="IndentText">An arbitrary signed integral type.&nbsp; The
+actual type may be any one of <span class=
+      "CodeText"><span style='font-size:10.0pt'>short</span></span>,
+      <span class="CodeText"><span style=
+      'font-size:10.0pt'>int</span></span>, or <span class=
+      "CodeText"><span style=
+      'font-size:10.0pt'>long</span></span>.</p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975073"></a><a name="_Ref347471625">Traditional
+Lint Comments</a></p>
+<p class="TextFontCX">Some of the control comments supported by
+most standard UNIX lints are supported by Splint so legacy systems
+can be checked more easily.&nbsp; These comments are not lexically
+consistent with Splint comments, and their meanings are less
+precise (and may vary between different lint programs), so we
+recommend that Splint comments are used instead except for checking
+legacy systems already containing standard lint comments.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="beforelist">These standard lint comments supported by
+Splint:</p>
+<p class="TextFontCX"><span class="Annot"><span style=
+'font-size:10.0pt'>/*FALLTHROUGH*/</span></span> (alternate
+misspelling, <span class="Annot"><span style=
+'font-size:10.0pt'>/*FALLTHRU*/</span></span>)</p>
+<p class="IndentText">Prevents errors for fall through cases.&nbsp;
+Same meaning as <span class="Annot"><span style=
+'font-size:10.0pt'>/*@fallthrough@*/</span></span>.</p>
+<p class="MsoListBullet"><span class="Annot"><span style=
+'font-size:10.0pt'>/*NOTREACHED*/</span></span></p>
+<p class="IndentText">Prevents errors about unreachable code (until
+the end of the function).&nbsp; Same meaning as <span class=
+"Annot"><span style=
+'font-size:10.0pt'>/*@notreached@*/</span></span>.&nbsp;&nbsp;</p>
+<p class="MsoListBullet"><span class="Annot"><span style=
+'font-size:10.0pt'>/*PRINTFLIKE*/</span></span></p>
+<p class="indentbefore">Arguments similar to the <span class=
+"CodeText"><span style='font-size:10.0pt'>printf</span></span>
+library function (there didn&#8217;t seem to be much of a consensus
+among standard lints as to exactly what this means).&nbsp; Splint
+supports:</p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@printflike@*/</span></span></p>
+<p class="IndentText" style='margin-left:.5in'>Function takes zero
+or more arguments of any type, an unmodified <span class=
+"CodeText"><span style='font-size:10.0pt'>char *</span></span>
+format string argument and zero of more arguments of type and
+number dictated by the format string.&nbsp; Format codes are
+interpreted identically to the <span class=
+      "CodeText"><span style='font-size:10.0pt'>printf</span></span>
+      standard library function.&nbsp; May return a result of any
+      type.&nbsp; (Splint interprets <span class=
+      "Annot"><span style=
+      'font-size:10.0pt'>/*PRINTFLIKE*/</span></span> as
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>/*@printflike@*/</span></span>.)</p>
+<p class="IndentText"><span class="Annot"><span style=
+'font-size:10.0pt'>/*@scanflike@*/</span></span></p>
+<p class="IndentText" style='margin-left:.5in'>Like
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>printflike</span></span>, except format
+      codes are interpreted as in the <span class=
+      "CodeText"><span style='font-size:10.0pt'>scanf</span></span>
+      library function.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="MsoListBullet" style='margin-left:0in;text-indent:0in'>
+<span class="Annot"><span style=
+'font-size:10.0pt'>/*ARGSUSED*/</span></span></p>
+<p class="IndentText">Turns off unused parameter messages for this
+function.&nbsp; The control comment, <span class=
+"Annot"><span style=
+'font-size:10.0pt'>/*@&#8209;paramuse</span></span><span class="Annot">
+<span style='font-size:10.0pt'>@*/</span></span> can be used to the
+same effect, or <span class="Annot"><span style=
+'font-size:10.0pt'>/*@unused@*/</span></span>&nbsp;can be used in
+individual parameter declarations.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="TextFontCX">Splint will ignore standard lint comments if
+<span class="Flag"><span style=
+'font-size:10.0pt'>-lint-comments</span></span> is used.&nbsp; If
+<span class="Flag"><span style=
+'font-size:10.0pt'>+warn-lint-comments</span></span> is used,
+Splint generates a message for standard lint comments and suggest
+replacements<a name="_Ref348801565">.</a></p>
+<p class="MsoHeading8" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975074">Metastate Definitions</a></p>
+<p class="TextFontCX">The grammar for <span class=
+"ProgramNameChar">.mts</span> files is shown below.</p>
+<p class="MsoNormal">&nbsp;</p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">metastate</span></i> <span lang="FR">&nbsp;&nbsp;</span>
+<span style='font-family:Symbol'>&#222;</span> <span lang=
+"FR">[</span> <span class="Annot"><span style=
+'font-size:10.0pt'>global</span></span> <span lang="FR">]</span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>attribute</span></span> <i><span lang=
+"FR">identifier clause*</span></i> <span class=
+      "Annot"><span style='font-size: 10.0pt'>end</span></span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">clause</span></i> <span lang=
+"FR">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> <span style=
+'font-family:Symbol'>&#222;</span> <i><span lang=
+"FR">contextClause</span></i> <span lang="FR">| <i>valuesClause</i>
+| <i>defaultClause | defaultsClause</i></span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .75in;text-align:left;text-indent:.25in'>
+<i><span lang="FR">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span></i>
+<span lang="FR">| <i>annotationsClause</i> | <i>mergeClause |
+transfersClause | loserefClause</i></span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: 1.25in;text-align:left'><i><span lang="FR">|
+preconditionsClause | postconditionsClause</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">contextClause</span></i><span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>context</span></span>
+      <i><span lang="FR">contextSelector</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">contextSelector</span></i> <span style=
+'font-family:Symbol'>&#222;</span> <span lang="FR">(</span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>parameter</span></span> <span lang="FR">|</span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>reference</span></span> <span lang="FR">|</span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>result</span></span> <span lang="FR">|</span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>clause</span></span> <span lang="FR">|</span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>literal</span></span> <span lang="FR">|</span>
+<span class="Annot"><span style=
+'font-size:10.0pt'>null</span></span> <span lang="FR">) [
+<i>type</i> ]</span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">valuesClause</span></i><span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>oneof</span></span>
+      <i>valueChoice</i>,*</p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'>&nbsp;</p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">defaultClause</span></i> <span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>default</span></span>
+      <i>valueChoide</i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">defaultsClause</span></i><span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>defaults</span></span>
+      <span lang="FR">( <i>contextSelector</i></span> <span class=
+      "Annot"><span style='font-size:10.0pt'>==&gt;</span></span>
+      <i>valueChoice</i> <span lang="FR">)*</span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">&nbsp;</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">annotationsClause</span></i><span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>annotations</span></span>
+      &nbsp;( <i>identifier</i> [ <i><span lang=
+      "FR">contextSelector</span></i> <span lang="FR">]</span>
+      <span class="Annot"><span style=
+      'font-size: 10.0pt'>==&gt;</span></span> <i>valueChoice</i>
+      )<i><span lang="FR">*</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">&nbsp;</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">mergeClause</span></i><span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>merge</span></span> (
+      <i>mergeItem</i> <span class="Annot"><span style=
+      'font-size:10.0pt'>+</span></span> <i>mergeItem</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>==&gt;</span></span> <i>transferAction</i>
+      )<i><span lang="FR">*</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">mergeItem</span></i><span style=
+'font-family:Symbol'>&#222;</span> <i>valueChoice |</i>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>*</span></span></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">&nbsp;</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">transfersClause</span></i><span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>transfers</span></span>
+      ( <i>valueChoice</i> <span class="Annot"><span style=
+      'font-size:10.0pt'>as</span></span>
+      <i>valueChoice</i><span class="Annot"><span style=
+      'font-size:10.0pt'>==&gt;</span></span> <i>transferAction</i>
+      )<i><span lang="FR">*</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">loserefClause</span></i><span style=
+'font-family:Symbol'>&#222;</span> <span class=
+      "Annot"><span style='font-size: 10.0pt'>losereference</span></span>
+      ( <i>valueChoice</i> <span class="Annot"><span style=
+      'font-size:10.0pt'>==&gt;</span></span> <i>errorAction</i>
+      )<i><span lang="FR">*</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">&nbsp;</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">transferAction</span></i><span style=
+'font-family:Symbol'>&#222;</span> <i>valueChoice |
+errorAction</i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'>
+      <i>errorAction</i><span style='font-family:Symbol'>&#222;</span>
+      <span class="Annot"><span style=
+      'font-size:10.0pt'>error</span></span> [ <i>stringLiteral</i>
+      ]</p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">&nbsp;</span></i></p>
+<p class="TextFontCX" align="left" style=
+'margin-left: .25in;text-align:left'><i><span lang=
+"FR">valueChoice</span></i><span style=
+'font-family:Symbol'>&#222;</span>
+<i>identifier</i>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975075"></a><a name="_Ref397875216"></a><a name=
+"_Ref350066976"></a><a name="_Ref348788300">Appendix
+      D<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="specifications" name="specifications">
+            Specifications</a>
+</a>
+           </p>
+<p class="TextFontCX">Another way of providing more information
+about programs is to use formal specifications.&nbsp; Although this
+document has largely ignored specifications, Splint was originally
+designed to use the information in LCL specifications instead of
+source-code annotations.&nbsp; This document focuses on annotations
+since it takes less effort to add annotations to source code than
+to maintain an additional specification file.&nbsp; Annotations can
+express everything that can be expressed in LCL specifications that
+is relevant to Splint checking.&nbsp; However, LCL specifications
+can provide more precise documentation on program interfaces than
+is possible with Splint annotations.&nbsp; This appendix (extracted
+from [Evans94]) is a very brief introduction to LCL
+Specifications.&nbsp; For more information, consult
+[GH93].&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The Larch family of languages is a two-tiered
+approach to formal specification. A specification is built using
+two languages &#8212; the <i>Larch Shared Language</i> (LSL), which
+is independent of the implementation language, and a <i>Larch
+Interface Language</i> designed for the specific implementation
+language.&nbsp; An LSL specification defines <i>sorts</i>,
+analogous to abstract&nbsp;types in a programming language, and
+<i>operators</i>, analogous to procedures.&nbsp; It expresses the
+underlying semantics of an abstraction.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">The interface language specifies an interface
+to an abstraction in a particular programming language.&nbsp; It
+captures the details of the interface needed by a client using the
+abstraction and places constraints on both correct implementations
+and uses of the module.&nbsp; The semantics of the interface are
+described using primitives and sorts and operators defined in LSL
+specifications.&nbsp; Interface languages have been designed for
+several programming languages.</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX">LCL [GH93, Tan95] is a Larch interface
+language for Standard C.&nbsp; LCL uses a C-like syntax.&nbsp;
+Traditionally, a C module <span class=
+      "Keyword"><i><span style='font-size:10.0pt;font-family:Arial; color:windowtext'>
+M</span></i></span> consists of a source file, <span class=
+"Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>,
+and a header file, <span class="Keyword"><i><span style=
+'font-size:10.0pt; font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.&nbsp;
+The header file contains prototype declarations for functions,
+variables and constants exported by <span class=
+"Keyword"><i><span style=
+'font-size:10.0pt; font-family:Arial;color:windowtext'>M</span></i></span>,
+as well as those macro definitions that implement exported
+functions or constants, and definitions of exported types. When
+using LCL, a module includes two additional files &#8212;
+<span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>,
+a formal specification of <span class=
+      "Keyword"><i><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
+M</span></i></span>, and <span class=
+      "Keyword"><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>
+M</span></i></span><span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>,
+which is derived by Splint (if the <span class=
+      "Flag"><span style='font-size:10.0pt'>lh</span></span> flag
+      is on) from <span class="Keyword"><i><span style=
+      'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>.&nbsp;
+Clients use <span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
+for documentation, and should not need to look at any
+implementation file.&nbsp; The derived file, <span class=
+"Keyword"><i><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>,
+contains include directives (if <span class=
+"Keyword"><i><span style=
+'font-size: 10.0pt;font-family:Arial;color:windowtext'>M</span></i></span>
+depends on other specified modules), prototypes of functions and
+declarations of variables as specified in <span class=
+"Keyword"><i><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>.&nbsp;
+The file <span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial; color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>
+should include <span class="Keyword"><i><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>
+and retain the implementation aspects of the old <span class=
+"Keyword"><i><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span class="Keyword">
+<span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>,
+but is no longer used for c<a name="_Ref348845779">lient
+documentation.</a></p>
+<p class="MsoHeading9" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975076">Specification Flags</a></p>
+<p class="TextFontCX">These flags are relevant only when Splint is
+used with LCL specifications.</p>
+<p class="Heading10">Global Flags</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>lcs</span></span></p>
+<p class="IndentText">Generate <span class=
+      "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
+.lcs</span></span>&nbsp;files containing symbolic state of
+<span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
+files (used for imports).&nbsp; By default <span class=
+"Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lcs</span></span>
+files are generated for each <span class=
+      "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
+.lcl</span></span> file processed.&nbsp; Use <span class=
+"Flag"><span style='font-size:10.0pt'>-lcs</span></span> to prevent
+generation of <span class="Keyword"><span style=
+'font-size:10.0pt;font-family: Arial;color:windowtext'>.lcs</span></span>
+files.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>lh</span></span></p>
+<p class="IndentText">Generate <span class=
+      "Keyword"><span style='font-size:10.0pt; font-family:Arial;color:windowtext'>
+.lh</span></span> files.&nbsp; By default, <span class=
+"Flag"><span style='font-size:10.0pt'>-lh</span></span> is set and
+no <span class="Keyword"><span style=
+'font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>
+files are generated.&nbsp; Use <span class=
+      "Flag"><span style='font-size:10.0pt'>+lh</span></span> to
+      enable <span class="Flag"><span style=
+      'font-size:10.0pt'>.lh</span></span> file
+      generation.&nbsp;</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>i</span></span> <span class=
+      "Flag"><span style='font-size:10.0pt'>&lt;file&gt;</span></span></p>
+<p class="IndentText">Set LCL initialization file to
+      <span class="Flag"><i><span style=
+      'font-size:10.0pt'>&lt;file&gt;</span></i></span>.&nbsp; The
+      LCL initialization file is read if any <span class=
+      "Keyword"><span style=
+      'font-size: 10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>
+      files are listed on the command line.&nbsp; The default file
+      is <span class="Keyword"><span style=
+      'font-size:10.0pt;font-family:Arial;color:windowtext'>lclinit.lci</span></span>,
+      found on the <span class="Keyword"><span style=
+      'font-size:10.0pt;font-family: Arial;color:windowtext'>LARCH_PATH</span></span>.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>lclexpect</span></span> <span class=
+"Flag"><span style=
+'font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>
+<p class="IndentText">Exactly <span class=
+      "Flag"><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>
+      specification errors are expected.&nbsp; Specification errors
+      are errors detected when checking the specifications.&nbsp;
+      They do not depend on the source code.</p>
+<p class="Heading10">Implicit Globals Checking Qualifiers</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-++-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checked-spec-globs</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checked</span></span>
+      qualifier on global variables specified in an LCL file with
+      no checking annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>----</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checkmod-spec-globs</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checkmod</span></span>
+      qualifier on global variables specified in an LCL file with
+      no checking annotation.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>imp-checkedstrict-spec-globs</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>checked</span></span>
+      qualifier on global variables specified in an LCL file with
+      no checking annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="Heading10">Implicit Annotations</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>spec-glob-imp-only</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>only</span></span>
+      annotation on global variable declaration in an LCL file with
+      no allocation annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>spec-ret-imp-only</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>only</span></span>
+      annotation on return value declaration in an LCL file with no
+      allocation annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>spec-struct-imp-only</span></span></p>
+<p class="IndentText">Implicit <span class=
+      "Annot"><span style='font-size:10.0pt'>only</span></span>
+      annotation on structure field declarations in an LCL file
+      with no allocation annotation.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>spec-imp-only</span></span></p>
+<p class="IndentText">Sets <span class="Flag"><span style=
+'font-size:10.0pt'>spec-glob-imp-only</span></span>,
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>spec-ret-imp-only</span></span> and
+      <span class="Flag"><span style=
+      'font-size:10.0pt'>spec-struct-imp-only</span></span>.</p>
+<p class="Heading10">Macro Expansion</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>spec-macros</span></span></p>
+<p class="IndentText">Macros defining specified identifiers are not
+expanded and are checked according to the
+      specification.<span class="Flag"><span style=
+      'font-size:10.0pt'>&nbsp;</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>-+++</span></span></p></td></tr></table></div>
+<p class="Heading10">Complete Programs and Specifications</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>spec-undef</span></span></p>
+<p class="IndentText">Function, variable, iterator or constant
+specified but never defined.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>spec-undecl</span></span></p>
+<p class="IndentText">Function, variable, iterator or constant
+specified but never declared.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>P:</span> <span class=
+      "Keyword"><span style='font-size:10.0pt'>-</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>need-spec</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>shortcut</span></p></td></tr></table></div>
+<p class="IndentText">There is information in the specification
+that is not duplicated in syntactic comments.&nbsp; Normally, this
+is not an error, but it may be useful to detect it to make sure
+checking incomplete systems without the specifications will still
+use this information.</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-any</span></span></p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="IndentText">An error is reported for any identifier that
+is exported but not specified.&nbsp; (Sets all export flags
+below.)</p>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-const</span></span></p>
+<p class="IndentText">Constant exported but not specified.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-var</span></span></p>
+<p class="IndentText">Variable exported but not specified.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-fcn</span></span></p>
+<p class="IndentText">Function exported but not specified.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-iter</span></span></p>
+<p class="IndentText">Iterator exported but not specified.</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-macro</span></span></p>
+<p class="IndentText">An expanded macro exported but not
+specified</p>
+<div>
+<table cellspacing="0" cellpadding="0" hspace="0" vspace="0"
+       height="14" align="left">
+<tr>
+<td valign="top" align="left" height="14" style=
+'padding-top:0in;padding-right: 9.35pt;padding-bottom:0in;padding-left:9.35pt'>
+<p class="TextFontCX" align="center" style=
+'text-align:center;background:#CCCCCC'><span style=
+'font-size:10.0pt'>m:</span><span class=
+      "Keyword"><span style='font-size:10.0pt'>---+</span></span></p></td></tr></table></div>
+<p class="TextFontCX"><span class="Flag"><span style=
+'font-size:10.0pt'>export-type</span></span></p>
+<p class="IndentText">Type definition exported but not
+specified</p>
+<p class="MsoHeading7" style='margin-left:0in;text-indent:0in'>
+<a name="_Toc534975077"></a><a name="_Ref534642451"></a><a name=
+"_Toc344355450">Appendix E<span style=
+'font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span>
+<a id="annotated" name="annotated">
+Annotated Bibliography</a></a></p>
+<h4 style='margin-left:0in;text-indent:0in'>Splint</h4>
+<p class="TextFontCX">All of these papers are available at
+<span style='font-size:10.0pt;font-family:Arial'><a href=
+"http://www.splint.org/publications/">http://www.splint.org/publications/</a></span>.&nbsp;&nbsp;&nbsp;&nbsp;</p>
+<p class="TextFontCX">&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+[Barker01] Chris Barker. <i>Static Error Checking of C Applications
+Ported from UNIX to WIN32 Systems Using LCLint</i>. Senior Thesis,
+University of Virginia Deptartment of Computer Science.&nbsp; May
+2001.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="IndentText">Describes annotations and checks useful for
+porting applications.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+[Evans94] David Evans. <i>Using specifications to check source
+code</i>.&nbsp; MIT/LCS/TR 628, Laboratory for Computer Science,
+MIT, June 1994.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="IndentText">MIT SM Thesis.&nbsp; Describes research
+behind Splint, focusing on how specifications can be exploited to
+do lightweight checking.&nbsp; Includes case studies using
+LCLint.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+[EGHT94] David Evans, John Guttag, Jim Horning and Yang Meng
+Tan.&nbsp; <i>LCL</i><i>int: A tool for using specifications to
+check code</i>.&nbsp; SIGSOFT Symposium on the Foundations of
+Software Engineering, December 1994.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="IndentText">Somewhat obsolete introduction to
+LCLint.&nbsp; Shows how LCLint is used to find errors in a sample
+program.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+[Evans96] David Evans.&nbsp; <i>Static Detection of Dynamic Memory
+Errors</i>.&nbsp; SIGPLAN Conference on Programming Language Design
+and Implementation (PLDI &#8217;96), Philadelphia, PA., May
+1996.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="IndentText">Describes approach for exploiting annotations
+added to code to detect a wide class of errors.&nbsp; Focuses on
+memory management checks described in Section 5 of this
+manual.&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+[Evans00] David Evans.&nbsp; <i>Annotation-Assisted Lightweight
+Static Checking.&nbsp;</i> First International Workshop on
+Automated Program Analysis, Testing and Verification.&nbsp;
+February, 2000.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="IndentText">Short position paper describing research
+agenda behind Splint.</p>
+<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
+<p class="IndentText" style='margin-left:0in'>[Evans02] David Evans
+and David Larochelle.&nbsp; <i>Improving Security Using Extensible
+Lightweight Static Analysis</i>.&nbsp; IEEE Software, Jan/Feb
+2002.</p>
+<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
+<p class="IndentText">Most security attacks exploit instances of
+well-known classes of implementations flaws.&nbsp; This article
+describes how Splint can be used to detect common security
+vulnerabilities (including buffer overflows and format string
+vulnerabilities).</p>
+<p class="IndentText">&nbsp;</p>
+<p class="IndentText" style='margin-left:0in'>[Larochelle01] David
+Larochelle and David Evans.&nbsp; Statically Detecting Likely
+Buffer Overflow Vulnerabilities.&nbsp; 2001 USENIX Security
+Symposium, Washington, D. C., August 13-17, 2001.&nbsp;</p>
+<p class="IndentText">&nbsp;</p>
+<p class="IndentText">Buffer overflow attacks may be today's single
+most important security threat. This paper describes how Splint can
+be used to detect likely vulnerabilities through an analysis of the
+program source code and presents experience using our approach to
+detect buffer overflow vulnerabilities in two security-sensitive
+programs.</p>
+<p class="IndentText">&nbsp;</p>
+<h4 style='margin-left:0in;text-indent:0in'>C</h4>
+<p class="TextFontCX" align="left" style='text-align: left'>[ISO99]
+International Standard ISO/IEC 9899.&nbsp; <i>Programming languages
+&#8211; C.</i>&nbsp; Second edition.&nbsp; December 1999.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="IndentText">International standard specification for C
+programming language.&nbsp; Approved by ANSI May 2000.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>[KR88]
+Brian W. Kernighan and Dennis M. Ritchie.&nbsp; <i>The C
+Programming Language</i>, second edition.&nbsp; Prentice Hall, New
+Jersey, 1988.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="IndentText">Standard reference for ANSI C.&nbsp; If you
+haven&#8217;t heard of this one, you probably didn&#8217;t get this
+far (unless you started at the back).</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>[vdL94]
+Peter van der Linden.&nbsp; <i>Expert C Programming:&nbsp; Deep C
+Secrets</i>.&nbsp; SunSoft Press, Prentice Hall, New Jersey,
+1994.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="IndentText">Filled with useful information on the darker
+corners of C, as well as lots of industry anecdotes and
+humor.&nbsp; Splint&#8217;s reserved name checking is loosely based
+on the list of reserved names in this book.</p>
+<h4 style='margin-left:0in;text-indent:0in'>Methodology</h4>
+<p class="TextFontCX" align="left" style='text-align: left'>[GH93]
+John Guttag and James Horning with Stephen J. Garland, Kevin D.
+Jones, Andr&#233;s Modet, and Jeannette M. Wing.&nbsp; <i>Larch:
+Languages and Tools for Formal Specification</i>. Springer-Verlag,
+Texts and Monographs in Computer Science, 1993.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="IndentText">Overview of the Larch family of specification
+languages and related tools.&nbsp; Includes a chapter on LCL, the
+Larch C interface language, on which Splint is based.</p>
+<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>[LG86]
+Barbara Liskov and John Guttag.&nbsp; <i>Abstraction and
+Specification in Program Development</i>, MIT Press, Cambridge, MA,
+1986.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="IndentText">Describes a programming methodology using
+abstract types&nbsp;and specified interfaces.&nbsp; Much of the
+methodology upon which Splint is based comes from this book.&nbsp;
+Uses the CLU programming language.&nbsp;</p>
+<p class="IndentText">&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+[Liskov01] Barbara Liskov with John Guttag.&nbsp; <i>Program
+Development in Java</i>, Addison Wesley, 2001.</p>
+<p class="IndentText">&nbsp;</p>
+<p class="IndentText">An updated version of [LG86] for the Java
+programming language.&nbsp;</p>
+<p class="IndentText">&nbsp;</p>
+<p class="TextFontCX" align="left" style='text-align: left'>[Tan95]
+Yang Meng Tan.&nbsp; <i>Formal Specification Techniques for
+Engineering Modular C</i>.&nbsp; Kluwer International Series in
+Software Engineering, Volume 1, Kluwer Academic Publishers, Boston,
+1995.</p>
+<p class="MsoNormal" align="left" style='text-align:left'>
+&nbsp;</p>
+<p class="IndentText">Modified and updated version of MIT Ph D
+thesis, previously published as MIT/LCS/TR-619, 1994.&nbsp;
+Includes presentation of the semantics of LCL and a case study
+using LCL.</p>
+<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
+<h4 style='margin-left:0in;text-indent:0in'>Secure Programming</h4>
+<p class="TextFontCX" align="left" style='text-align: left'>[Hat95]
+Les Hatton.&nbsp; <i>Safer C: Developing Software for
+High-integrity and Safety-critical Systems</i>.&nbsp; McGraw-Hill
+International Series in Software Engineering, 1995.</p>
+<p class="TextFontCX" align="left" style='text-align: left'>
+&nbsp;</p>
+<p class="IndentText">A broad work on all aspects of developing
+safety-critical software, focusing on the C language.&nbsp;
+Provides good justification for the use of C in safety-critical
+systems, and the necessity of tool-supported programming
+standards.&nbsp; Splint users will be interested to see how many of
+the errors listed as only being dynamically detectable can be
+detected statically by Splint.</p>
+<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
+<p class="IndentText" style='margin-left:0in'>[VM02] John Viega and
+Gary McGraw.&nbsp; <i>Building Secure Software: How to Avoid
+Security Problems the</i> <i>Right Way</i><i>.</i>&nbsp;
+Addison-Wesley, 2002.</p>
+<p class="IndentText">A comprehensive survey of techniques and
+principles for building secure programs.</p>
+<p class="IndentText" style='margin-left:0in'>&nbsp;</p>
+<p class="IndentText" style='margin-left:0in'>See also [Evans02]
+and
+[Larochelle01].</p></center></center></center></center></center></center></center></center></center></center></center></div>
+<span style=
+'font-size:11.0pt;font-family:"Times New Roman"'><br clear="all"
+style='page-break-before:right'></span> 
+
+<span style=
+'font-size:11.0pt;font-family:"Times New Roman"'><br clear="all"
+style='page-break-before:auto'></span> 
+<div class="Section8">
+<p class="IndentText">&nbsp;</p></div>
+<div><br clear="all">
+ 
+<hr align="left" size="1" width="33%">
+<div id="ftn1">
+<p class="MsoFootnoteText"><a href="#_ftnref1" name="_ftn1"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>
+   Lint is a common programming tool for detecting anomalies in C
+   programs.&nbsp; S. C. Johnson developed the original lint in the
+   late seventies, mainly because early versions of C did not
+   support function prototypes.&nbsp; Splint was originally named
+   LCLint because it was originally intended to check for
+   inconsistencies between LCL specifications and C
+   implementations.&nbsp; To reflect divergence from LCL and
+   increased focus on detecting security vulnerabilities, the name
+   was changed to Splint, short for &#8220;Specification
+   Lint&#8221; and &#8220;Secure Programming Lint&#8221;.</p></div>
+<div id="ftn2">
+<p class="MsoFootnoteText"><a href="#_ftnref2" name="_ftn2"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>
+   The meta-notation, <span class="Annot">item,<sup>+</sup></span>
+   is used to denote a comma separated list of items.&nbsp; For
+   example,
+   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+   <span class="Annot">/*@access mstring, intSet@*/</span></p>
+<p class="MsoFootnoteText">allows access to the representations of
+both <span class="CodeText">mstring</span> and <span class=
+"CodeText">intSet</span>.)&nbsp;&nbsp;</p></div>
+<div id="ftn3">
+<p class="MsoFootnoteText"><a href="#_ftnref3" name="_ftn3"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[3]</span></span></span></a>
+   This section is largely based on [Evans96].&nbsp; It
+   semi-formally defines some of the terms needed to describe
+   memory management checking; if you are satisfied with an
+   intuitive understanding of these terms, this section may be
+   skipped.</p></div>
+<div id="ftn4">
+<p class="MsoFootnoteText"><a href="#_ftnref4" name="_ftn4"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>
+   This is similar to the LISP storage model, except that objects
+   are typed.</p></div>
+<div id="ftn5">
+<p class="TextFontCX"><a href="#_ftnref5" name="_ftn5" title=
+""><span class="MsoFootnoteReference"><span class=
+"MsoFootnoteReference"><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>
+<span style='font-size:10.0pt'>Except</span> <span class=
+"CodeText"><span style=
+'font-size:10.0pt'>sizeof</span></span><span style=
+'font-size:10.0pt'>, which does not need the value of its
+argument.</span></p></div>
+<div id="ftn6">
+<p class="TextFontCX"><a href="#_ftnref6" name="_ftn6" title=
+""><span class="MsoFootnoteReference"><span class=
+"MsoFootnoteReference"><span style=
+'font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>
+If the storage is not assigned to a reference, an internal
+reference is created to track the storage.</p></div>
+<div id="ftn7">
+<p class="MsoFootnoteText"><a href="#_ftnref7" name="_ftn7"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a>
+   The declaration of <span class="CodeText">free</span> has a
+   <span class="Annot">null</span>&nbsp;annotation on the parameter
+   to indicate that the argument may be <span class=
+   "CodeText">NULL</span>.&nbsp; According to [ISO, 7.20.3.2],
+   <span class="CodeText">NULL</span> may be passed to
+      <span class="CodeText">free</span> without no action.&nbsp;
+      On some UNIX platforms, passing <span class=
+      "CodeText">NULL</span> to free causes a program crash so the
+      UNIX version of the standard library specifies <span class=
+      "CodeText">free</span> without the <span class=
+      "Annot">null</span> annotation on its parameter. To check
+      that allocated objects are completely destroyed (e.g., all
+      unshared objects inside a structure are deallocated before
+      the structure is deallocated), Splint checks that any
+      parameter passed as an <span class="CodeText">out only void
+      *</span> does not contain references to live, unshared
+      objects.&nbsp; This makes sense, since such a parameter could
+      not be used sensibly in any way other than deallocating its
+      storage.</p></div>
+<div id="ftn8">
+<p class="MsoFootnoteText"><a href="#_ftnref8" name="_ftn8"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[8]</span></span></span></a>
+   In versions of Splint before 3.0, the <span class=
+   "Annot">noreturn</span> annotation was named <span class=
+   "Annot">exits</span>.&nbsp; The <span class=
+   "Annot">noreturn</span> annotation means the same thing, but is
+   a more appropriate name.&nbsp; For legacy code, Splint still
+   supports the <span class="Annot">exits</span> annotations.&nbsp;
+   Similarly, <span class="Annot">maynotreturn</span> replaces
+   <span class="Annot">mayexit</span>, <span class=
+   "Annot">noreturnwhentrue</span> replaces <span class=
+   "Annot">truexit</span> and <span class=
+   "Annot">noreturnwhenfalse</span> replaces <span class=
+   "Annot">falseexit</span>.</p></div>
+<div id="ftn9">
+<p class="MsoFootnoteText"><a href="#_ftnref9" name="_ftn9"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>The
+   <span class="Annot">sef</span> annotation denotes a parameter as
+   side effect free (see Section 11.2.1).&nbsp; We use
+      <span class="CodeText">bool /*@alt int@*/</span> as the type
+      of the parameter, to indicate that it may be either a Boolean
+      or an integer.</p></div>
+<div id="ftn10">
+<p class="MsoFootnoteText"><a href="#_ftnref10" name="_ftn10"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>
+   Peter van der Linden estimates that default fall through is the
+   wrong behavior 97% of the time.&nbsp; [vdL95, p. 37]</p></div>
+<div id="ftn11">
+<p class="MsoFootnoteText"><a href="#_ftnref11" name="_ftn11"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>
+   &#8220;Software Glitch Cripples AT&amp;T Network&#8221;,
+   Telephony, 22 January 1990.</p></div>
+<div id="ftn12">
+<p class="MsoFootnoteText"><a href="#_ftnref12" name="_ftn12"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[12]</span></span></span></a>
+   See [Larochelle01] for information on internal aspects of the
+   checking.</p></div>
+<div id="ftn13">
+<p class="MsoFootnoteText"><a href="#_ftnref13" name="_ftn13"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[13]</span></span></span></a>
+   This section is largely based on [Evans02].</p></div>
+<div id="ftn14">
+<p class="MsoFootnoteText"><a href="#_ftnref14" name="_ftn14"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>
+   C. Cowan et al., <i>FormatGuard: Automatic Protection from
+   printf Format String Vulnerabilities</i>.&nbsp; 10th Usenix
+   Security Symposium, 2001.</p></div>
+<div id="ftn15">
+<p class="MsoFootnoteText"><a href="#_ftnref15" name="_ftn15"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>
+   To be completely correct, all the macro parameters should be
+   evaluated before the macro has any side effects.&nbsp; Splint
+   does not check this.</p></div>
+<div id="ftn16">
+<p class="MsoFootnoteText"><a href="#_ftnref16" name="_ftn16"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>
+   Functions that do not produce to the same result each time they
+   are called with the same arguments should be declared to modify
+   <span class="Annot">internalState</span> so they will lead to
+   errors if they are passed as <span class="Annot">sef</span>
+   parameters.</p></div>
+<div id="ftn17">
+<p class="MsoFootnoteText"><a href="#_ftnref17" name="_ftn17"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>
+   The most renowned C naming convention is the Hungarian naming
+   convention, introduced by Charles Simonyi [Simonyi, Charles, and
+   Martin Heller.&nbsp; &#8220;The Hungarian
+   Revolution.&#8221;&nbsp; <i>BYTE</i>, August 1991, p.
+   131-38].&nbsp; The names for Splint naming conventions follow
+   the tradition of using Central European nationalities as
+   mnemonics for naming conventions.&nbsp; The Splint conventions
+   are similar to the Hungarian naming convention in that they
+   encode type information in names, except that the Splint
+   conventions encode the names of accessible abstract
+   types&nbsp;instead of the type of the declaration of return
+   value.&nbsp; Prefixes used in the Hungarian naming convention
+   are not supported by Splint.</p>
+<p class="MsoFootnoteText">&nbsp;</p></div>
+<div id="ftn18">
+<p class="MsoFootnoteText"><a href="#_ftnref18" name="_ftn18"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>
+   Of course, namespace prefixes should really be described by
+   regular expressions.&nbsp; If there is sufficient interest (that
+   is, someone volunteers to program it), regular expressions will
+   be supported in a future version of Splint.</p></div>
+<div id="ftn19">
+<p class="MsoFootnoteText"><a href="#_ftnref19" name="_ftn19"
+   title=""><span class="MsoFootnoteReference"><span class=
+   "MsoFootnoteReference"><span style=
+   'font-size:10.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>
+   POSIX library was contributed by Jens
+   Schweikhardt.</p></div></div>
+<!--#include virtual="footer.html"-->
+</body>
+</html>

diff --git a/doc/manual.css b/doc/manual.css
new file mode 100755 (executable)
index 0000000..bc176a4
--- /dev/null
+++ b/doc/manual.css
@@ -0,0 +1,21 @@
+body { font-family: Arial, helvetica, sans-serif }
+h1 { font-family: Arial, helvetica, sans-serif; color: darkblue }
+h2 { font-family: Arial, helvetica, sans-serif; color: darkblue }
+h3 { font-family: Arial, helvetica, sans-serif; color: darkblue }
+h4 { font-family: Arial, helvetica, sans-serif; color: darkblue; top-padding: .2em }
+h5 { font-family: Arial, helvetica, sans-serif; color: darkblue; top-padding: .2em }
+
+body { background: white }
+title { font-family: Ariel, helvetica, sans-serif; color: darkblue }
+A:link { color: blue }
+A:visited { color: darkblue }
+A:active { color: green }
+body { margin-left: 0%; margin-right: 0%; margin-top: 0%; margin-bottom:
+0% }
+h4 { margin-left: 0%; margin-right: 0% }
+h3 { margin-left: 0%; margin-right: 0% }
+h2 { margin-left: 0%; margin-right: 0% }
+h1 { margin-left: 0%; margin-right: 0% }
+
+
+

diff --git a/doc/manual.htm b/doc/manual.htm
deleted file mode 100644 (file)
index 2840807..0000000
--- a/doc/manual.htm
+++ /dev/null
@@ -1,19886 +0,0 @@
-<html>\r
-<head>\r
-<link rel="stylesheet" type="text/css" href="http://www.splint.org/manual.css" title="style1">\r
-<title>Splint Manual</title>\r
-</head>\r
-<body>\r
-<!--#include virtual="header.html"-->\r
-\r
-<style>\r
-<!--\r
- /* Font Definitions */\r
- @font-face\r
-       {font-family:Helvetica;\r
-       panose-1:2 11 5 4 2 2 2 2 2 4;}\r
-@font-face\r
-       {font-family:Courier;\r
-       panose-1:2 7 4 9 2 2 5 2 4 4;}\r
-@font-face\r
-       {font-family:"Tms Rmn";\r
-       panose-1:2 2 6 3 4 5 5 2 3 4;}\r
-@font-face\r
-       {font-family:Helv;\r
-       panose-1:2 11 6 4 2 2 2 3 2 4;}\r
-@font-face\r
-       {font-family:"New York";\r
-       panose-1:2 4 5 3 6 5 6 2 3 4;}\r
-@font-face\r
-       {font-family:System;\r
-       panose-1:0 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Wingdings;\r
-       panose-1:5 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"MS Mincho";\r
-       panose-1:2 2 6 9 4 2 5 8 3 4;}\r
-@font-face\r
-       {font-family:Batang;\r
-       panose-1:2 3 6 0 0 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:SimSun;\r
-       panose-1:2 1 6 0 3 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:PMingLiU;\r
-       panose-1:2 1 6 1 0 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:"MS Gothic";\r
-       panose-1:2 11 6 9 7 2 5 8 2 4;}\r
-@font-face\r
-       {font-family:Dotum;\r
-       panose-1:2 11 6 0 0 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:SimHei;\r
-       panose-1:2 1 6 0 3 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:MingLiU;\r
-       panose-1:2 1 6 9 0 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:Mincho;\r
-       panose-1:2 2 6 9 4 3 5 8 3 5;}\r
-@font-face\r
-       {font-family:Gulim;\r
-       panose-1:2 11 6 0 0 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:Century;\r
-       panose-1:2 4 6 3 5 7 5 2 3 3;}\r
-@font-face\r
-       {font-family:"Angsana New";\r
-       panose-1:2 2 6 3 5 4 5 2 3 4;}\r
-@font-face\r
-       {font-family:"Cordia New";\r
-       panose-1:2 11 3 4 2 2 2 2 2 4;}\r
-@font-face\r
-       {font-family:Mangal;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Latha;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Sylfaen;\r
-       panose-1:1 10 5 2 5 3 6 3 3 3;}\r
-@font-face\r
-       {font-family:Vrinda;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Raavi;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Shruti;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Sendnya;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Gautami;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Tunga;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"Estrangella Edessa";\r
-       panose-1:0 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"Arial Unicode MS";\r
-       panose-1:0 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Tahoma;\r
-       panose-1:2 11 6 4 3 5 4 4 2 4;}\r
-@font-face\r
-       {font-family:"Book Antiqua";\r
-       panose-1:2 4 6 2 5 3 5 3 3 4;}\r
-@font-face\r
-       {font-family:"Arial Narrow";\r
-       panose-1:2 11 5 6 2 2 2 3 2 4;}\r
-@font-face\r
-       {font-family:Times;\r
-       panose-1:0 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Marlett;\r
-       panose-1:0 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"News Gothic MT";\r
-       panose-1:2 11 5 4 2 2 3 2 2 4;}\r
-@font-face\r
-       {font-family:"Lucida Sans Unicode";\r
-       panose-1:2 11 6 2 3 5 4 2 2 4;}\r
-@font-face\r
-       {font-family:"Century Gothic";\r
-       panose-1:2 11 5 2 2 2 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Abadi MT Condensed Light";\r
-       panose-1:2 11 3 6 3 1 1 1 1 3;}\r
-@font-face\r
-       {font-family:"Matisse ITC";\r
-       panose-1:4 4 4 3 3 13 2 2 7 4;}\r
-@font-face\r
-       {font-family:Westminster;\r
-       panose-1:4 4 5 6 3 15 2 2 7 2;}\r
-@font-face\r
-       {font-family:"Lucida Console";\r
-       panose-1:2 11 6 9 4 5 4 2 2 4;}\r
-@font-face\r
-       {font-family:"Arial Black";\r
-       panose-1:2 11 10 4 2 1 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Comic Sans MS";\r
-       panose-1:3 15 7 2 3 3 2 2 2 4;}\r
-@font-face\r
-       {font-family:Verdana;\r
-       panose-1:2 11 6 4 3 5 4 4 2 4;}\r
-@font-face\r
-       {font-family:Webdings;\r
-       panose-1:5 3 1 2 1 5 9 6 7 3;}\r
-@font-face\r
-       {font-family:"Verdana Ref";\r
-       panose-1:2 11 6 4 3 5 4 4 2 4;}\r
-@font-face\r
-       {font-family:"Georgia Ref";\r
-       panose-1:2 4 5 2 5 4 5 2 3 3;}\r
-@font-face\r
-       {font-family:RefSpecialty;\r
-       panose-1:2 0 5 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"MS Reference 1";\r
-       panose-1:5 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"MS Reference 2";\r
-       panose-1:0 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:Money;\r
-       panose-1:0 0 4 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"Mediascape OSD Icon";\r
-       panose-1:2 11 6 3 5 3 2 2 2 4;}\r
-@font-face\r
-       {font-family:Pronto;\r
-       panose-1:2 11 7 3 3 0 0 0 0 7;}\r
-@font-face\r
-       {font-family:"Agency FB";\r
-       panose-1:0 1 6 6 4 0 0 4 0 3;}\r
-@font-face\r
-       {font-family:Algerian;\r
-       panose-1:4 2 7 5 4 10 2 6 7 2;}\r
-@font-face\r
-       {font-family:"Arial Rounded MT Bold";\r
-       panose-1:2 15 7 4 3 5 4 3 2 4;}\r
-@font-face\r
-       {font-family:"Baskerville Old Face";\r
-       panose-1:2 2 6 2 8 5 5 2 3 3;}\r
-@font-face\r
-       {font-family:"Bauhaus 93";\r
-       panose-1:4 3 9 5 2 11 2 2 12 2;}\r
-@font-face\r
-       {font-family:"Bell MT";\r
-       panose-1:2 2 5 3 6 3 5 2 3 3;}\r
-@font-face\r
-       {font-family:"Berlin Sans FB";\r
-       panose-1:2 14 6 2 2 5 2 2 3 6;}\r
-@font-face\r
-       {font-family:"Bernard MT Condensed";\r
-       panose-1:2 5 8 6 6 9 5 2 4 4;}\r
-@font-face\r
-       {font-family:"Blackadder ITC";\r
-       panose-1:4 2 5 5 5 16 7 2 13 2;}\r
-@font-face\r
-       {font-family:"Bookman Old Style";\r
-       panose-1:2 5 6 4 5 5 5 2 2 4;}\r
-@font-face\r
-       {font-family:"Bradley Hand ITC";\r
-       panose-1:3 7 4 2 5 3 2 3 2 3;}\r
-@font-face\r
-       {font-family:"Britannic Bold";\r
-       panose-1:2 11 9 3 6 7 3 2 2 4;}\r
-@font-face\r
-       {font-family:Broadway;\r
-       panose-1:4 4 9 5 8 11 2 2 5 2;}\r
-@font-face\r
-       {font-family:"Brush Script MT";\r
-       panose-1:3 6 8 2 4 4 6 7 3 4;}\r
-@font-face\r
-       {font-family:"Californian FB";\r
-       panose-1:2 7 4 3 6 8 11 3 2 4;}\r
-@font-face\r
-       {font-family:"Calisto MT";\r
-       panose-1:2 4 6 3 5 5 5 3 3 4;}\r
-@font-face\r
-       {font-family:Castellar;\r
-       panose-1:2 10 4 2 6 4 6 1 3 1;}\r
-@font-face\r
-       {font-family:Centaur;\r
-       panose-1:2 3 5 4 5 2 5 2 3 4;}\r
-@font-face\r
-       {font-family:"Century Schoolbook";\r
-       panose-1:2 4 6 4 5 5 5 2 3 4;}\r
-@font-face\r
-       {font-family:Chiller;\r
-       panose-1:4 2 4 4 3 16 7 2 6 2;}\r
-@font-face\r
-       {font-family:"Colonna MT";\r
-       panose-1:4 2 8 5 6 2 2 3 2 3;}\r
-@font-face\r
-       {font-family:"Cooper Black";\r
-       panose-1:2 8 9 4 4 3 11 2 4 4;}\r
-@font-face\r
-       {font-family:"Copperplate Gothic Bold";\r
-       panose-1:2 14 7 5 2 2 6 2 4 4;}\r
-@font-face\r
-       {font-family:"Copperplate Gothic Light";\r
-       panose-1:2 14 5 7 2 2 6 2 4 4;}\r
-@font-face\r
-       {font-family:"Curlz MT";\r
-       panose-1:4 4 4 4 5 7 2 2 2 2;}\r
-@font-face\r
-       {font-family:"Edwardian Script ITC";\r
-       panose-1:3 3 3 2 4 7 7 13 8 4;}\r
-@font-face\r
-       {font-family:Elephant;\r
-       panose-1:2 2 9 4 9 5 5 2 3 3;}\r
-@font-face\r
-       {font-family:"Engravers MT";\r
-       panose-1:2 9 7 7 8 5 5 2 3 4;}\r
-@font-face\r
-       {font-family:"Eras Bold ITC";\r
-       panose-1:2 11 9 7 3 5 4 2 2 4;}\r
-@font-face\r
-       {font-family:"Eras Demi ITC";\r
-       panose-1:2 11 8 5 3 5 4 2 8 4;}\r
-@font-face\r
-       {font-family:"Eras Light ITC";\r
-       panose-1:2 11 4 2 3 5 4 2 8 4;}\r
-@font-face\r
-       {font-family:"Eras Medium ITC";\r
-       panose-1:2 11 6 2 3 5 4 2 8 4;}\r
-@font-face\r
-       {font-family:"Felix Titling";\r
-       panose-1:4 6 5 5 6 2 2 2 10 4;}\r
-@font-face\r
-       {font-family:"Footlight MT Light";\r
-       panose-1:2 4 6 2 6 3 10 2 3 4;}\r
-@font-face\r
-       {font-family:Forte;\r
-       panose-1:3 6 9 2 4 5 2 7 2 3;}\r
-@font-face\r
-       {font-family:"Franklin Gothic Book";\r
-       panose-1:2 11 5 3 2 1 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Franklin Gothic Demi";\r
-       panose-1:2 11 7 3 2 1 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Franklin Gothic Demi Cond";\r
-       panose-1:2 11 7 6 3 4 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Franklin Gothic Heavy";\r
-       panose-1:2 11 9 3 2 1 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Franklin Gothic Medium";\r
-       panose-1:2 11 6 3 2 1 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Franklin Gothic Medium Cond";\r
-       panose-1:2 11 6 6 3 4 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Freestyle Script";\r
-       panose-1:3 8 4 2 3 2 5 11 4 4;}\r
-@font-face\r
-       {font-family:"French Script MT";\r
-       panose-1:3 2 4 2 4 6 7 4 6 5;}\r
-@font-face\r
-       {font-family:Garamond;\r
-       panose-1:2 2 4 4 3 3 1 1 8 3;}\r
-@font-face\r
-       {font-family:Gigi;\r
-       panose-1:4 4 5 4 6 16 7 2 13 2;}\r
-@font-face\r
-       {font-family:"Gill Sans MT";\r
-       panose-1:2 11 5 2 2 1 4 2 2 3;}\r
-@font-face\r
-       {font-family:"Gill Sans MT Condensed";\r
-       panose-1:2 11 5 6 2 1 4 2 2 3;}\r
-@font-face\r
-       {font-family:"Gill Sans Ultra Bold";\r
-       panose-1:2 11 10 2 2 1 4 2 2 3;}\r
-@font-face\r
-       {font-family:"Gill Sans Ultra Bold Condensed";\r
-       panose-1:2 11 10 6 2 1 4 2 2 3;}\r
-@font-face\r
-       {font-family:"Gill Sans MT Ext Condensed Bold";\r
-       panose-1:2 11 9 2 2 1 4 2 2 3;}\r
-@font-face\r
-       {font-family:"Gloucester MT Extra Condensed";\r
-       panose-1:2 3 8 8 2 6 1 1 1 1;}\r
-@font-face\r
-       {font-family:"Goudy Old Style";\r
-       panose-1:2 2 5 2 5 3 5 2 3 3;}\r
-@font-face\r
-       {font-family:"Goudy Stout";\r
-       panose-1:2 2 9 4 7 3 11 2 4 1;}\r
-@font-face\r
-       {font-family:Haettenschweiler;\r
-       panose-1:2 11 7 6 4 9 2 6 2 4;}\r
-@font-face\r
-       {font-family:"Harlow Solid Italic";\r
-       panose-1:4 3 6 4 2 15 2 2 13 2;}\r
-@font-face\r
-       {font-family:Harrington;\r
-       panose-1:4 4 5 5 5 10 2 2 7 2;}\r
-@font-face\r
-       {font-family:"High Tower Text";\r
-       panose-1:2 4 5 2 5 5 6 3 3 3;}\r
-@font-face\r
-       {font-family:"Imprint MT Shadow";\r
-       panose-1:4 2 6 5 6 3 3 3 2 2;}\r
-@font-face\r
-       {font-family:Jokerman;\r
-       panose-1:4 9 6 5 6 13 6 2 7 2;}\r
-@font-face\r
-       {font-family:"Juice ITC";\r
-       panose-1:4 4 4 3 4 10 2 2 2 2;}\r
-@font-face\r
-       {font-family:"Kristen ITC";\r
-       panose-1:3 5 5 2 4 2 2 3 2 2;}\r
-@font-face\r
-       {font-family:"Kunstler Script";\r
-       panose-1:3 3 4 2 2 6 7 13 13 6;}\r
-@font-face\r
-       {font-family:"Lucida Bright";\r
-       panose-1:2 4 6 2 5 5 5 2 3 4;}\r
-@font-face\r
-       {font-family:"Lucida Calligraphy";\r
-       panose-1:3 1 1 1 1 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:"Lucida Fax";\r
-       panose-1:2 6 6 2 5 5 5 2 2 4;}\r
-@font-face\r
-       {font-family:"Lucida Handwriting";\r
-       panose-1:3 1 1 1 1 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:"Lucida Sans";\r
-       panose-1:2 11 6 2 3 5 4 2 2 4;}\r
-@font-face\r
-       {font-family:"Lucida Sans Typewriter";\r
-       panose-1:2 11 5 9 3 5 4 3 2 4;}\r
-@font-face\r
-       {font-family:Magneto;\r
-       panose-1:4 3 8 5 5 8 2 2 13 2;}\r
-@font-face\r
-       {font-family:"Maiandra GD";\r
-       panose-1:2 14 5 2 3 3 8 2 2 4;}\r
-@font-face\r
-       {font-family:"Matura MT Script Capitals";\r
-       panose-1:3 2 8 2 6 6 2 7 2 2;}\r
-@font-face\r
-       {font-family:Mistral;\r
-       panose-1:3 9 7 2 3 4 7 2 4 3;}\r
-@font-face\r
-       {font-family:"Modern No\. 20";\r
-       panose-1:2 7 7 4 7 5 5 2 3 3;}\r
-@font-face\r
-       {font-family:"Niagara Engraved";\r
-       panose-1:4 2 5 2 7 7 3 3 2 2;}\r
-@font-face\r
-       {font-family:"Niagara Solid";\r
-       panose-1:4 2 5 2 7 7 2 2 2 2;}\r
-@font-face\r
-       {font-family:"OCR A Extended";\r
-       panose-1:2 1 5 9 2 1 2 1 3 3;}\r
-@font-face\r
-       {font-family:"Old English Text MT";\r
-       panose-1:3 4 9 2 4 5 8 3 8 6;}\r
-@font-face\r
-       {font-family:Onyx;\r
-       panose-1:4 5 6 2 8 7 2 2 2 3;}\r
-@font-face\r
-       {font-family:"Palace Script MT";\r
-       panose-1:3 3 3 2 2 6 7 12 11 5;}\r
-@font-face\r
-       {font-family:Papyrus;\r
-       panose-1:3 7 5 2 6 5 2 3 2 5;}\r
-@font-face\r
-       {font-family:Parchment;\r
-       panose-1:3 4 6 2 4 7 8 4 8 4;}\r
-@font-face\r
-       {font-family:Perpetua;\r
-       panose-1:2 2 5 2 6 4 1 2 3 3;}\r
-@font-face\r
-       {font-family:"Perpetua Titling MT";\r
-       panose-1:2 2 5 2 6 5 5 2 8 4;}\r
-@font-face\r
-       {font-family:Playbill;\r
-       panose-1:4 5 6 3 10 6 2 2 2 2;}\r
-@font-face\r
-       {font-family:"Poor Richard";\r
-       panose-1:2 8 5 2 5 5 5 2 7 2;}\r
-@font-face\r
-       {font-family:Pristina;\r
-       panose-1:3 6 4 2 4 4 6 8 2 4;}\r
-@font-face\r
-       {font-family:"Rage Italic";\r
-       panose-1:3 7 5 2 4 5 7 7 3 4;}\r
-@font-face\r
-       {font-family:Ravie;\r
-       panose-1:4 4 8 5 5 8 9 2 6 2;}\r
-@font-face\r
-       {font-family:Rockwell;\r
-       panose-1:2 6 6 3 2 2 5 2 4 3;}\r
-@font-face\r
-       {font-family:"Rockwell Condensed";\r
-       panose-1:2 6 6 3 5 4 5 2 1 4;}\r
-@font-face\r
-       {font-family:"Rockwell Extra Bold";\r
-       panose-1:2 6 9 3 4 5 5 2 4 3;}\r
-@font-face\r
-       {font-family:"Informal Roman";\r
-       panose-1:3 6 4 2 3 4 6 11 2 4;}\r
-@font-face\r
-       {font-family:"Script MT Bold";\r
-       panose-1:3 4 6 2 4 6 7 8 9 4;}\r
-@font-face\r
-       {font-family:"Showcard Gothic";\r
-       panose-1:4 2 9 4 2 1 2 2 6 4;}\r
-@font-face\r
-       {font-family:"Snap ITC";\r
-       panose-1:4 4 10 7 6 10 2 2 2 2;}\r
-@font-face\r
-       {font-family:Stencil;\r
-       panose-1:4 4 9 5 13 8 2 2 4 4;}\r
-@font-face\r
-       {font-family:"Tempus Sans ITC";\r
-       panose-1:4 2 4 4 3 13 7 2 2 2;}\r
-@font-face\r
-       {font-family:"Trebuchet MS";\r
-       panose-1:2 11 6 3 2 2 2 2 2 4;}\r
-@font-face\r
-       {font-family:"Tw Cen MT";\r
-       panose-1:2 11 6 2 2 1 4 2 6 3;}\r
-@font-face\r
-       {font-family:"Tw Cen MT Condensed";\r
-       panose-1:2 11 6 6 2 1 4 2 2 3;}\r
-@font-face\r
-       {font-family:"Viner Hand ITC";\r
-       panose-1:3 7 5 2 3 5 2 2 2 3;}\r
-@font-face\r
-       {font-family:Vivaldi;\r
-       panose-1:3 2 6 2 5 5 6 9 8 4;}\r
-@font-face\r
-       {font-family:"Vladimir Script";\r
-       panose-1:3 5 4 2 4 4 7 7 3 5;}\r
-@font-face\r
-       {font-family:"Wide Latin";\r
-       panose-1:2 10 10 7 5 5 5 2 4 4;}\r
-@font-face\r
-       {font-family:"Wingdings 2";\r
-       panose-1:5 2 1 2 1 5 7 7 7 7;}\r
-@font-face\r
-       {font-family:"Wingdings 3";\r
-       panose-1:5 4 1 2 1 8 7 7 7 7;}\r
-@font-face\r
-       {font-family:"Berlin Sans FB Demi";\r
-       panose-1:2 14 8 2 2 5 2 2 3 6;}\r
-@font-face\r
-       {font-family:"Tw Cen MT Condensed Extra Bold";\r
-       panose-1:2 11 8 3 2 0 0 0 0 4;}\r
-@font-face\r
-       {font-family:"Almanac MT";\r
-       panose-1:5 1 1 1 1 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:"Beesknees ITC";\r
-       panose-1:4 4 10 5 5 13 2 2 5 2;}\r
-@font-face\r
-       {font-family:"Holidays MT";\r
-       panose-1:5 1 1 1 1 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:"Monotype Sorts";\r
-       panose-1:1 1 6 1 1 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:"Monotype Sorts 2";\r
-       panose-1:5 2 1 2 1 2 8 2 8 8;}\r
-@font-face\r
-       {font-family:"Pepita MT";\r
-       panose-1:3 6 4 2 4 5 2 7 8 4;}\r
-@font-face\r
-       {font-family:"Vacation MT";\r
-       panose-1:5 1 1 1 1 1 1 1 1 1;}\r
-@font-face\r
-       {font-family:"Map Symbols";\r
-       panose-1:0 5 1 2 1 7 6 2 5 7;}\r
-@font-face\r
-       {font-family:"Bookshelf Symbol 3";\r
-       panose-1:5 5 1 2 1 7 6 2 5 7;}\r
-@font-face\r
-       {font-family:Georgia;\r
-       panose-1:2 4 5 2 5 4 5 2 3 3;}\r
-@font-face\r
-       {font-family:"MS Outlook";\r
-       panose-1:5 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"Berling Antiqua";\r
-       panose-1:2 2 6 2 6 4 5 3 4 2;}\r
-@font-face\r
-       {font-family:Bookdings;\r
-       panose-1:5 0 0 0 0 0 0 0 0 0;}\r
-@font-face\r
-       {font-family:"Frutiger Linotype";\r
-       panose-1:2 11 6 4 3 5 4 4 2 4;}\r
-@font-face\r
-       {font-family:"Andale Mono";\r
-       panose-1:2 11 5 9 0 0 0 0 0 4;}\r
-@font-face\r
-       {font-family:Impact;\r
-       panose-1:2 11 8 6 3 9 2 5 2 4;}\r
-@font-face\r
-       {font-family:"Monotype Corsiva";\r
-       panose-1:3 1 1 1 1 2 1 1 1 1;}\r
-@font-face\r
-       {font-family:"MT Extra";\r
-       panose-1:5 5 1 2 1 2 5 2 2 2;}\r
-@font-face\r
-       {font-family:ProgramTwo;\r
-       panose-1:0 0 0 0 0 0 0 0 0 0;}\r
- /* Style Definitions */\r
- p.MsoNormal, li.MsoNormal, div.MsoNormal\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-h1\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       page-break-before:always;\r
-       page-break-after:avoid;\r
-       font-size:16.0pt;\r
-       font-family:"Times New Roman";}\r
-h2\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       page-break-after:avoid;\r
-       font-size:14.0pt;\r
-       font-family:"Times New Roman";}\r
-h3\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       page-break-after:avoid;\r
-       font-size:12.0pt;\r
-       font-family:"Times New Roman";}\r
-h4\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       page-break-after:avoid;\r
-       font-size:12.0pt;\r
-       font-family:"Times New Roman";}\r
-h5\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:normal;}\r
-h6\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:normal;\r
-       font-style:italic;}\r
-p.MsoHeading7, li.MsoHeading7, div.MsoHeading7\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       page-break-before:always;\r
-       page-break-after:avoid;\r
-       font-size:16.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:bold;}\r
-p.MsoHeading8, li.MsoHeading8, div.MsoHeading8\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       page-break-after:avoid;\r
-       font-size:14.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:bold;}\r
-p.MsoHeading9, li.MsoHeading9, div.MsoHeading9\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       text-indent:0in;\r
-       page-break-after:avoid;\r
-       font-size:12.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:bold;}\r
-p.MsoIndex1, li.MsoIndex1, div.MsoIndex1\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:10.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndex2, li.MsoIndex2, div.MsoIndex2\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:20.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndex3, li.MsoIndex3, div.MsoIndex3\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:30.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndex4, li.MsoIndex4, div.MsoIndex4\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:40.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndex5, li.MsoIndex5, div.MsoIndex5\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:50.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndex6, li.MsoIndex6, div.MsoIndex6\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:60.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndex7, li.MsoIndex7, div.MsoIndex7\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:70.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndex8, li.MsoIndex8, div.MsoIndex8\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:80.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndex9, li.MsoIndex9, div.MsoIndex9\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:1.25in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-10.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoToc1, li.MsoToc1, div.MsoToc1\r
-       {margin-top:9.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:4.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:bold;}\r
-p.MsoToc2, li.MsoToc2, div.MsoToc2\r
-       {margin-top:4.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:.15in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoToc3, li.MsoToc3, div.MsoToc3\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:22.3pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoToc4, li.MsoToc4, div.MsoToc4\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:30.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoToc5, li.MsoToc5, div.MsoToc5\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:40.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoToc6, li.MsoToc6, div.MsoToc6\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:50.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoToc7, li.MsoToc7, div.MsoToc7\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:60.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoToc8, li.MsoToc8, div.MsoToc8\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:70.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoToc9, li.MsoToc9, div.MsoToc9\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:80.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoFootnoteText, li.MsoFootnoteText, div.MsoFootnoteText\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:10.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoCommentText, li.MsoCommentText, div.MsoCommentText\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:20.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoHeader, li.MsoHeader, div.MsoHeader\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:bold;\r
-       font-style:italic;}\r
-p.MsoFooter, li.MsoFooter, div.MsoFooter\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:20.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoIndexHeading, li.MsoIndexHeading, div.MsoIndexHeading\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoCaption, li.MsoCaption, div.MsoCaption\r
-       {margin-top:6.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:6.0pt;\r
-       margin-left:0in;\r
-       text-align:center;\r
-       font-size:10.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:bold;}\r
-p.MsoTof, li.MsoTof, div.MsoTof\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:22.0pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-22.0pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-span.MsoFootnoteReference\r
-       {vertical-align:super;}\r
-span.MsoPageNumber\r
-       {vertical-align:baseline;}\r
-p.MsoListBullet, li.MsoListBullet, div.MsoListBullet\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:12.95pt;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       text-indent:-12.95pt;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.MsoTitle, li.MsoTitle, div.MsoTitle\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:center;\r
-       font-size:16.0pt;\r
-       font-family:Arial;\r
-       font-weight:bold;}\r
-p.MsoSubtitle, li.MsoSubtitle, div.MsoSubtitle\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:center;\r
-       font-size:12.0pt;\r
-       font-family:Arial;}\r
-p.MsoPlainText, li.MsoPlainText, div.MsoPlainText\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       line-height:200%;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-pre\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       font-size:10.0pt;\r
-       font-family:"Courier New";}\r
-p.TextFontCX, li.TextFontCX, div.TextFontCX\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.Appendix, li.Appendix, div.Appendix\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       page-break-after:avoid;\r
-       font-size:14.0pt;\r
-       font-family:"Times New Roman";\r
-       font-weight:bold;}\r
-p.Heading10, li.Heading10, div.Heading10\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       page-break-after:avoid;\r
-       font-size:12.0pt;\r
-       font-family:"Times New Roman";\r
-       letter-spacing:-.4pt;\r
-       font-weight:bold;}\r
-p.Heading11, li.Heading11, div.Heading11\r
-       {margin-top:12.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       page-break-after:avoid;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";\r
-       letter-spacing:-.4pt;\r
-       font-weight:bold;\r
-       font-style:italic;}\r
-span.Flag\r
-       {font-family:Tahoma;\r
-       }\r
-span.Annot\r
-       {font-family:Tahoma;\r
-       }\r
-span.PlainText\r
-       {font-family:"Courier New";}\r
-span.Keyword\r
-       {font-family:"Courier New";\r
-       }\r
-span.Line\r
-       {font-family:Arial;\r
-       font-style:italic;}\r
-span.implicit\r
-       {font-family:"Courier New";\r
-       color:gray;\r
-       font-style:italic;}\r
-span.HeadingNote\r
-       {font-family:"Times New Roman";\r
-       font-style:italic;}\r
-p.Author, li.Author, div.Author\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:3.0pt;\r
-       margin-left:0in;\r
-       text-align:center;\r
-       font-size:14.0pt;\r
-       font-family:Arial;\r
-       font-style:italic;}\r
-p.Verbatim, li.Verbatim, div.Verbatim\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       font-size:10.0pt;\r
-       font-family:"Courier New";\r
-       text-align:left}\r
-p.lclintrun, li.lclintrun, div.lclintrun\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       font-size:11.0pt;\r
-       font-family:"Arial Narrow";}\r
-p.IndentText, li.IndentText, div.IndentText\r
-       {margin-top:0in;\r
-       margin-right:.2in;\r
-       margin-bottom:0in;\r
-       margin-left:.2in;\r
-       margin-bottom:.0001pt;\r
-       text-align:left;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.beforelist, li.beforelist, div.beforelist\r
-       {margin-top:0in;\r
-       margin-right:0in;\r
-       margin-bottom:6.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.example, li.example, div.example\r
-       {margin-top:6.0pt;\r
-       margin-right:.2in;\r
-       margin-bottom:6.0pt;\r
-       margin-left:.2in;\r
-       font-size:9.5pt;\r
-       font-family:"Courier New";\r
-       text-align=left}\r
-p.skiplist, li.skiplist, div.skiplist\r
-       {margin-top:6.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.afterlist, li.afterlist, div.afterlist\r
-       {margin-top:6.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:0in;\r
-       margin-left:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.betweenlists, li.betweenlists, div.betweenlists\r
-       {margin-top:6.0pt;\r
-       margin-right:0in;\r
-       margin-bottom:6.0pt;\r
-       margin-left:0in;\r
-       text-align:justify;\r
-       font-size:11.0pt;\r
-       font-family:"Times New Roman";}\r
-p.indentbefore, li.indentbefore, div.indentbefore\r
-       {margin-top:0in;\r
-       margin-right:.2in;\r
-       margin-bottom:6.0pt;\r
-       margin-left:.2in;\r
-       font-size:11.0pt;\r
-       text-align:left;\r
-       font-family:"Times New Roman";}\r
-p.indentbefore0, li.indentbefore0, div.indentbefore0\r
-       {margin-top:0in;\r
-       margin-right:.2in;\r
-       margin-bottom:6.0pt;\r
-       margin-left:.2in;\r
-       font-size:11.0pt;\r
-       text-align:left;\r
-       font-family:"Times New Roman";}\r
-span.CodeText\r
-       {font-family:Arial;\r
-       }\r
-p.Sidebar, li.Sidebar, div.Sidebar\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       font-size:9.0pt;\r
-       font-family:"Times New Roman";}\r
-p.URL, li.URL, div.URL\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:10.0pt;\r
-       font-family:Arial;}\r
-span.StyleKeywordBold\r
-       {font-family:"Courier New";\r
-       color:white;\r
-       font-weight:bold;}\r
-p.ProgramName, li.ProgramName, div.ProgramName\r
-       {margin:0in;\r
-       margin-bottom:.0001pt;\r
-       text-align:justify;\r
-       font-size:10.0pt;\r
-       font-family:Arial;}\r
-span.Style1\r
-       {font-family:"Courier New";}\r
-span.ProgramNameChar\r
-       {font-family:Arial;}\r
-span.ProgramCode\r
-       {font-family:ProgramTwo;\r
-       }\r
-p.fileName, li.fileName, div.fileName\r
-       {margin-top:0in;\r
-       margin-right:.2in;\r
-       margin-bottom:0in;\r
-       margin-left:.2in;\r
-       margin-bottom:.0001pt;\r
-       font-size:10.0pt;\r
-       font-family:Arial;}\r
-p.FileName0, li.FileName0, div.FileName0\r
-       {margin-top:0in;\r
-       margin-right:.2in;\r
-       margin-bottom:0in;\r
-       margin-left:.2in;\r
-       margin-bottom:.0001pt;\r
-       font-size:10.0pt;\r
-       font-family:Arial;}\r
-span.FileNameChar\r
-       {font-family:Arial;}\r
-ins\r
-       {text-decoration:none;}\r
-span.msoIns\r
-       {text-decoration:underline;}\r
-span.msoDel\r
-       {text-decoration:line-through;\r
-       color:red;}\r
- /* Page Definitions */\r
- @page Section1\r
-       {size:8.5in 11.0in;\r
-       margin:1.0in 1.25in .75in 1.25in;}\r
-div.Section1\r
-       {page:Section1;}\r
-@page Section2\r
-       {size:8.5in 11.0in;\r
-       margin:1.0in 1.25in 1.0in 99.35pt;}\r
-div.Section2\r
-       {page:Section2;}\r
-@page Section3\r
-       {size:8.5in 11.0in;\r
-       margin:1.0in 1.25in 1.0in 99.35pt;}\r
-div.Section3\r
-       {page:Section3;}\r
-@page Section4\r
-       {size:8.5in 11.0in;\r
-       margin:1.0in 1.25in 1.0in 99.0pt;}\r
-div.Section4\r
-       {page:Section4;}\r
-@page Section5\r
-       {size:8.5in 11.0in;\r
-       margin:1.0in 1.25in 1.0in 1.25in;}\r
-div.Section5\r
-       {page:Section5;}\r
-@page Section6\r
-       {size:8.5in 11.0in;\r
-       margin:1.0in 1.25in 1.0in 1.25in;}\r
-div.Section6\r
-       {page:Section6;}\r
-@page Section7\r
-       {size:8.5in 11.0in;\r
-       margin:1.0in 1.25in 1.0in 1.25in;}\r
-div.Section7\r
-       {page:Section7;}\r
-@page Section8\r
-       {size:8.5in 11.0in;\r
-       margin:1.0in 1.25in 1.0in 1.25in;}\r
-div.Section8\r
-       {page:Section8;}\r
- /* List Definitions */\r
- ol\r
-       {margin-bottom:0in;}\r
-ul\r
-       {margin-bottom:0in;}\r
--->\r
-</style>\r
-\r
-</head>\r
-\r
-<body lang=EN-US>\r
-\r
-<div class=Section1>\r
-\r
-<p class=MsoTitle>\r
-<img width=189 height=219 src="manual-301_files/image001.jpg" hspace=12><a name="_Ref533872469"></a></p>\r
-\r
-<p class=MsoTitle><a name="_Ref483663680"></a><span class=MsoCommentReference><span\r
-style='font-size:20.0pt'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;\r
-font-family:"Book Antiqua"'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;\r
-font-family:"Book Antiqua"'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;\r
-font-family:"Book Antiqua"'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;\r
-font-family:"Book Antiqua"'>Splint Manual</span></span></p>\r
-\r
-<p class=MsoTitle><span class=MsoCommentReference><span style='font-size:26.0pt;\r
-font-family:"Book Antiqua"'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:\r
-18.0pt;font-family:"Book Antiqua"'>Version 3.0.1</span></span></p>\r
-\r
-<p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:\r
- 18.0pt;font-family:"Book Antiqua"'>7 January 2002</span></span></p>\r
-\r
-<p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:\r
-15.5pt'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:\r
-15.5pt'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoSubtitle><span class=MsoCommentReference><span style='font-size:\r
-15.5pt'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoNormal><span class=MsoCommentReference><span style='font-size:14.0pt;\r
-font-family:"Book Antiqua"'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoNormal><span class=MsoCommentReference><span style='font-size:14.0pt;\r
-font-family:"Book Antiqua"'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoNormal><span class=MsoCommentReference><span style='font-size:14.0pt;\r
-font-family:"Book Antiqua"'>&nbsp;</span></span></p>\r
-\r
-<p class=MsoNormal><span class=MsoCommentReference><span style='font-size:14.0pt;\r
-font-family:"Book Antiqua"'>&nbsp;</span></span></p>\r
-\r
-<p class=TextFontCX><span\r
-class=MsoCommentReference><span style='font-size:15.5pt'>&nbsp;</span></span></p>\r
-\r
-<p class=TextFontCX align=right style='margin-right:\r
--58.5pt;text-align:right'><img width=364 height=181\r
-src="manual-301_files/image002.gif" align=left hspace=12\r
-alt="Text Box:  &#13;&#10;Secure Programming Group&#13;&#10;University of Virginia &#13;&#10;Department of Computer Science&#13;&#10;&#13;&#10;"></p>\r
-\r
-<p class=TextFontCX style='margin-left:28.35pt;\r
-text-indent:-14.15pt'><span class=MsoCommentReference><span style='font-size:\r
-15.5pt'>&nbsp;</span></span></p>\r
-\r
-<p class=TextFontCX align=right style='margin-right:\r
-9.0pt;text-align:right'><span class=MsoCommentReference><i><span\r
-style='font-size:14.0pt'>&nbsp;</span></i></span></p>\r
-\r
-</div>\r
-\r
-<span class=MsoCommentReference><b><i><span style='font-size:14.0pt;font-family:\r
-Arial'><br clear=all style='page-break-before:auto'>\r
-</span></i></b></span>\r
-\r
-<div class=Section2><span class=MsoCommentReference><span style='font-size:\r
-15.5pt;font-family:"Times New Roman"'><br clear=all style='page-break-before:\r
-always'>\r
-</span></span>\r
-\r
-<p class=TextFontCX><span\r
-class=MsoCommentReference><b><span style='font-size:14.0pt;font-family:Arial'>&nbsp;</span></b></span></p>\r
-\r
-<h4 style='margin-left:0in;text-indent:0in'><span class=MsoCommentReference><span\r
-style='font-size:14.0pt'>Authors</span></span></h4>\r
-\r
-<p class=TextFontCX>This manual was written by\r
-David Evans, except for Section 9, which was written by David Larochelle and David Evans.</p>\r
-\r
-<h4 style='margin-left:0in;text-indent:0in'><span class=MsoCommentReference><span\r
-style='font-size:14.0pt'>Credits</span></span></h4>\r
-\r
-<p class=TextFontCX>Splint is developed and maintained\r
-by the Secure Programming Group at the University of Virginia Department of\r
-Computer Science.  David Evans is the project leader and the primary developer\r
-of Splint.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>David Larochelle developed\r
-the memory bounds checking.  University of Virginia students Chris Barker,\r
-David Friedman, Mike Lanouette and Hien Phan all contributed significantly to\r
-the development of Splint.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint is the successor to\r
-LCLint, a tool originally developed as a joint research project between the\r
-Massachusetts Institute of Technology and Digital Equipment Corporation\92s System\r
- Research Center.  David Evans was the primary designed and developer of LCLint. \r
-John Guttag and Jim Horning had the original idea for a static checking tool\r
-for detecting inconsistencies between LCL specifications and their C\r
-implementations.  They provided valuable advice on its functionality and design\r
-and were instrumental in its development.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint incorporates the\r
-original LCL checker developed by Yang Meng Tan.  This was built on the DECspec\r
-Project (Joe Wild, Gary Feldman, Steve Garland, and Bill McKeeman).  The LSL\r
-checker used by LCLint was developed by Steve Garland.  The original C grammar\r
-for LCLint was provided by Nate Osgood.  This work has also benefited greatly\r
-from discussions with Mike Burrows, Stephen Garland, Colin Godfrey, Steve\r
-Harrison, Yanlin Huang, Daniel Jackson, John Knight, David Larochelle, Angelika\r
-Leeb, Ulana Legedza, Anya Pogosyants, Avneesh Saxena, Seejo Sebastine, Navneet\r
-Singh, Raymie Stata, Yang Meng Tan, and Mark Vandevoorde.  I especially thank\r
-Angelika Leeb for many constructive comments on improving an early version of\r
-this document, Raymie Stata and Mark Vandevoorde for technical assistance, and\r
-Dorothy Curtis, Paco Hope, Scott Ruffner, Christina Jackson, David Ladd, and\r
-Jessica Greer for systems assistance.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Much of Splint\92s development\r
-has been driven by feedback from users in academia and industry.  Many more\r
-people than I can mention here have made contributions by suggesting\r
-improvements, reporting bugs, porting early versions of Splint to other\r
-platforms.  Particularly heroic contributions have been made by Nelson Beebe,\r
-Eric Bloodworth, Jutta Degener, Rick Farnbach, Chris Flatters, Huver Hu,\r
-Alexander Mai, John Gerard Malecki, Thomas G. McWilliams, Michael Meskes,\r
-Richard O\92Keefe, Jens Schweikhardt, Albert L. Ting and Jim Zelenka. Martin\r
-\93Herbert\94 Dietze and Mike Smith performed valiantly in producing the original\r
-Win32 and OS2 ports.  Tim Van Holder produced the <span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>automake</span></span>\r
-and <span class=Keyword><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>autoconf</span></span> distribution.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint research at the University\r
- of Virginia is currently funded in part by a grant from the NASA Langley Research\r
- Center, an NSF CAREER Award for swarm programming, and an NSF CCLI Award for\r
-using analysis to teach software engineering.  David Larochelle is funded by a\r
-USENIX student research grant.   <span style='font-size:20.0pt'> </span></p>\r
-\r
-</div>\r
-\r
-<span class=MsoCommentReference><span style='font-size:15.5pt;font-family:"Times New Roman"'><br\r
-clear=all style='page-break-before:right'>\r
-</span></span>\r
-\r
-<div class=Section3>\r
-\r
-<p class=MsoToc1 align=center style='text-align:center'><span\r
-class=MsoCommentReference><span style='font-size:15.5pt'>Contents</span></span></p>\r
-\r
-<p class=MsoToc1>1<span\r
-style='font-size:12.0pt;font-weight:normal'>      </span>Operation................................................................................................................ 11</p>\r
-\r
-<p class=MsoToc2>1.1<span style='font-size:12.0pt'>     </span>Warnings............................................................................................................. 11</p>\r
-\r
-<p class=MsoToc2>1.2<span style='font-size:12.0pt'>     </span>Flags.................................................................................................................... 12</p>\r
-\r
-<p class=MsoToc2>1.3<span style='font-size:12.0pt'>     </span>Stylized\r
-Comments............................................................................................... 12</p>\r
-\r
-<p class=MsoToc3>1.3.1<span style='font-size:12.0pt'>     </span>Annotations................................................................................................... 13</p>\r
-\r
-<p class=MsoToc3>1.3.2<span style='font-size:12.0pt'>     </span>Setting Flags.................................................................................................. 13</p>\r
-\r
-<p class=MsoToc1>2<span style='font-size:12.0pt;font-weight:normal'>      </span>Null\r
-Dereferences................................................................................................... 14</p>\r
-\r
-<p class=MsoToc3>2.1.1<span style='font-size:12.0pt'>     </span>Predicate\r
-Functions........................................................................................ 14</p>\r
-\r
-<p class=MsoToc3>2.1.2<span style='font-size:12.0pt'>     </span>Notnull\r
-Annotations........................................................................................ 15</p>\r
-\r
-<p class=MsoToc3>2.1.3<span style='font-size:12.0pt'>     </span>Relaxing Null\r
-Checking.................................................................................. 15</p>\r
-\r
-<p class=MsoToc1>3<span style='font-size:12.0pt;font-weight:normal'>      </span>Undefined\r
-Values.................................................................................................... 17</p>\r
-\r
-<p class=MsoToc3>3.1.1<span style='font-size:12.0pt'>     </span>Undefined\r
-Parameters................................................................................... 17</p>\r
-\r
-<p class=MsoToc3>3.1.2<span style='font-size:12.0pt'>     </span>Relaxing\r
-Checking......................................................................................... 18</p>\r
-\r
-<p class=MsoToc3>3.1.3<span style='font-size:12.0pt'>     </span>Partially\r
-Defined Structures............................................................................ 18</p>\r
-\r
-<p class=MsoToc1>4<span style='font-size:12.0pt;font-weight:normal'>      </span>Types....................................................................................................................... 19</p>\r
-\r
-<p class=MsoToc2>4.1<span style='font-size:12.0pt'>     </span>Built in C Types.................................................................................................... 19</p>\r
-\r
-<p class=MsoToc3>4.1.1<span style='font-size:12.0pt'>     </span>Characters.................................................................................................... 19</p>\r
-\r
-<p class=MsoToc3>4.1.2<span style='font-size:12.0pt'>     </span>Enumerators.................................................................................................. 19</p>\r
-\r
-<p class=MsoToc3>4.1.3<span style='font-size:12.0pt'>     </span>Numeric Types.............................................................................................. 19</p>\r
-\r
-<p class=MsoToc3>4.1.4<span style='font-size:12.0pt'>     </span>Arbitrary\r
-Integral Types................................................................................. 19</p>\r
-\r
-<p class=MsoToc2>4.2<span style='font-size:12.0pt'>     </span>Boolean Types..................................................................................................... 20</p>\r
-\r
-<p class=MsoToc2>4.3<span style='font-size:12.0pt'>     </span>Abstract Types..................................................................................................... 21</p>\r
-\r
-<p class=MsoToc3>4.3.1<span style='font-size:12.0pt'>     </span>Controlling\r
-Access......................................................................................... 22</p>\r
-\r
-<p class=MsoToc3>4.3.2<span style='font-size:12.0pt'>     </span>Mutability...................................................................................................... 23</p>\r
-\r
-<p class=MsoToc2>4.4<span style='font-size:12.0pt'>     </span>Polymorphism....................................................................................................... 24</p>\r
-\r
-<p class=MsoToc1>5<span style='font-size:12.0pt;font-weight:normal'>      </span>Memory\r
-Management............................................................................................ 25</p>\r
-\r
-<p class=MsoToc2>5.1<span style='font-size:12.0pt'>     </span>Storage Model...................................................................................................... 25</p>\r
-\r
-<p class=MsoToc2>5.2<span style='font-size:12.0pt'>     </span>Deallocation\r
-Errors............................................................................................... 26</p>\r
-\r
-<p class=MsoToc3>5.2.1<span style='font-size:12.0pt'>     </span>Unshared\r
-References.................................................................................... 26</p>\r
-\r
-<p class=MsoToc3>5.2.2<span style='font-size:12.0pt'>     </span>Temporary\r
-Parameters.................................................................................. 27</p>\r
-\r
-<p class=MsoToc3>5.2.3<span style='font-size:12.0pt'>     </span>Owned and\r
-Dependent References................................................................. 27</p>\r
-\r
-<p class=MsoToc3>5.2.4<span style='font-size:12.0pt'>     </span>Keep\r
-Parameters........................................................................................... 28</p>\r
-\r
-<p class=MsoToc3>5.2.5<span style='font-size:12.0pt'>     </span>Shared\r
-References........................................................................................ 28</p>\r
-\r
-<p class=MsoToc3>5.2.6<span style='font-size:12.0pt'>     </span>Stack\r
-References.......................................................................................... 28</p>\r
-\r
-<p class=MsoToc3>5.2.7<span style='font-size:12.0pt'>     </span>Inner Storage................................................................................................. 28</p>\r
-\r
-<p class=MsoToc2>5.3<span style='font-size:12.0pt'>     </span>Implicit Memory\r
-Annotations................................................................................. 29</p>\r
-\r
-<p class=MsoToc2>5.4<span style='font-size:12.0pt'>     </span>Reference\r
-Counting.............................................................................................. 30</p>\r
-\r
-<p class=MsoToc1>6<span style='font-size:12.0pt;font-weight:normal'>      </span>Sharing.................................................................................................................... 31</p>\r
-\r
-<p class=MsoToc2>6.1<span style='font-size:12.0pt'>     </span>Aliasing................................................................................................................ 31</p>\r
-\r
-<p class=MsoToc3>6.1.1<span style='font-size:12.0pt'>     </span>Unique\r
-Parameters........................................................................................ 31</p>\r
-\r
-<p class=MsoToc3>6.1.2<span style='font-size:12.0pt'>     </span>Returned\r
-Parameters..................................................................................... 31</p>\r
-\r
-<p class=MsoToc2>6.2<span style='font-size:12.0pt'>     </span>Exposure.............................................................................................................. 32</p>\r
-\r
-<p class=MsoToc3>6.2.1<span style='font-size:12.0pt'>     </span>Read-Only\r
-Storage........................................................................................ 32</p>\r
-\r
-<p class=MsoToc3>6.2.2<span style='font-size:12.0pt'>     </span>Exposed\r
-Storage............................................................................................ 33</p>\r
-\r
-<p class=MsoToc1>7<span style='font-size:12.0pt;font-weight:normal'>      </span>Function\r
-Interfaces................................................................................................. 35</p>\r
-\r
-<p class=MsoToc2>7.1<span style='font-size:12.0pt'>     </span>Modifications........................................................................................................ 35</p>\r
-\r
-<p class=MsoToc3>7.1.1<span style='font-size:12.0pt'>     </span>State\r
-Modifications........................................................................................ 36</p>\r
-\r
-<p class=MsoToc3>7.1.2<span style='font-size:12.0pt'>     </span>Missing\r
-Modifies Clauses............................................................................... 36</p>\r
-\r
-<p class=MsoToc2>7.2<span style='font-size:12.0pt'>     </span>Global Variables................................................................................................... 37</p>\r
-\r
-<p class=MsoToc3>7.2.1<span style='font-size:12.0pt'>     </span>Controlling Globals\r
-Checking.......................................................................... 37</p>\r
-\r
-<p class=MsoToc3>7.2.2<span style='font-size:12.0pt'>     </span>Definition\r
-State.............................................................................................. 38</p>\r
-\r
-<p class=MsoToc2>7.3<span style='font-size:12.0pt'>     </span>Declaration\r
-Consistency........................................................................................ 38</p>\r
-\r
-<p class=MsoToc2>7.4<span style='font-size:12.0pt'>     </span>State Clauses....................................................................................................... 39</p>\r
-\r
-<p class=MsoToc2>7.5<span style='font-size:12.0pt'>     </span>Requires and\r
-Ensures Clauses............................................................................... 41</p>\r
-\r
-<p class=MsoToc1>8<span style='font-size:12.0pt;font-weight:normal'>      </span>Control\r
-Flow........................................................................................................... 43</p>\r
-\r
-<p class=MsoToc2>8.1<span style='font-size:12.0pt'>     </span>Execution............................................................................................................. 43</p>\r
-\r
-<p class=MsoToc2>8.2<span style='font-size:12.0pt'>     </span>Undefined\r
-Behavior.............................................................................................. 44</p>\r
-\r
-<p class=MsoToc2>8.3<span style='font-size:12.0pt'>     </span>Problematic\r
-Control Structures.............................................................................. 45</p>\r
-\r
-<p class=MsoToc3>8.3.1<span style='font-size:12.0pt'>     </span>Likely\r
-Infinite Loops...................................................................................... 45</p>\r
-\r
-<p class=MsoToc3>8.3.2<span style='font-size:12.0pt'>     </span>Switches....................................................................................................... 46</p>\r
-\r
-<p class=MsoToc3>8.3.3<span style='font-size:12.0pt'>     </span>Deep Breaks................................................................................................. 46</p>\r
-\r
-<p class=MsoToc3>8.3.4<span style='font-size:12.0pt'>     </span>Loop and If\r
-Bodies........................................................................................ 47</p>\r
-\r
-<p class=MsoToc3>8.3.5<span style='font-size:12.0pt'>     </span>Complete Logic............................................................................................. 47</p>\r
-\r
-<p class=MsoToc2>8.4<span style='font-size:12.0pt'>     </span>Suspicious\r
-Statements........................................................................................... 47</p>\r
-\r
-<p class=MsoToc3>8.4.1<span style='font-size:12.0pt'>     </span>Statements\r
-with No Effects............................................................................ 47</p>\r
-\r
-<p class=MsoToc3>8.4.2<span style='font-size:12.0pt'>     </span>Ignored Return\r
-Values................................................................................... 48</p>\r
-\r
-<p class=MsoToc1>9<span style='font-size:12.0pt;font-weight:normal'>      </span>Buffer\r
-Sizes............................................................................................................. 49</p>\r
-\r
-<p class=MsoToc2>9.1<span style='font-size:12.0pt'>     </span>Checking Accesses.............................................................................................. 49</p>\r
-\r
-<p class=MsoToc2>9.2<span style='font-size:12.0pt'>     </span>Annotating\r
-Buffer Sizes........................................................................................ 49</p>\r
-\r
-<p class=MsoToc2>9.3<span style='font-size:12.0pt'>     </span>Warnings............................................................................................................. 50</p>\r
-\r
-<p class=MsoToc1>10<span style='font-size:12.0pt;font-weight:normal'>      </span>Extensible\r
-Checking............................................................................................ 52</p>\r
-\r
-<p class=MsoToc2>10.1<span style='font-size:12.0pt'>       </span>Defining\r
-Attributes............................................................................................ 52</p>\r
-\r
-<p class=MsoToc2>10.2<span style='font-size:12.0pt'>       </span>Annotations...................................................................................................... 54</p>\r
-\r
-<p class=MsoToc2>10.3<span style='font-size:12.0pt'>       </span>Example........................................................................................................... 54</p>\r
-\r
-<p class=MsoToc1>11<span style='font-size:12.0pt;font-weight:normal'>      </span>Macros.................................................................................................................. 55</p>\r
-\r
-<p class=MsoToc2>11.1<span style='font-size:12.0pt'>       </span>Constant\r
-Macros............................................................................................... 55</p>\r
-\r
-<p class=MsoToc2>11.2<span style='font-size:12.0pt'>       </span>Function-like\r
-Macros......................................................................................... 55</p>\r
-\r
-<p class=MsoToc3>11.2.1<span style='font-size:12.0pt'>       </span>Side Effect\r
-Free Parameters....................................................................... 56</p>\r
-\r
-<p class=MsoToc2>11.3<span style='font-size:12.0pt'>       </span>Controlling\r
-Macro Checking............................................................................... 57</p>\r
-\r
-<p class=MsoToc2>11.4<span style='font-size:12.0pt'>       </span>Iterators........................................................................................................... 58</p>\r
-\r
-<p class=MsoToc3>11.4.1<span style='font-size:12.0pt'>       </span>Defining\r
-Iterators....................................................................................... 58</p>\r
-\r
-<p class=MsoToc3>11.4.2<span style='font-size:12.0pt'>       </span>Using Iterators........................................................................................... 58</p>\r
-\r
-<p class=MsoToc1>12<span style='font-size:12.0pt;font-weight:normal'>      </span>Naming\r
-Conventions............................................................................................ 60</p>\r
-\r
-<p class=MsoToc2>12.1<span style='font-size:12.0pt'>       </span>Type-Based\r
-Naming Conventions...................................................................... 60</p>\r
-\r
-<p class=MsoToc3>12.1.1<span style='font-size:12.0pt'>       </span>Czech Names............................................................................................. 60</p>\r
-\r
-<p class=MsoToc3>12.1.2<span style='font-size:12.0pt'>       </span>Slovak\r
-Names............................................................................................ 61</p>\r
-\r
-<p class=MsoToc3>12.1.3<span style='font-size:12.0pt'>       </span>Czechoslovak\r
-Names.................................................................................. 61</p>\r
-\r
-<p class=MsoToc2>12.2<span style='font-size:12.0pt'>       </span>Namespace\r
-Prefixes......................................................................................... 61</p>\r
-\r
-<p class=MsoToc2>12.3<span style='font-size:12.0pt'>       </span>Naming\r
-Restrictions.......................................................................................... 63</p>\r
-\r
-<p class=MsoToc3>12.3.1<span style='font-size:12.0pt'>       </span>Reserved\r
-Names........................................................................................ 63</p>\r
-\r
-<p class=MsoToc3>12.3.2<span style='font-size:12.0pt'>       </span>Distinct\r
-Names........................................................................................... 63</p>\r
-\r
-<p class=MsoToc1>13<span style='font-size:12.0pt;font-weight:normal'>      </span>Completeness....................................................................................................... 65</p>\r
-\r
-<p class=MsoToc2>13.1<span style='font-size:12.0pt'>       </span>Unused\r
-Declarations......................................................................................... 65</p>\r
-\r
-<p class=MsoToc2>13.2<span style='font-size:12.0pt'>       </span>Complete\r
-Programs........................................................................................... 65</p>\r
-\r
-<p class=MsoToc3>13.2.1<span style='font-size:12.0pt'>       </span>Unnecessarily\r
-External Names.................................................................... 65</p>\r
-\r
-<p class=MsoToc3>13.2.2<span style='font-size:12.0pt'>       </span>Declarations\r
-Missing from Headers............................................................. 65</p>\r
-\r
-<p class=MsoToc1>14<span style='font-size:12.0pt;font-weight:normal'>      </span>Libraries\r
-and Header File Inclusion.................................................................... 66</p>\r
-\r
-<p class=MsoToc2>14.1<span style='font-size:12.0pt'>       </span>Standard\r
-Libraries............................................................................................. 66</p>\r
-\r
-<p class=MsoToc3>14.1.1<span style='font-size:12.0pt'>       </span>ISO\r
-Standard Library.................................................................................. 66</p>\r
-\r
-<p class=MsoToc3>14.1.2<span style='font-size:12.0pt'>       </span>POSIX\r
-Library........................................................................................... 66</p>\r
-\r
-<p class=MsoToc3>14.1.3<span style='font-size:12.0pt'>       </span>UNIX\r
-Library............................................................................................ 66</p>\r
-\r
-<p class=MsoToc3>14.1.4<span style='font-size:12.0pt'>       </span>Strict\r
-Libraries............................................................................................ 66</p>\r
-\r
-<p class=MsoToc2>14.2<span style='font-size:12.0pt'>       </span>Generating\r
-Libraries.......................................................................................... 67</p>\r
-\r
-<p class=MsoToc3>14.2.1<span style='font-size:12.0pt'>       </span>Generating\r
-the Standard Libraries................................................................ 67</p>\r
-\r
-<p class=MsoToc2>14.3<span style='font-size:12.0pt'>       </span>Header File\r
-Inclusion......................................................................................... 68</p>\r
-\r
-<p class=MsoToc3>14.3.1<span style='font-size:12.0pt'>       </span>Preprocessing\r
-Constants............................................................................. 68</p>\r
-\r
-<p class=MsoToc1>Appendix A<span style='font-size:12.0pt;font-weight:normal'>    </span>Availability............................................................................................... 71</p>\r
-\r
-<p class=MsoToc1>Appendix B<span style='font-size:12.0pt;font-weight:normal'>    </span>Flags........................................................................................................ 72</p>\r
-\r
-<p class=MsoToc2>Global Flags................................................................................................................... 72</p>\r
-\r
-<p class=MsoToc3>Help.......................................................................................................................... 72</p>\r
-\r
-<p class=MsoToc3>Initialization................................................................................................................ 72</p>\r
-\r
-<p class=MsoToc3>Pre-processor............................................................................................................ 73</p>\r
-\r
-<p class=MsoToc3>Libraries.................................................................................................................... 73</p>\r
-\r
-<p class=MsoToc3>Output....................................................................................................................... 74</p>\r
-\r
-<p class=MsoToc3>Expected Errors......................................................................................................... 75</p>\r
-\r
-<p class=MsoToc2>Message Format............................................................................................................ 75</p>\r
-\r
-<p class=MsoToc2>Mode Selector Flags....................................................................................................... 75</p>\r
-\r
-<p class=MsoToc2>Checking Flags............................................................................................................... 76</p>\r
-\r
-<p class=MsoToc3>Key........................................................................................................................... 76</p>\r
-\r
-<p class=MsoToc3>Types........................................................................................................................ 76</p>\r
-\r
-<p class=MsoToc3>Function Interfaces..................................................................................................... 79</p>\r
-\r
-<p class=MsoToc3>Memory Management................................................................................................ 81</p>\r
-\r
-<p class=MsoToc3>Sharing...................................................................................................................... 84</p>\r
-\r
-<p class=MsoToc3>Use Before Definition <i>(Section 3)</i>............................................................................... 85</p>\r
-\r
-<p class=MsoToc3>Null Dereferences <i>(Section 2)</i>.................................................................................... 85</p>\r
-\r
-<p class=MsoToc3>Macros <i>(Section 7)</i>.................................................................................................... 85</p>\r
-\r
-<p class=MsoToc3>Iterators..................................................................................................................... 86</p>\r
-\r
-<p class=MsoToc3>Naming Conventions................................................................................................... 86</p>\r
-\r
-<p class=MsoToc3>Other Checks............................................................................................................. 90</p>\r
-\r
-<p class=MsoToc2>Flag Name Abbreviations................................................................................................ 95</p>\r
-\r
-<p class=MsoToc1>Appendix C<span style='font-size:12.0pt;font-weight:normal'>    </span>Annotations............................................................................................. 97</p>\r
-\r
-<p class=MsoToc3>Suppressing Warnings................................................................................................. 97</p>\r
-\r
-<p class=MsoToc2>Syntactic Annotations..................................................................................................... 97</p>\r
-\r
-<p class=MsoToc3>Functions................................................................................................................... 97</p>\r
-\r
-<p class=MsoToc3>Iterators (Section 11.4)............................................................................................... 98</p>\r
-\r
-<p class=MsoToc3>Constants (Section 11.1)............................................................................................. 98</p>\r
-\r
-<p class=MsoToc3>Alternate Types (Section 4.4)...................................................................................... 98</p>\r
-\r
-<p class=MsoToc3>Declarator Annotations............................................................................................... 98</p>\r
-\r
-<p class=MsoToc3>Type Access.............................................................................................................. 98</p>\r
-\r
-<p class=MsoToc3>Macro Expansion...................................................................................................... 101</p>\r
-\r
-<p class=MsoToc3>Arbitrary Integral Types............................................................................................ 102</p>\r
-\r
-<p class=MsoToc3>Traditional Lint Comments........................................................................................ 102</p>\r
-\r
-<p class=MsoToc2>Metastate Definitions.................................................................................................... 103</p>\r
-\r
-<p class=MsoToc1>Appendix D<span style='font-size:12.0pt;font-weight:normal'>    </span>Specifications......................................................................................... 104</p>\r
-\r
-<p class=MsoToc3>Specification Flags.................................................................................................... 104</p>\r
-\r
-<p class=MsoToc1>Appendix E<span style='font-size:12.0pt;font-weight:normal'>    </span>Annotated\r
-Bibliography........................................................................ 107</p>\r
-\r
-<p class=MsoToc1>Index............................................................................................................................. 111</p>\r
-\r
-<p class=TextFontCX><span\r
-class=MsoCommentReference><i><span style='font-size:15.5pt;text-transform:uppercase'><b>&nbsp;</b></span></i></span></p>\r
-\r
-<p class=MsoToc1 align=center style='text-align:center'><span\r
-class=MsoCommentReference><span style='font-size:15.5pt'>Figures</span></span></p>\r
-\r
-<p class=MsoNormal>&nbsp;</p>\r
-\r
-<p class=MsoTof>Figure 1.  Typical Effort-Benefit Curve for Using Splint....................................................... 10</p>\r
-\r
-<p class=MsoTof>Figure 2.  Null Checking..................................................................................................... 14</p>\r
-\r
-<p class=MsoTof>Figure 3.  Use before Definition.......................................................................................... 18</p>\r
-\r
-<p class=MsoTof>Figure 4.  Boolean Checking............................................................................................... 21</p>\r
-\r
-<p class=MsoTof>Figure 5.  Information Hiding Violations............................................................................... 22</p>\r
-\r
-<p class=MsoTof>Figure 6.  Memory Management......................................................................................... 27</p>\r
-\r
-<p class=MsoTof>Figure 7.  Stack-Allocated Storage...................................................................................... 28</p>\r
-\r
-<p class=MsoTof>Figure 8.  Implicit Annotations............................................................................................ 29</p>\r
-\r
-<p class=MsoTof>Figure 9.  Reference Counting............................................................................................ 30</p>\r
-\r
-<p class=MsoTof>Figure 10.  Unique parameters............................................................................................ 31</p>\r
-\r
-<p class=MsoTof>Figure 11.  Exposure.......................................................................................................... 34</p>\r
-\r
-<p class=MsoTof>Figure 12.  Modification...................................................................................................... 36</p>\r
-\r
-<p class=MsoTof>Figure 13.  Global Variables................................................................................................ 37</p>\r
-\r
-<p class=MsoTof>Figure 14.  Annotated Globals Lists..................................................................................... 38</p>\r
-\r
-<p class=MsoTof>Figure 15.  State Clauses.................................................................................................... 41</p>\r
-\r
-<p class=MsoTof>Figure 16.  Evaluation Order............................................................................................... 44</p>\r
-\r
-<p class=MsoTof>Figure 17.  Infinite Loops.................................................................................................... 45</p>\r
-\r
-<p class=MsoTof>Figure 18.  Switch Cases.................................................................................................... 46</p>\r
-\r
-<p class=MsoTof>Figure 19.  Statements with No Effect................................................................................. 48</p>\r
-\r
-<p class=MsoTof>Figure 20.  Ignored Return Values...................................................................................... 48</p>\r
-\r
-<p class=MsoTof>Figure 21.  Prefix Character Codes..................................................................................... 65</p>\r
-\r
-<p class=MsoTof>Figure 22.  Distinct Names................................................................................................. 66</p>\r
-\r
-<p class=MsoTof>Figure 23.  Flag Name Abbreviations.................................................................................. 98</p>\r
-\r
-<p class=TextFontCX></p>\r
-\r
-</div>\r
-\r
-<span class=MsoCommentReference><b><i><span style='font-size:15.5pt;font-family:\r
-"Times New Roman";text-transform:uppercase'><br clear=all style='page-break-before:\r
-right'>\r
-</span></i></b></span>\r
-\r
-<div class=Section4>\r
-\r
-<p class=TextFontCX><span style='font-size:16.0pt'>&nbsp;</span></p>\r
-\r
-<p class=MsoNormal align=center style='text-align:center'><b><span\r
-style='font-size:16.0pt'>Splint User\92s Manual</span></b></p>\r
-\r
-<p class=MsoNormal align=center style='text-align:center'>&nbsp;</p>\r
-\r
-<p class=MsoNormal align=center style='text-align:center'>Version 3.0.1</p>\r
-\r
-<p class=MsoNormal align=center style='text-align:center'>7 January 2002</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint<a href="#_ftn1"\r
-name="_ftnref1" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>\r
-is a tool for statically checking C programs for security vulnerabilities and\r
-programming mistakes.  Splint does many of the traditional lint checks\r
-including unused declarations, type inconsistencies, use before definition, unreachable code, ignored return values, execution paths with no return, likely\r
-infinite loops, and fall through cases.  More powerful checks are made possible\r
-by additional information given in source code annotations.  Annotations are stylized comments that document assumptions about functions, variables,\r
-parameters and types.  In addition to the checks specifically enabled by\r
-annotations, many of the traditional lint checks are improved by exploiting\r
-this additional information.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>As more effort is put into\r
-annotating programs, better checking results. A representational effort-benefit\r
-curve for using Splint is shown in Figure 1.  Splint is designed to be flexible and allow programmers to select appropriate points on the effort-benefit curve for particular projects.  As different checks are turned on and more information is given in code\r
-annotations the number of bugs that can be detected increases dramatically.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>Problems detected by Splint include:</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Dereferencing a possibly null pointer (Section 2);</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Using possibly undefined storage or returning storage that is not\r
-properly defined (Section&nbsp;3);</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Type\r
-mismatches, with greater precision and flexibility than provided by C compilers\r
-(Section 4.1\964.2);</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Violations\r
-of information hiding (Section 4.3);</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Memory management errors including uses of dangling references\r
-and memory leaks  (Section 5);</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Dangerous aliasing (Section 6);</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Modifications and global variable uses that are inconsistent with\r
-specified interfaces (Section 7);</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Problematic control flow such as likely infinite loops (Section 8.3.1), fall through cases or incomplete switches (Section 8.3.2), and suspicious statements (Section 8.4);</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Buffer overflow vulnerabilities (Section 9);</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Dangerous macro implementations or invocations (Section 11); and</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Violations of customized naming conventions.  (Section 12).</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=MsoCaption>\r
-<center><img width=572 height=350\r
-src="manual-301_files/image003.gif"><center>\r
-</p>\r
-\r
-<p class=MsoCaption><a name="_Toc534824605"></a><a name="_Ref534821281">Figure </a>1.  Typical Effort-Benefit Curve</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint checking can be\r
-customized to select what classes of errors are reported using command line\r
-flags and stylized comments in the code.  In addition, users can define new annotations and associated checks to extend Splint\92s checking or to enforce application\r
-specific properties (Section 10).</p>\r
-\r
-<p class=TextFontCX><a name="_Ref343085763"></a><a\r
-name="_Ref343065516">&nbsp;</a></p>\r
-\r
-<p class=TextFontCX><b>About This Document</b></p>\r
-\r
-<p class=TextFontCX>This document is a guide to\r
-using Splint.  Section 1 explains how to run Splint, interpret messages and\r
-control checking.  Sections 2\9613 describe particular checks done by Splint.  There are some minor dependencies between sections, but in general they can be read in any order.  Section 14 covers issues involving libraries and header file inclusion important for running Splint on large systems.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>This document does not\r
-describe technical details of the checking.  For technical background and\r
-analysis of Splint\92s effectiveness in practice, see the papers available at <a\r
-href="http://www.splint.org/"><span style='font-size:10.0pt;font-family:Arial'>http://www.splint.org</span></a>. \r
-</p>\r
-\r
-<center>\r
-<table cellspacing=0 cellpadding=0 hspace=0 width="80%" style="border-collapse: collapse" bordercolor="#111111">\r
- <tr>\r
-  <td valign=top align=left style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=right\r
-  style='text-align:right'><a name="_Ref349497354"></a><a name="_Ref348079997"><i><span\r
-  style='font-size:9.0pt'>Since human beings themselves are not fully debugged\r
-  yet, there will be bugs in your code no matter what you do.</span></i></a></p>\r
-  <p class=TextFontCX align=right\r
-  style='margin-left:4.5pt;text-align:right'><span style='font-size:9.0pt'>Chris\r
-  Mason,</span><i><span style='font-size:9.0pt'> Zero-defects  memo </span></i><span\r
-  style='font-size:9.0pt'>(quoted in <i>Microsoft Secrets</i>, Cusumano and Selby)</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<a name="Section1">\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534974932"></a><a\r
-name="_Ref348785755">1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Operation</a></h1>\r
-\r
-<p class=TextFontCX>Splint is invoked by listing\r
-files to be checked.  Initialization files, command line flags, and stylized comments may be used to customize checking globally and locally.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The best way to learn to use\r
-Splint, of course, is to actually use it (if you don\92t already have Splint\r
-installed on your system, see Appendix A).  Before you read much further in\r
-this document, I recommend finding a small C program.  Then, try running:</p>\r
-\r
-<p class=example align="left">splint *.c</p>\r
-\r
-<center>\r
-<center>\r
-\r
-<p class=TextFontCX>For the most C programs, this\r
-will produce a large number of warnings.  To turn off reporting for some of the\r
-warnings, try:<a name="_Ref347468509"></a><a name="_Ref345591726"></a><a\r
-name="_Ref345568136"></a><a name="_Ref345515100"></a><a name="_Ref345497041"></a><a\r
-name="_Ref345435155"></a><a name="_Ref345257971"></a><a name="_Ref344916723"></a><a\r
-name="_Ref344907348"></a><a name="_Ref344891202"></a><a name="_Toc344355397"></a></p>\r
-\r
-<p class=example align="left">splint -weak *.c</p>\r
-\r
-<center><center>\r
-\r
-<p class=TextFontCX>The <span class=Flag><span\r
-style='font-size:10.0pt'>-weak</span></span> flag is a mode flag that sets many checking parameters to select weaker checking than is done in the\r
-default mode.  Other Splint flags will be introduced in the following sections;\r
-a complete list is given in Appendix B.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974933"></a><a\r
-name="_Toc344355435">1.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Warnings</a></h2>\r
-\r
-<p class=beforelist>A typical warning message is:</p>\r
-\r
-<p class=IndentText align="left" style="margin-bottom: 0.0003pt"><span style='font-size:10.0pt;font-family:Arial'>sample.c:\r
-(in function faucet)</span></p>\r
-\r
-<p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'>sample.c:11:12</span><span style='font-size:10.0pt;\r
-font-family:Arial'>: Fresh storage x not released before return</span></p>\r
-\r
-<p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'>  A memory\r
-leak has been detected. Storage allocated locally is not released</span></p>\r
-\r
-<p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'>  before\r
-the last reference to it is lost. (Use -mustfreefresh to inhibit</span></p>\r
-\r
-<p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'>  warning)</span></p>\r
-\r
-<p class=IndentText align="left"><span style='font-size:10.0pt;font-family:Arial'>  \r
-sample.c:5:47: Fresh storage x allocated</span></p>\r
-\r
-<center><center>\r
-\r
-<p class=afterlist>The first line gives the name of the function in which the\r
-error is found.  This is printed before the first message reported for a\r
-function.  The second line is the text of the message.  This message reports a\r
-memory leak\97storage allocated in a function is not deallocated before the\r
-function returns.  The file name, line and column number where the error is\r
-located precedes the text.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The next line is a hint\r
-giving more information about the suspected error, including information on how\r
-the warning message may be suppressed.  For this message, using the <span\r
-class=Flag><span style='font-size:10.0pt'>&#8209;mustfreefresh</span></span> flag would prevent this warning from being reported.  This flag can be set at the\r
-command line, or more precisely just around the code point in question by using\r
-annotations (see Section 1.3.2).</p>\r
-\r
-<p class=TextFontCX> </p>\r
-\r
-<p class=TextFontCX>The final line of the message\r
-gives additional location information.  For this message, it tells where the\r
-leaking storage was allocated.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>The generic message format is (parts enclosed in square\r
-brackets are optional):</p>\r
-\r
-<p class=Verbatim align="left"><span style='font-family:Arial'>  [&lt;file&gt;:&lt;line&gt;\r
-(in &lt;context&gt;)]</span></p>\r
-\r
-<p class=Verbatim align="left"><span style='font-family:Arial'> \r
-&lt;file&gt;:&lt;line&gt;[,&lt;column&gt;]: <i>message</i></span></p>\r
-\r
-<p class=Verbatim align="left"><span style='font-family:Arial'>     [<i>hint</i>]</span></p>\r
-\r
-<p class=Verbatim align="left"><span style='font-family:Arial'>      &lt;file&gt;:&lt;line&gt;,&lt;column&gt;:\r
-<i>extra location information, if appropriate</i></span></p>\r
-\r
-<center>\r
-<center>\r
-\r
-<p class=afterlist>Users can customize the format and content of messages\r
-printed by Splint.  The function context is not printed if <span class=Flag><span\r
-style='font-size:10.0pt'>-showfunc</span></span> is used.  Column numbers are not printed if <span\r
-class=Flag><span style='font-size:10.0pt'>&#8209;showcol</span></span> is used.  The <span\r
-class=Flag><span style='font-size:10.0pt'>+parenfileformat</span></span> flag can be used to generate file locations in the format recognized by Microsoft Visual Studio.  If <span class=Flag><span style='font-size:10.0pt'>+parenfileformat</span></span> is\r
-set, the line number follows the file name in parentheses (e.g., <span\r
-class=PlainText><span style='font-size:10.0pt;font-family:Arial'>sample.c(11)</span></span>.) \r
-Messages are split into lines of length less than the value set using <span\r
-class=Flag><span style='font-size:10.0pt'>-linelen <i>&lt;number&gt;</i></span></span>.  The default line length is 80 characters.  Splint attempts to split lines in a sensible place as near to the line length limit as possible.  </p>\r
-\r
-<p class=afterlist style='margin-top:0in'>&nbsp;</p>\r
-\r
-<p class=afterlist style='margin-top:0in'>The <span class=Flag><span\r
-style='font-size:10.0pt'>&#8209;hints</span></span> prevents any hints from being printed.  Normally, a hint is given only the first time a class of error is reported.  To have Splint print a hint for every message regardless, use <span\r
-class=Flag><span style='font-size:10.0pt'>+forcehints</span></span>.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974934"></a><a\r
-name="_Ref348343333"></a><a name="_Ref348343330"></a><a name="_Ref348092990"></a><a\r
-name="_Ref344882148"></a><a name="_Ref344870278"></a><a name="_Toc344355436">1.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Flags</a></h2>\r
-\r
-<p class=TextFontCX>So that many programming\r
-styles can be supported, Splint provides several hundred flags for controlling\r
-checking and message reporting.  Some of the flags are introduced in the body\r
-of this document.  Appendix B describes every flag.  Modes and shortcut flags are provided for setting many flags at once.  Individual flags can override the mode settings.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Flags are preceded by <span\r
-class=Flag><span style='font-size:10.0pt'>+</span></span> or <span class=Flag><span\r
-style='font-size:10.0pt'>-</span></span>.  When a flag is preceded by <span\r
-class=Flag><span style='font-size:10.0pt'>+</span></span> we say it is <i>on</i>;\r
-when it is preceded by <span class=Flag><span style='font-size:10.0pt'>-</span></span>\r
-it is <i>off</i>. The precise meaning of on and off depends on the type of\r
-flag.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Flag><span\r
-style='font-size:10.0pt'>+</span></span>/<span class=Flag><span\r
-style='font-size:10.0pt'>-</span></span> flag settings are used for consistency\r
-and clarity, but contradict standard UNIX usage and it is easy to accidentally\r
-use the wrong one.  To reduce the likelihood of using the wrong flag, Splint\r
-issues warnings when a flag is set in an unusual way.  Warnings are issued when\r
-a flag is redundantly set to the value it already had (these errors are not\r
-reported if the flag is set using a stylized comment), if a mode flag or\r
-special flag is set after a more specific flag that will be set by the general\r
-flag was already set, if value flags are given unreasonable values, of if flags\r
-are set in an inconsistent way.  The <span class=Flag><span style='font-size:\r
-10.0pt'>-warnflags</span></span> flag suppresses these warnings.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Default flag settings will be read from <span class=Keyword><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>~/.splintrc</span></span> if it is readable.  If there is a <span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span> file in the working directory, settings in this file will be read next and its settings will override those in <span class=Keyword><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>~/.splintrc</span></span>.  Command-line flags override settings in either file.  The syntax of the <span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.splintrc</span></span> file is the same as that of command-line flags, except that flags may be on separate lines and the <span class=CodeText><span style='font-size:10.0pt'>#</span></span>\r
-character may be used to indicate that the remainder of the line is a comment.\r
-The <span class=Flag><span style='font-size:10.0pt'>-nof</span></span> flag prevents the <span class=Keyword><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>~/.splintrc</span></span> file from being loaded.  The <span\r
-class=Flag><span style='font-size:10.0pt'>-f </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;filename&gt;</i></span></span>\r
-flag loads options from <i>filename</i>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>To make flag names more\r
-readable, hyphens (<span class=Flag><span style='font-size:10.0pt'>-</span></span>),\r
-underscores (<span class=Flag><span style='font-size:10.0pt'>_</span></span>)\r
-and spaces in flags at the command line are ignored.  Hence, <span class=Flag><span\r
-style='font-size:10.0pt'>warnflags</span></span>, <span class=Flag><span\r
-style='font-size:10.0pt'>warn-flags</span></span> and <span class=Flag><span\r
-style='font-size:10.0pt'>warn_flags</span></span> all select the <span\r
-class=Flag><span style='font-size:10.0pt'>warnflags</span></span> option.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974935"></a><a\r
-name="_Toc344355442"></a><a name="_Ref343086686">1.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Stylized Comments</a></h2>\r
-\r
-<p class=TextFontCX>Stylized comments are used to\r
-provide extra information about a type, variable or function interface to\r
-improve checking, or to control flag settings locally.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>All stylized comments begin\r
-with <span class=CodeText><span style='font-size:10.0pt'>/*@</span></span> and\r
-are closed by the end of the comment.  The role of the <span class=CodeText><span\r
-style='font-size:10.0pt'>@</span></span> may be played by any printable character.  Use <span class=Flag><span style='font-size:10.0pt'>-commentchar</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;char&gt;</i></span></span> to\r
-select a different stylized comment marker.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974936">1.3.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Annotations</a></h3>\r
-\r
-<p class=TextFontCX>Annotations are stylized comments that follow a definite syntax.  Although they are comments,\r
-they may only be used in fixed grammatical contexts (e.g., like a type qualifier).</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Sections 2\966­ describe annotations for expressing assumptions about variables, parameters, return values, structure fields and type definitions.  For example, <span class=Annot><span style='font-size:10.0pt'>/*@null@*/</span></span>\r
-is used to express an assumption that a parameter may be NULL.  Section 7 describes annotations for describing function interfaces.  Other annotations are\r
-described in later sections and Section 10 describes mechanisms users can employ to define new annotations.  A summary of annotations is found in Appendix C.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Some annotations, known as\r
-control comments, may appear between any two tokens in a C program (unlike\r
-regular C comments, control comments should not be used within a single token\r
-as they introduce new separators in the code).  Syntactically, they are no\r
-different from standard comments.  Control comments are used to provide\r
-source-level control of Splint checking.  They may be used to suppress spurious\r
-messages, set flags, and control checking locally in other ways.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974937"></a><a\r
-name="_Ref534648584">1.3.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Setting Flags</a></h3>\r
-\r
-<p class=TextFontCX>Most flags (all except those\r
-characterized as \93global\94 in Appendix B) can be set locally using control comments.  A control comment can set flags locally to override the command line settings.  The original flag settings are restored before processing the next file. The syntax for\r
-setting flags in control comments is the same as that of the command line,\r
-except that flags may also be preceded by <span class=CodeText><span\r
-style='font-size:10.0pt'>=</span></span> to restore their setting to the\r
-original command-line value.  For instance,</p>\r
-\r
-<p class=example><span class=Annot><span style='font-size:10.0pt'>/*@+charint </span></span><span\r
-class=Annot><span style='font-size:10.0pt'>-modifies</span></span><span class=Annot><span style='font-size:10.0pt'> =showfunc</span></span><span\r
-class=Annot><span style='font-size:10.0pt'>@*/</span></span></p>\r
-\r
-<p class=TextFontCX>sets <span class=Flag><span\r
-style='font-size:10.0pt'>charint</span></span> on (this makes <span\r
-class=CodeText><span style='font-size:10.0pt'>char</span></span> and <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span>\r
-indistinguishable types), sets <span class=Flag><span style='font-size:10.0pt'>modifies</span></span>\r
-off (this prevents reporting of modification errors), and sets <span class=Flag><span style='font-size:10.0pt'>showfunc</span></span> to its original setting (this controls  whether or not the name of a function <a name="_Toc344355449">is displayed before a message).</a><a name="_Ref348845205"></a><a\r
-name="_Ref348845200"></a><a name="_Ref348785779"> </a></p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534974938"></a><a\r
-name="_Ref534641443"></a><a name="_Ref534093860"></a><a name="_Ref534050017"></a><a\r
-name="_Ref534008843">2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Null Dereferences</a></h1>\r
-\r
-<p class=TextFontCX>A common cause of program\r
-failures is when a null pointer is dereferenced.  Splint detects these errors\r
-by distinguishing possibly <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>\r
-pointers at interface boundaries.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>null</span></span> annotation is used to indicate that a pointer value may be <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span>.  A pointer declared with no <span\r
-class=Annot><span style='font-size:10.0pt'>null</span></span> annotation, may\r
-not be <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>. \r
-If null checking is turned on (controlled by <span class=Flag><span\r
-style='font-size:10.0pt'>null</span></span>), Splint will report an error when\r
-a possibly null pointer is passed as a parameter, returned as a result, or\r
-assigned to an external reference with no <span class=Annot><span\r
-style='font-size:10.0pt'>null</span></span> qualifier.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>If a pointer is declared with\r
-the <span class=Annot><span style='font-size:10.0pt'>null</span></span> annotation, the code must check that it is not <span\r
-class=CodeText><span style='font-size:10.0pt'>NULL</span></span> on all paths\r
-leading to a dereference of the pointer (or the pointer being returned or\r
-passed as a value with no <span class=Annot><span style='font-size:10.0pt'>null</span></span>\r
-annotation).  Dereferences of possibly null pointers may be protected by\r
-conditional statements or <span class=CodeText><span style='font-size:10.0pt'>assert</span></span>ions\r
-(to see how <span class=CodeText><span style='font-size:10.0pt'>assert</span></span>\r
-is declared see Section 8.1) that check the pointer is not <span\r
-class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Consider two implementations\r
-of <span class=CodeText><span style='font-size:10.0pt'>firstChar</span></span>\r
-in Figure 2. For <span\r
-class=CodeText><span style='font-size:10.0pt'>firstChar1</span></span>, Splint\r
-reports an error since the pointer that is dereferenced is declared with a <span\r
-class=Annot><span style='font-size:10.0pt'>null</span></span> annotation.  For <span\r
-class=CodeText><span style='font-size:10.0pt'>firstChar2</span></span>, no\r
-error is reported since the true branch of the <span class=CodeText><span\r
-style='font-size:10.0pt'>s == NULL</span></span> if statement returns, so the\r
-dereference of <span class=CodeText><span style='font-size:10.0pt'>s</span></span>\r
-is only reached if <span class=CodeText><span style='font-size:10.0pt'>s</span></span>\r
-is not <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.</p>\r
-\r
-<center>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:5.4pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='width:207.0pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>null.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='width:220.5pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:207.0pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>char firstChar1 (/*@null@*/\r
-  char *s)</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>{<br>\r
-  </span><span class=Line><span style='font-size:8.0pt'>3</span></span><span\r
-  style='font-size:9.0pt'>  return *s;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>char firstChar2 (/*@null@*/\r
-  char *s)</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>   if (s == NULL) return\r
-  \91\0\92;<br>\r
-  </span><span class=Line><span style='font-size:8.0pt'>9</span></span><span\r
-  style='font-size:9.0pt'>  return *s;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>\r
-  </td>\r
-  <td  valign=top style='width:220.5pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint null.c</p>\r
-  <p class=lclintrun>Splint 3.0.1</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>null.c: (in function firstChar1)</p>\r
-  <p class=lclintrun>null.c:3:11: Dereference of possibly null pointer s: *s</p>\r
-  <p class=lclintrun>   null.c:1:35: Storage s may become null</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>Finished checking --- 1 code warning found</p>\r
-  <p class=TextFontCX>&nbsp;</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0 style="border-collapse: collapse" bordercolor="#111111">\r
- <tr>\r
-  <td valign=top align=left style='padding-top:6.5pt;padding-right:\r
-  9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Ref534981289"></a><a name="_Toc534824606"></a><a\r
-  name="_Ref534981293">Figure 2</a>.  Null Checking</p>\r
-  <p class=MsoNormal align=left style='margin-top:0in;margin-right:26.55pt;\r
-  margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;text-align:left;\r
-  background:white'><span style='font-size:10.0pt'>Output from running Splint\r
-  is displayed in </span><span style='font-size:10.0pt;font-family:"Arial Narrow"'>sans-serif</span><span\r
-  style='font-size:10.0pt'> font.  The command line is preceded by </span><span\r
-  style='font-size:10.0pt;font-family:Arial'>&gt;</span><span style='font-size:\r
-  10.0pt'>, the rest is output from Splint.  Explanations added to the code or\r
-  splint output are shown in <i>italics</i>. Code shown in the figures in this\r
-  document is available from the splint web site, </span><span\r
-  style='font-size:10.0pt;font-family:Arial'>http://www.splint.org</span><span\r
-  style='font-size:10.0pt'>.  No error is reported for line 9, since the\r
-  dereference is reached only if </span><span class=CodeText><span\r
-  style='font-size:10.0pt'>s</span></span><span style='font-size:10.0pt'> is\r
-  non-null.  For most of the figures, the options </span><span class=Flag><span\r
-  style='font-size:9.0pt'>-linelen 55 -hints \96showcol</span></span><span\r
-  style='font-size:10.0pt'> were used to produce condensed output, and </span><span\r
-  class=Flag><span style='font-size:9.0pt'>\96exportlocal</span></span><span\r
-  style='font-size:10.0pt'> to inhibit warnings about exported declarations.  </span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974939"></a><a\r
-name="_Ref344185475">2.1.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Predicate Functions</a></h3>\r
-\r
-<p class=TextFontCX>Another way to protect null\r
-dereference, is to declare a function using <span class=Annot><span\r
-style='font-size:10.0pt'>nullwhentrue</span></span> or <span\r
-class=Annot><span style='font-size:10.0pt'>falsewhennull</span></span><span\r
-class=Annot><span style='font-size:10.0pt'> </span></span>(these annotations\r
-where originally <span class=Annot><span style='font-size:10.0pt'>falsenull</span></span> and <span\r
-class=Annot><span style='font-size:10.0pt'>truenull</span></span>, but were renamed to clarify the logical asymmetry; <span\r
-class=Annot><span style='font-size:10.0pt'>falsenull</span></span> and <span\r
-class=Annot><span style='font-size:10.0pt'>truenull</span></span> may still be\r
-used) and call the function in a conditional statement before the <span\r
-class=Annot><span style='font-size:10.0pt'>null</span></span>-annotated pointer\r
-is dereferenced.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>If a function annotated with <span\r
-class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span> returns\r
-true it means its first passed parameter is <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span>. If it returns false, the parameter\r
-is not <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>. \r
-Note that it may return true for a parameter that is not <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span>.  A more descriptive name for <span\r
-class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span> would be\r
-\93if the result is false, the parameter was not null\94. For example, if <span\r
-class=CodeText><span style='font-size:10.0pt'>isNull</span></span> is declared\r
-as,</p>\r
-\r
-<p class=example>   /*@nullwhentrue@*/ bool isNull (/*@null@*/ char *x);</p>\r
-\r
-<p class=beforelist>we could write <span class=CodeText><span style='font-size:\r
-10.0pt'>firstChar2</span></span>:</p>\r
-\r
-<p class=Verbatim>   char firstChar2 (/*@null@*/ char *s)</p>\r
-\r
-<p class=Verbatim>   {</p>\r
-\r
-<p class=Verbatim style='margin-left:.5in'>if (isNull (s)) return '\0';<br>\r
-return *s;</p>\r
-\r
-<p class=Verbatim>   }</p>\r
-\r
-<p class=afterlist>No error is reported since the dereference of <span\r
-class=CodeText><span style='font-size:10.0pt'>s</span></span> is only reached\r
-if <span class=CodeText><span style='font-size:10.0pt'>isNull(s)</span></span>\r
-is false, and since <span class=CodeText><span style='font-size:10.0pt'>isNull</span></span>\r
-is declared with the <span class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span>\r
-annotation this means <span class=CodeText><span style='font-size:10.0pt'>s</span></span>\r
-must not be null.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>falsewhennull</span></span> annotation is not quite\r
-the logical opposite of <span class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span>. \r
-If a function declared with <span class=Annot><span style='font-size:10.0pt'>falsewhennull</span></span>\r
-returns true, it means its parameter is definitely not <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span>.  If it returns false, the\r
-parameter may or may not be <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>. \r
-That is a <span class=Annot><span style='font-size:10.0pt'>falsewhennull</span></span>\r
-always returns false when passed a <span class=CodeText><span style='font-size:\r
-10.0pt'>NULL</span></span> parameter; it may sometimes return false when passed\r
-a non-<span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>\r
-parameter.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>For example, we could define <span class=CodeText><span\r
-style='font-size:10.0pt'>isNonEmpty</span></span> to return true if its\r
-parameter is not <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>\r
-and has least one character before the <span class=CodeText><span\r
-style='font-size:10.0pt'>NUL</span></span> terminator:</p>\r
-\r
-<p class=Verbatim>   /*@falsewhennull@*/ bool isNonEmpty (/*@null@*/ char *x)</p>\r
-\r
-<p class=Verbatim>   {</p>\r
-\r
-<p class=Verbatim>     return (x != NULL &amp;&amp; *x != \91\0\92);</p>\r
-\r
-<p class=Verbatim>   }</p>\r
-\r
-<p class=afterlist>Splint does not check that the implementation of a function\r
-declared with <span class=Annot><span style='font-size:10.0pt'>nullwhentrue</span></span>\r
-or <span class=Annot><span style='font-size:10.0pt'>falsewhennull</span></span>\r
-is consistent with its annotation, but assumes the annotation is correct when\r
-code that calls the function is checked.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974940">2.1.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Notnull Annotations</a></h3>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>notnull</span></span> annotation specifies that a\r
-declarator is definitely not <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>. \r
-By default, this is assumed, but it may be necessary to use <span class=Annot><span\r
-style='font-size:10.0pt'>notnull</span></span> to override a <span class=Annot><span\r
-style='font-size:10.0pt'>null</span></span> in a type definition.  The <span\r
-class=Annot><span style='font-size:10.0pt'>null</span></span> annotation may be\r
-used in a type definition to indicate that all instances of the type may be <span\r
-class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.  For declarations\r
-of a type declared using <span class=Annot><span style='font-size:10.0pt'>null</span></span>,\r
-the <span class=Annot><span style='font-size:10.0pt'>null</span></span>\r
-annotation in the type definition may be overridden with <span class=Annot><span\r
-style='font-size:10.0pt'>notnull</span></span>. This is particularly useful for parameters to hidden <span\r
-class=CodeText><span style='font-size:10.0pt'>static</span></span> operations\r
-of abstract types (see Section 4.3) where the null test has already been done before the function is called, or function results known to never be <span\r
-class=CodeText><span style='font-size:10.0pt'>NULL</span></span>.  For an\r
-abstract type, <span class=Flag><span style='font-size:10.0pt'>notnull</span></span>\r
-may not be used for parameters to external functions, since clients should not\r
-be aware of when the concrete representation may by <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span>.  Parameters to static functions in\r
-the implementation module, however, may be declared using <span class=Annot><span\r
-style='font-size:10.0pt'>notnull</span></span>, since they may only be called\r
-from places where the representation is accessible.  Return values for <span\r
-class=CodeText><span style='font-size:10.0pt'>static</span></span> or external\r
-functions may be declared using <span class=Annot><span style='font-size:10.0pt'>notnull</span></span>. \r
-</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974941"></a><a\r
-name="_Ref347853058">2.1.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Relaxing Null Checking</a></h3>\r
-\r
-<p class=TextFontCX>An additional annotation, <span\r
-class=Annot><span style='font-size:10.0pt'>relnull</span></span> may be used to relax null checking.  No error is reported when a <span\r
-class=Annot><span style='font-size:10.0pt'>relnull</span></span> value is\r
-dereferenced, or when a possibly null value is assigned to an identifier\r
-declared using <span class=Annot><span style='font-size:10.0pt'>relnull</span></span>.\r
-</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>This is generally used for\r
-structure fields that may or may not be null depending on some other\r
-constraint.  Splint does not report and error when <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span> is assigned to a <span class=Annot><span\r
-style='font-size:10.0pt'>relnull</span></span> reference, or when a <span\r
-class=Annot><span style='font-size:10.0pt'>relnull</span></span> reference is\r
-dereferenced.  It is up to the programmer to ensure that this constraint is\r
-satisfied before the pointer is dereferenced.</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Ref348845237"></a><a\r
-name="_Ref347254431"></a><a name="_Ref347169350"></a><a name="_Ref344916590"></a><a\r
-name="_Ref344907893"></a><a name="_Toc344355407"></a><a name="_Toc534974942"></a><a\r
-name="_Ref534641444"></a><a name="_Ref534093775"></a><a name="_Ref534093769"></a><a\r
-name="_Ref534049950">3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Undefined Values</a></h1>\r
-\r
-<p class=TextFontCX>Like many static checkers,\r
-Splint detects instances where the value of a location is used before it is\r
-defined.  This analysis is done at the procedural level.  If there is a path\r
-through the procedure that uses a local variable before it is defined, a use\r
-before definition error is reported.  The <span class=Flag><span\r
-style='font-size:10.0pt'>usedef</span></span> flag controls use before\r
-definition checking.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint can do more checking\r
-than standard checkers though, because the annotations can be used to describe\r
-what storage must be defined and what storage may be undefined at interface\r
-points. Unannotated references are expected to be completely defined at\r
-interface points.  This means all storage reachable from a global variable, parameter to a function, or function return value is defined before and\r
-after a function call.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974943"></a><a\r
-name="_Ref347811030"></a><a name="_Ref347204458">3.1.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Undefined Parameters</a></h3>\r
-\r
-<p class=TextFontCX>Sometimes, function\r
-parameters or return values are expected to reference undefined or partially\r
-defined storage.  For example, a pointer parameter may be intended only as an\r
-address to store a result, or a memory allocator may return allocated but\r
-undefined storage.  The <span class=Annot><span style='font-size:10.0pt'>out</span></span> annotation denotes a pointer to storage that may be undefined.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint does not report an\r
-error when a pointer to allocated but undefined storage is passed as an <span\r
-class=Annot><span style='font-size:10.0pt'>out</span></span> parameter.  Within\r
-the body of a function, Splint will assume an <span class=Annot><span\r
-style='font-size:10.0pt'>out</span></span> parameter is allocated but not\r
-necessarily bound to a value, so an error is reported if its value is used\r
-before it is defined.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint reports an error if\r
-storage reachable by the caller after the call is not defined when the function\r
-returns.  This can be suppressed by <span class=Flag><span style='font-size:\r
-10.0pt'>-must-define</span></span>.  After a call returns, an actual parameter corresponding to an <span\r
-class=Annot><span style='font-size:10.0pt'>out</span></span> parameter is\r
-assumed to be completely defined.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>When checking unannotated\r
-programs, many spurious use before definition errors may be reported   If <span\r
-class=Flag><span style='font-size:10.0pt'>impouts</span></span> is on, no error is reported when an incompletely-defined parameter is passed to a\r
-formal parameter with no definition annotation, and the actual parameter is\r
-assumed to be defined after the call.  The <span class=Annot><span\r
-style='font-size:10.0pt'>/*@in@*/</span></span> annotation can be used to denote a parameter that must be completely defined, even if <span class=Flag><span\r
-style='font-size:10.0pt'>imp-outs</span></span> is on.  If <span class=Flag><span\r
-style='font-size:10.0pt'>imp-outs</span></span> is off, there is an implicit <span\r
-class=Annot><span style='font-size:10.0pt'>in</span></span> annotation on every\r
-parameter with no definition annotation.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
- style='margin-left:.9pt;border-collapse:collapse'>\r
- <tr>\r
-  <td width="40%" valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>usedef.c</span></b></span></p>\r
-  </td>\r
-  <td valign=top style='border-top:1.5pt solid black;\r
-  border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black;\r
-  background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>extern void</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>  setVal (/*@out@*/ int *x);</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>extern int</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>  getVal (/*@in@*/ int *x);</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>extern int mysteryVal </span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>  (int *x);</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>&nbsp;</span></span></p>\r
-  <p class=MsoNormal align=left style='text-align:left'><span class=Keyword><span\r
-  style='font-size:10.0pt;color:windowtext'>int dumbfunc </span></span></p>\r
-  <p class=MsoNormal align=left style='text-align:left'><span class=Keyword><span\r
-  style='font-size:10.0pt;color:windowtext'>   (/*@out@*/ int *x, int i)</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>{</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>  if (i &gt; 3)</span></span></p>\r
-  <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>11</span></span><span\r
-  class=Keyword><span style='font-size:10.0pt;color:windowtext'>   return *x;</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>  else if (i &gt; 1)</span></span></p>\r
-  <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>13</span></span><span\r
-  class=Keyword><span style='font-size:10.0pt;color:windowtext'>   return\r
-  getVal (x);</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>  else if (i == 0)</span></span></p>\r
-  <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>15</span></span><span\r
-  class=Keyword><span style='font-size:10.0pt;color:windowtext'>   return\r
-  mysteryVal (x);</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>  else</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>    {</span></span></p>\r
-  <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>18</span></span><span\r
-  class=Keyword><span style='font-size:10.0pt;color:windowtext'>    setVal (x);</span></span></p>\r
-  <p class=MsoNormal><span class=Line><span style='font-size:8.0pt'>19</span></span><span\r
-  class=Keyword><span style='font-size:10.0pt;color:windowtext'>    return *x;</span></span></p>\r
-  <p class=MsoNormal><span class=Keyword><span style='font-size:10.0pt;\r
-  color:windowtext'>    }</span></span></p>\r
-  <p class=Verbatim><span class=Keyword><span style='color:windowtext'>}</span></span></p>\r
-  </td>\r
-  <td  valign=top style='border-top:medium none;border-left:medium none;\r
-  border-bottom:1.5pt solid black;border-right:1.5pt solid black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>\r
-  <p class=lclintrun>&gt; splint usedef.c</p>\r
-  <p class=lclintrun>usedef.c:11: Value *x used before definition</p>\r
-  <p class=lclintrun>usedef.c:13: Passed storage x not completely defined</p>\r
-  <p class=lclintrun>                (*x is undefined): getVal (x)</p>\r
-  <p class=lclintrun>usedef.c:15: Passed storage x not completely defined</p>\r
-  <p class=lclintrun>                (*x is undefined): mysteryVal (x)</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>Finished checking --- 3 code warnings</p>\r
-  <p class=TextFontCX><i>&nbsp;</i></p>\r
-  <p class=IndentText style='margin-top:0in;margin-right:.85pt;margin-bottom:\r
-  0in;margin-left:0in;margin-bottom:.0001pt;page-break-after:avoid'><i>No error\r
-  is reported for line 18, since the incompletely defined storage </i><span\r
-  class=CodeText><span style='font-size:10.0pt'>x</span></span><i> is passed as\r
-  an </i><span class=CodeText><span style='font-size:10.0pt'>out</span></span><i>\r
-  parameter.  After the call, </i><span class=CodeText><span style='font-size:\r
-  10.0pt'>x</span></span><i> may be dereferenced, since </i><span class=Annot><span\r
-  style='font-size:10.0pt'>setVal</span></span><i> is assumed to completely\r
-  define its </i><span class=Annot><span style='font-size:10.0pt'>out</span></span><i>\r
-  parameter.  The warning for line 15 would not appear if </i><span class=Flag><span\r
-  style='font-size:10.0pt'>+impouts</span></span><i> were used since there is no </i><span class=Annot><span style='font-size:10.0pt'>in</span></span><i>\r
-  annotation on the parameter to </i><span class=Flag><span style='font-size:\r
-  10.0pt'>mysteryVal</span></span><i>.</i></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<div>\r
-\r
-<div align="center">\r
-  <center>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  style="border-collapse: collapse" bordercolor="#111111">\r
- <tr>\r
-  <td valign=top align=left style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Ref347764461"></a><a name="_Ref347853047"></a><a\r
-  name="_Toc534824607">Figure 3.  Use before Definition</a></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-  </center>\r
-</div>\r
-\r
-</div>\r
-\r
-<br clear=ALL>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974944">3.1.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Relaxing Checking</a></h3>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>reldef</span></span> annotation relaxes definition checking for a particular declaration.  Storage declared with a <span class=Annot><span\r
-style='font-size:10.0pt'>reldef</span></span> annotation is assumed to be\r
-defined when it is used, but no error is reported if it is not defined before\r
-it is returned or passed as a parameter.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>It is up to the programmer to\r
-check <span class=Annot><span style='font-size:10.0pt'>reldef</span></span>\r
-fields are used correctly.   They should be avoided in most cases, but may be\r
-useful for fields of structures that may or may not be defined depending on\r
-other constraints.  </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974945"></a><a\r
-name="_Ref347853043">3.1.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Partially Defined Structures</a></h3>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>partial</span></span> annotation can be used to relax checking of structure fields.  A structure with\r
-undefined fields may be passed as a <span class=Annot><span style='font-size:\r
-10.0pt'>partial</span></span> parameter or returned as a <span class=Annot><span\r
-style='font-size:10.0pt'>partial</span></span> result.  Inside a function body,\r
-no error is reported when the field of a <span class=Annot><span\r
-style='font-size:10.0pt'>partial</span></span> structure is used.  After a\r
-call, all fields of a structure that is passed as a <span class=Annot><span\r
-style='font-size:10.0pt'>partial</span></span> parameter are assumed to be\r
-completely defined.</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Ref534977413"></a><a\r
-name="_Toc534974946">4<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Types</a></h1>\r
-\r
-<p class=TextFontCX>Strong type checking often reveals programming errors.  Splint can check primitive C types more strictly\r
-and flexibly than typical compilers (4.1) and provides support a Boolean type (4.2).  In addition, users can define abstract types that provide information hiding (0). </p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974947"></a><a\r
-name="_Ref534642132"></a><a name="_Ref533964147"></a><a name="_Toc344355401">4.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Built in C Types</a></h2>\r
-\r
-<p align=right><span style='font-size:9.0pt'>\r
-  <i>Two types have </i>compatible<i> type if their types are\r
-  the same.</i>\r
-  <p class=TextFontCX align=right\r
-  style='text-align:right'><span style='font-size:9.0pt'>ANSI C, 3.1.2.6.</span></p>\r
-  <p class=Sidebar>&nbsp;</p>\r
-</p>\r
-\r
-<p class=MsoListBullet style='margin-left:0in;text-indent:0in'>Splint supports\r
-stricter checking of built in C types.  The <span class=CodeText><span\r
-style='font-size:10.0pt'>char</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>enum</span></span> types can be checked as distinct\r
-types, and the different numeric types can be type-checked strictly.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974948">4.1.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Characters</a></h3>\r
-\r
-<p class=TextFontCX>The primitive <span\r
-class=CodeText><span style='font-size:10.0pt'>char</span></span> type can be\r
-type-checked as a distinct type.  If <span class=CodeText><span\r
-style='font-size:10.0pt'>char</span></span> is used as a distinct type, common\r
-errors involving assigning <span class=CodeText><span style='font-size:10.0pt'>int</span></span>s\r
-to <span class=CodeText><span style='font-size:10.0pt'>char</span></span>s are\r
-detected. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Flag><span\r
-style='font-size:10.0pt'>+charint</span></span> flag can be used for checking\r
-legacy programs where <span class=CodeText><span style='font-size:10.0pt'>char</span></span>\r
-and <span class=CodeText><span style='font-size:10.0pt'>int</span></span> are\r
-used interchangeably.  If <span class=Flag><span style='font-size:10.0pt'>charint</span></span>\r
-is on, <span class=CodeText><span style='font-size:10.0pt'>char</span></span>\r
-types indistinguishable from <span class=CodeText><span style='font-size:10.0pt'>int</span></span>s. \r
-To keep <span class=CodeText><span style='font-size:10.0pt'>char</span></span>\r
-and <span class=Keyword><span style='font-size:10.0pt'>int</span></span> as\r
-distinct types, but allow chars to be used to index arrays, use <span\r
-class=Flag><span style='font-size:10.0pt'>+charindex</span></span>.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974949">4.1.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Enumerators</a></h3>\r
-\r
-<p class=TextFontCX>Standard C treats\r
-user-declared <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>\r
-types just like integers.  An arbitrary integral value may be assigned to an <span\r
-class=CodeText><span style='font-size:10.0pt'>enum</span></span> type, whether\r
-or not it was listed as an enumerator member.  Splint checks each user-defined <span\r
-class=CodeText><span style='font-size:10.0pt'>enum</span></span> type as\r
-distinct type.  An error is reported if a value that is not an enumerator\r
-member is assigned to the <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>\r
-type, or if an <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>\r
-type is used as an operand to an arithmetic operator.  If the <span class=Flag><span\r
-style='font-size:10.0pt'>enumint</span></span> flag is on, <span\r
-class=CodeText><span style='font-size:10.0pt'>enum</span></span> and <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span> types may be\r
-used interchangeably.  Like <span class=Flag><span style='font-size:10.0pt'>charindex</span></span>, if the <span\r
-class=Flag><span style='font-size:10.0pt'>enumindex</span></span> flag is on, <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>\r
-types may be used to index arrays.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974950">4.1.3<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Numeric Types</a></h3>\r
-\r
-<p class=TextFontCX>Splint reports where numeric\r
-types are used in dangerous or inconsistent ways.  With the strictest checking,\r
-Splint will report an error anytime numeric types do not match exactly.  If the\r
-<span class=Flag><span style='font-size:10.0pt'>relax-quals</span></span> flag is on, only those inconsistencies that may corrupt values are reported.  For\r
-example, if an <span class=CodeText><span style='font-size:10.0pt'>int</span></span>\r
-is assigned to a variable of type <span class=CodeText><span style='font-size:\r
-10.0pt'>long</span></span> (or passed as a <span class=CodeText><span\r
-style='font-size:10.0pt'>long</span></span> formal parameter), Splint will not\r
-report an error if <span class=Flag><span style='font-size:10.0pt'>relax-quals</span></span>\r
-is on since a <span class=CodeText><span style='font-size:10.0pt'>long</span></span>\r
-must have at least enough bits to store an <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span> without data loss.  On the other\r
-hand, an error would be reported if the <span class=CodeText><span\r
-style='font-size:10.0pt'>long</span></span> were assigned to an <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span>, since the <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span> type may not\r
-have enough bits to store the <span class=CodeText><span style='font-size:10.0pt'>long</span></span>\r
-value.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Similarly, if a <span\r
-class=CodeText><span style='font-size:10.0pt'>signed</span></span> value is\r
-assigned to an <span class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>,\r
-Splint will report an error since an <span class=CodeText><span\r
-style='font-size:10.0pt'>unsigned</span></span> type cannot represent all <span\r
-class=CodeText><span style='font-size:10.0pt'>signed</span></span> values correctly. \r
-If the <span class=Flag><span style='font-size:10.0pt'>+ignore-signs</span></span>\r
-flag is on, checking is relaxed to ignore all sign qualifiers in type\r
-comparisons (this is not recommended, since it will suppress reporting of real\r
-bugs, but may be necessary for quickly checking certain legacy code).  </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974951">4.1.4<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Arbitrary Integral Types</a></h3>\r
-\r
-<p class=TextFontCX>Some types are declared to be\r
-integral types, but the concrete type may be implementation dependent.  For\r
-example, the standard library declares the types <span class=CodeText><span\r
-style='font-size:10.0pt'>size_t</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>ptr_diff</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>wchar_t</span></span>, but does not constrain their\r
-types other than limiting them to integral types.  Programs may rely on them\r
-being integral types (e.g., can use <span class=CodeText><span\r
-style='font-size:10.0pt'>+</span></span> operator on two <span class=CodeText><span\r
-style='font-size:10.0pt'>size_t</span></span> operands), but should not rely on\r
-a particular representation (e.g., <span class=CodeText><span style='font-size:\r
-10.0pt'>long unsigned</span></span>).    </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint supports three\r
-different kinds of arbitrary integral types:</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@integraltype@*/</span></span></p>\r
-\r
-<p class=TextFontCX><span class="Annot"><font size="2">&nbsp;&nbsp;&nbsp; </font>\r
-</span>An arbitrary integral type.  The actual type may be any one\r
-of <span class=CodeText><span style='font-size:10.0pt'>short</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>long</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>unsigned short</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>, or <span\r
-class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>. </p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>\r
-\r
-<p class=TextFontCX><span class="Annot"><font size="2">&nbsp;&nbsp;&nbsp; </font>\r
-</span>An arbitrary unsigned integral type.  The actual type may\r
-be any one of <span class=CodeText><span style='font-size:10.0pt'>unsigned\r
-short</span></span>, <span class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>,\r
-or <span class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>\r
-\r
-<p class=TextFontCX><span class="Annot"><font size="2">&nbsp;&nbsp;&nbsp; </font>\r
-</span>An arbitrary signed integral type.  The actual type may be\r
-any one of <span class=CodeText><span style='font-size:10.0pt'>short</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>int</span></span>, or <span\r
-class=CodeText><span style='font-size:10.0pt'>long</span></span>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint reports an error if\r
-the code depends on the actual representation of a type declared as an\r
-arbitrary integral.  The <span class=Flag><span style='font-size:10.0pt'>match-any-integral</span></span> flag relaxes checking and allows an arbitrary integral type is allowed to match\r
-any integral type.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Other flags set the arbitrary\r
-integral types to a concrete type.  These should only be used if portability to\r
-platforms that may use different representations is not important.  The <span\r
-class=Flag><span style='font-size:10.0pt'>long-integral</span></span> and <span class=Flag><span style='font-size:10.0pt'>long-unsigned-integral</span></span> flags set the type corresponding to <span class=Annot><span style='font-size:\r
-10.0pt'>/*@integraltype@*/</span></span> to be <span class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>\r
-and <span class=CodeText><span style='font-size:10.0pt'>long</span></span>\r
-respectively.  The <span class=Flag><span style='font-size:10.0pt'>long-unsigned-unsigned-integral</span></span> flag sets the type corresponding to <span class=Annot><span style='font-size:\r
-10.0pt'>/*@unsignedintegraltype@*/ </span></span>to be <span class=CodeText><span\r
-style='font-size:10.0pt'>unsigned long</span></span>.  The <span class=Flag><span\r
-style='font-size:10.0pt'>long-signed-integral</span></span> flag sets the type corresponding to <span class=Annot><span style='font-size:10.0pt'>/*@signedintegraltype@*/\r
-</span></span>to be <span class=CodeText><span style='font-size:10.0pt'>long</span></span>.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974952"></a><a\r
-name="_Ref534642133"></a><a name="_Ref533964143"></a><a name="_Ref344892413"></a><a\r
-name="_Toc344355400">4.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Boolean Types</a></h2>\r
-\r
-<p class=TextFontCX>Pre-ISO99 C had no Boolean\r
-representation \96 the result of a comparison operator was an integer, and no\r
-type checking is done for test expressions.  C99 introduced a Boolean type (<span\r
-class=CodeText><span style='font-size:10.0pt'>_Bool</span></span> and <span\r
-class=CodeText><span style='font-size:10.0pt'>bool</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>true</span></span> and <span\r
-class=CodeText><span style='font-size:10.0pt'>false</span></span> macros in <span\r
-style='font-size:10.0pt;font-family:Arial'>stdbool.h</span>), but did not\r
-strengthen the type checking.  Splint supports a Boolean type that can be\r
-checked distinctly from integral types.  Many common errors can be detected by\r
-introducing a distinct Boolean type and stronger type checking. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint checks that the test\r
-expression in an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>while</span></span>, or <span\r
-class=CodeText><span style='font-size:10.0pt'>for</span></span> statement or an\r
-operand of a <span class=CodeText><span style='font-size:10.0pt'>&amp;&amp;</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>||</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>!</span></span><span\r
-class=Keyword><span style='font-size:10.0pt'> </span></span>operator is a\r
-Boolean.  If the type of a test expression is not a Boolean, Splint will\r
-produce a warning depending on the type of the test expression and flag\r
-settings.  If the test expression has pointer type, the warning is inhibited by\r
-<span class=Flag><span style='font-size:10.0pt'>\96predboolptr</span></span> (this can be used to prevent messages for the idiom of testing if a pointer is not\r
-null without a comparison).  If it is type <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span>, the warnings is inhibited by <span\r
-class=Flag><span style='font-size:10.0pt'>-pred-bool-int</span></span>.  For\r
-all other types, Splint warns unless <span class=Flag><span style='font-size:\r
-10.0pt'>-pred-bool-others</span></span> is set.   Relations, comparisons and\r
-certain standard library functions are declared to return Booleans.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Since using <span\r
-class=CodeText><span style='font-size:10.0pt'>=</span></span> instead of <span\r
-class=CodeText><span style='font-size:10.0pt'>==</span></span> is such a common\r
-bug, reporting of test expressions that are assignments is controlled by the\r
-separate <span class=Flag><span style='font-size:10.0pt'>pred-assign</span></span>\r
-flag.  The message can be suppressed by adding extra parentheses around the\r
-test expression.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Use the <span class=Flag><span\r
-style='font-size:10.0pt'>\96booltype &lt;name&gt;</span></span> flag to select the type name is used to represent Boolean values.  There is no\r
-default Boolean type, although <span class=CodeText><span style='font-size:\r
-10.0pt'>bool</span></span> is used by convention.  The names <span\r
-class=CodeText><span style='font-size:10.0pt'>TRUE</span></span> and <span\r
-class=CodeText><span style='font-size:10.0pt'>FALSE</span></span> are assumed\r
-to represent true and false Boolean values.  To change the names of true and\r
-false, use <span class=Flag><span style='font-size:10.0pt'>-booltrue</span></span>\r
-and <span class=Flag><span style='font-size:10.0pt'>-boolfalse</span></span>.  (The Splint distribution includes an implementation of <span\r
-class=CodeText><span style='font-size:10.0pt'>bool</span></span>, in <span\r
-class=CodeText><span style='font-size:10.0pt;color:windowtext'>lib/bool.h</span></span>. \r
-However, it isn\92t necessary to use this implementation to get the benefits of\r
-Boolean checking.)</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Figure 4 illustrates some of the Boolean checking done by Splint.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:5.4pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr style='height:13.3pt'>\r
-  <td valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.3pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>bool.c</span></b></span></p>\r
-  </td>\r
-  <td valign=top style='border-top:1.5pt solid black;\r
-  border-left:medium none;border-bottom:medium none;border-right:1.5pt solid black;\r
-  background:black;padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr >\r
-  <td valign=top style='width:2.0in;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt;height:156.15pt'>\r
-  <p class=Verbatim># include &quot;bool.h&quot;</p>\r
-  <p class=Verbatim>int f (int i, char *s,</p>\r
-  <p class=Verbatim>     bool b1, bool b2)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 6</span></span> \r
-  if (i = 3)</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 7</span></span>   \r
-  return b1;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 8</span></span> \r
-  if (!i || s)</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 9</span></span>   \r
-  return i;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10</span></span> \r
-  if (s)</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>11</span></span>   \r
-  return 7;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>12</span></span> \r
-  if (b1 == b2)</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>13</span></span>   \r
-  return 3;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>14</span></span> \r
-  return 2;</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td valign=top style='border-top:medium none;border-left:\r
-  medium none;border-bottom:1.5pt solid black;border-right:1.5pt solid black;\r
-  padding-left:5.4pt; padding-right:5.4pt; padding-top:0in; padding-bottom:0in'>\r
-  <p class=lclintrun>&gt; splint bool.c +predboolptr \96booltype bool</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>bool.c:6: Test expression for if is assignment expression:\r
-  i = 3</p>\r
-  <p class=lclintrun>bool.c:6: Test expression for if not bool, type int: i = 3</p>\r
-  <p class=lclintrun>bool.c:7: Return value type bool does not match declared\r
-  type int: b1</p>\r
-  <p class=lclintrun>bool.c:8: Operand of ! is non-boolean (int): !i</p>\r
-  <p class=lclintrun>bool.c:8: Right operand of || is non-boolean (char *): !i\r
-  || s</p>\r
-  <p class=lclintrun>bool.c:10: Test expression for if not bool, type char *: s</p>\r
-  <p class=lclintrun>bool.c:12: Use of == with bool variables (risks\r
-  inconsistency because</p>\r
-  <p class=lclintrun>              of multiple true values): b1 == b2</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun style='page-break-after:avoid'>Finished checking --- 7\r
-  code warnings found</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top align=left style='padding-top:.1in;padding-right:\r
-  9.35pt;padding-bottom:.1in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Ref533964137"></a><a name="_Toc534824608"></a><a\r
-  name="_Ref534821769">Figure 4</a>.  Boolean Checking</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974953"></a><a\r
-name="_Ref534970776">4.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Abstract Types</a></h2>\r
-\r
-<p class=TextFontCX>Information hiding is a\r
-technique for handling complexity.  By hiding implementation details, programs\r
-can be understood and developed in distinct modules and the effects of a change\r
-can be localized.  One technique for information hiding is data abstraction.  An abstract type is used to represent some natural program abstraction.  It\r
-provides functions for manipulating instances of the type.  The module that\r
-implements these functions is called the <i>implementation</i> module.  We call\r
-the functions that are part of the implementation of an abstract type the <i>operations</i>\r
-of the type.  Other modules that use the abstract type are called <i>clients</i>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Clients may use the type name\r
-and operations, but should not manipulate or rely on the actual representation\r
-of the type.  Only the implementation module may manipulate the representation\r
-of an abstract type.  This hides information, since implementers and\r
-maintainers of client modules should not need to know anything about how the\r
-abstract type is implemented. It provides modularity, since the representation\r
-of an abstract type can be changed without having to change any client code.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint supports abstract\r
-types by detecting places where client code depends on the concrete\r
-representation of an abstract type.  Some examples of abstraction violations\r
-detected by Splint are shown in Figure 5.</p>\r
-\r
-<p class=beforelist>&nbsp;</p>\r
-\r
-<p class=beforelist>To declare an abstract type, the <span class=Annot><span\r
-style='font-size:10.0pt'>abstract</span></span> annotation is added to a <span class=CodeText><span style='font-size:10.0pt'>typedef</span></span>. \r
-For example (in <span class=Keyword><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>mstring.h</span></span>),</p>\r
-\r
-<p class=example>typedef /*@abstract@*/ char *mstring;</p>\r
-\r
-<p class=TextFontCX>declares <span\r
-class=CodeText><span style='font-size:10.0pt'>mstring</span></span> as an\r
-abstract type.  It is implemented using a <span class=CodeText><span\r
-style='font-size:10.0pt'>char *</span></span>, but clients of the type should\r
-not depend on or need to be aware of this.  If it later becomes apparent that a\r
-better representation such as a string table should be used, we should be able\r
-to change the implementation of <span class=CodeText><span style='font-size:\r
-10.0pt'>mstring</span></span> without having to change or inspect any client\r
-code.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>In a client module, abstract\r
-types are checked by name, not structure.  Splint reports an error if an\r
-instance of <span class=CodeText><span style='font-size:10.0pt'>mstring</span></span>\r
-is passed as a <span class=CodeText><span style='font-size:10.0pt'>char *</span></span>\r
-(for instance, as an argument to <span class=CodeText><span style='font-size:\r
-10.0pt'>strlen</span></span>), since the correctness of this call depends on\r
-the representation of the abstract type.  Splint also reports errors if any C\r
-operator except assignment (<span class=CodeText><span style='font-size:10.0pt'>=</span></span>)\r
-or <span class=CodeText><span style='font-size:10.0pt'>sizeof</span></span> is\r
-used on an abstract type.  The assignment operator is allowed since its\r
-semantics do not depend on the representation of the type (for abstract types\r
-whose instances can change value, a client does need to know if assignment has\r
-copy or sharing semantics as discussed in Section 4.3.2).  The use of <span\r
-class=CodeText><span style='font-size:10.0pt'>sizeof</span></span> is also permitted, since this is the only way for clients to allocate pointers to\r
-the abstract type.  Type casting objects to or from abstract types in a client\r
-module is an abstraction violation and will generate a warning message.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Normally, Splint will assume\r
-a type definition is not abstract unless the <span class=Annot><span\r
-style='font-size:10.0pt'>/*@abstract@*/</span></span> qualifier is used.  If\r
-instead you want all user-defined types to be abstract types unless they are\r
-marked as <span class=Annot><span style='font-size:10.0pt'>concrete</span></span>,\r
-the <span class=Flag><span style='font-size:10.0pt'>+imp-abstract</span></span>\r
-flag can be used.  This adds an implicit <span class=Annot><span\r
-style='font-size:10.0pt'>abstract</span></span> annotation to any <span\r
-class=CodeText><span style='font-size:10.0pt'>typedef</span></span> that is not\r
-marked with <span class=Annot><span style='font-size:10.0pt'>/*@concrete@*/</span></span>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='width:418.5pt;margin-left:.9pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr style='height:13.45pt'>\r
-  <td  valign=top style='width:211.5pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>palindrome.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='width:207.0pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr style='height:196.2pt'>\r
-  <td valign=top style='width:211.5pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>\r
-  <p class=Verbatim><span style='font-size:9.0pt'># include &quot;bool.h&quot;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'># include\r
-  &quot;mstring.h&quot;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>bool isPalindrome (mstring s)</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 6</span></span><span\r
-  style='font-size:9.0pt'> char *current = (char *) s;</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 7</span></span><span\r
-  style='font-size:9.0pt'> int i, len = (int) strlen (s);</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>  for (i = 0; i &lt;= (len+1)\r
-  / 2; i++)</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>    {</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>11</span></span><span\r
-  style='font-size:9.0pt'>    if (current[i] != s[len-i-1])</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>        return FALSE;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>    }</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>  return TRUE;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>bool callPal (void)</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>19</span></span><i><span\r
-  style='font-size:9.0pt;font-family:Arial'>  </span></i><span\r
-  style='font-size:9.0pt'>return (isPalindrome (&quot;bob&quot;));</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>\r
-  </td>\r
-  <td valign=top style='width:207.0pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt;height:196.2pt'>\r
-  <p class=lclintrun>&gt; splint palindrome.c</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>palindrome.c:6: Cast from underlying</p>\r
-  <p class=lclintrun>    abstract type mstring: (char *)s</p>\r
-  <p class=lclintrun>palindrome.c:7: Function strlen expects arg</p>\r
-  <p class=lclintrun>    1 to be char * gets mstring: s</p>\r
-  <p class=lclintrun>palindrome.c:11: Array fetch from non-array</p>\r
-  <p class=lclintrun>    (mstring): s[len - i - 1]</p>\r
-  <p class=lclintrun>palindrome.c:19: Function isPalindrome</p>\r
-  <p class=lclintrun>    expects arg 1 to be mstring gets char *:</p>\r
-  <p class=lclintrun>    &quot;bob&quot;</p>\r
-  <p class=TextFontCX>&nbsp;</p>\r
-  <p class=lclintrun>Finished checking --- 4 code warnings</p>\r
-  <p class=TextFontCX><span style='font-size:\r
-  9.0pt;font-family:Times'>&nbsp;</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824609"></a><a name="_Toc347255385"></a><a\r
-  name="_Ref344908730"></a><a name="_Ref344908735">Figure 5</a>.  Information Hiding\r
-  Violations</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-<p align=right>\r
-<i><span style='font-size:9.0pt'> Traditionally, programming books wax mathematical when\r
-  they arrive at the topic of abstract data types\85<br>Such books make it seem as\r
-  if you\92d never actually use an abstract data type except as a sleep aid. </i></p>\r
-  <p class=TextFontCX align=right\r
-  style='text-align:right'><i><span style='font-size:9.0pt'>         </span></i><span\r
-  style='font-size:9.0pt'>   Steve McConnell</span><span style='font-size:9.0pt'> </span></p>\r
-  <p class=TextFontCX><i>&nbsp;</i></p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974954"></a><a\r
-name="_Ref344892422"></a><a name="_Ref344870884"></a><a name="_Toc344355398">4.3.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Controlling Access</a></h3>\r
-\r
-<p class=TextFontCX>Where code may manipulate the\r
-representation of an abstract type, we say the code has <i>access</i> to that\r
-type.  If code has access to an abstract type, the representation of the type\r
-and the abstract type are indistinguishable.  Usually, a single program module\r
-that is the only code that has access to the type representation implements an\r
-abstract type.  Sometimes, more complicated access control is desired if the implementation of an abstract type is split across program files, or particular\r
-client code needs to access the representation.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>There are a several ways of selecting what code has access\r
-the representation of an abstract type:</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Modules.  An abstract type defined in <i><span style='font-size:\r
-10.0pt;font-family:Arial'>M</span></i><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span> is\r
-accessible in <i><span style='font-size:10.0pt;font-family:Arial'>M</span></i><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>. \r
-Controlled by the <span class=Flag><span style='font-size:10.0pt'>accessmodule</span></span>\r
-flag.  This means when <span class=Flag><span style='font-size:10.0pt'>accessmodule</span></span>\r
-is on, as it is by default, the module access rule is in effect.  If <span\r
-class=Flag><span style='font-size:10.0pt'>accessmodule</span></span> is off (when <span class=Flag><span style='font-size:10.0pt'>-access-module</span></span>\r
-is used), the module access rule is not in effect and an abstract type defined\r
-in <i><span style='font-size:10.0pt;font-family:Arial'>M</span></i><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>\r
-is not necessarily accessible in <i><span style='font-size:10.0pt;font-family:\r
-Arial'>M</span></i><span class=Keyword><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>.c</span></span>.</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>File names.  An abstract type named <span class=CodeText><i><span\r
-style='font-size:10.0pt'>type</span></i></span> is accessible in files named <span\r
-class=CodeText><i><span style='font-size:10.0pt'>type.&lt;extension&gt;</span></i></span>. \r
-For example, the representation of <span class=CodeText><span style='font-size:\r
-10.0pt'>mstring</span></span> is accessible in <span class=CodeText><span\r
-style='font-size:10.0pt'>mstring.h</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>mstring.c</span></span>.  Controlled by the <span\r
-class=Flag><span style='font-size:10.0pt'>access-file</span></span> flag.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Function\r
-names.  An abstract type named <span class=CodeText><i><span style='font-size:\r
-10.0pt'>type</span></i></span> may be accessible in a function named <span\r
-class=CodeText><i><span style='font-size:10.0pt'>type_name</span></i></span> or\r
-<span class=CodeText><i><span style='font-size:10.0pt'>typeName</span></i></span>. \r
-For example, <span class=CodeText><span style='font-size:10.0pt'>mstring_length</span></span><span\r
-style='text-transform:uppercase'> </span>and <span class=CodeText><span\r
-style='font-size:10.0pt'>mstringLength</span></span> would have access to the <span\r
-class=CodeText><span style='font-size:10.0pt'>mstring</span></span> abstract\r
-type.  Controlled by <span class=Flag><span style='font-size:10.0pt'>accessfunction</span></span> and the naming convention (see Section 12).</p>\r
-\r
-<p class=TextFontCX style='margin-left:12.95pt;\r
-text-indent:-12.95pt'><span style='font-family:Symbol'>·<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></span>Access control comments. The syntax <span class=Annot><span\r
-style='font-size:10.0pt'>/*@access <i>type</i>,<sup>+</sup>@*/</span></span><a\r
-href="#_ftn2" name="_ftnref2" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>\r
-allows the following code to access the representation of <span class=CodeText><i><span\r
-style='font-size:10.0pt'>type</span></i></span>.  Similarly, <span class=Annot><span\r
-style='font-size:10.0pt'>/*@noaccess </span></span><span\r
-class=Annot><span style='font-size:10.0pt'><i>type</i>,<sup>+</sup>@*/ </span></span>restricts\r
-access to the representation of <span class=CodeText><i><span style='font-size:\r
-10.0pt'>type</span></i></span>.  The type in a <span class=Annot><span\r
-style='font-size:10.0pt'>noaccess</span></span> comment must have been declared\r
-as an abstract type.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974955"></a><a\r
-name="_Toc344355399"></a><a name="_Ref343240525"></a><a name="_Ref343240518">4.3.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Mutability</a></h3>\r
-\r
-<p class=TextFontCX>We can view types as being <i>mutable</i>\r
-or <i>immutable</i>.  A type is mutable if passing it as a parameter to a\r
-function call can change the value of an instance of the type.  For example,\r
-the primitive type <span class=CodeText><span style='font-size:10.0pt'>int</span></span>\r
-is immutable.  If <span class=CodeText><span style='font-size:10.0pt'>i</span></span>\r
-is a local variable of type <span class=CodeText><span style='font-size:10.0pt'>int</span></span>\r
-and no variables point to the location where <span class=CodeText><span\r
-style='font-size:10.0pt'>i</span></span> is stored, the value of <span\r
-class=CodeText><span style='font-size:10.0pt'>i</span></span> must be the same\r
-before and after the call <span class=CodeText><span style='font-size:10.0pt'>f\r
-(i)</span></span>.  Structure and union types are also immutable, since they\r
-are copied when they are passed as arguments.  On the other hand, pointer types\r
-are mutable.  If <span class=CodeText><span style='font-size:10.0pt'>x</span></span>\r
-is a local variable of type <span class=CodeText><span style='font-size:10.0pt'>int\r
-*</span></span>, the value of <span class=CodeText><span style='font-size:10.0pt'>*x</span></span>\r
-(and hence, the value of the object <span class=CodeText><span\r
-style='font-size:10.0pt'>x</span></span>) can be changed by the function call <span\r
-class=CodeText><span style='font-size:10.0pt'>g(x)</span></span>.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The mutability of a concrete\r
-type is determined by its type definition. For abstract types, mutability does\r
-not depend on the type representation but on what operations the type provides.\r
-If an abstract type has operations that may change the value of instances of\r
-the type, the type is mutable.  If not, it is immutable.  The value of an\r
-instance of an immutable type never changes.  Since object sharing is\r
-noticeable only for mutable types, they are checked differently from immutable\r
-types.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>The <span class=Annot><span style='font-size:10.0pt'>/*@mutable@*/</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>/*@immutable@*/</span></span>\r
-annotations are used to declare an abstract type as mutable or immutable.  (If\r
-neither is used, the abstract type is assumed to be mutable.)  For example,</p>\r
-\r
-<p class=Verbatim>   typedef /*@abstract@*/ /*@mutable@*/ char *mstring;</p>\r
-\r
-<p class=Verbatim>   typedef /*@abstract@*/ /*@immutable@*/ int weekDay;</p>\r
-\r
-<p class=afterlist>declares <span class=CodeText><span style='font-size:10.0pt'>mstring</span></span>\r
-as a mutable abstract type and <span class=CodeText><span style='font-size:\r
-10.0pt'>weekDay </span></span>as an immutable abstract type.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Clients of a mutable abstract\r
-type need to know the semantics of assignment.  After the assignment expression\r
-<span class=CodeText><span style='font-size:10.0pt'>s = t</span></span>, do <span\r
-class=CodeText><span style='font-size:10.0pt'>s</span></span> and <span\r
-class=CodeText><span style='font-size:10.0pt'>t</span></span> refer to the same\r
-object (that is, will changes to the value of <span class=CodeText><span\r
-style='font-size:10.0pt'>s</span></span> also change the value of <span\r
-class=CodeText><span style='font-size:10.0pt'>t</span></span>).</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint prescribes that all\r
-abstract types have sharing semantics, so <span class=CodeText><span\r
-style='font-size:10.0pt'>s</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>t</span></span> would indeed be the same object. \r
-Splint will produce a warning if a mutable type is implemented with a\r
-representation (e.g., a <span class=CodeText><span style='font-size:10.0pt'>struct</span></span>)\r
-that does not provide sharing semantics (controlled by <span class=Flag><span\r
-style='font-size:10.0pt'>mutrep</span></span> flag).  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The mutability of an abstract\r
-type is not necessarily the same as the mutability of its representation. We\r
-could use the immutable concrete type <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span> to represent mutable strings using\r
-an index into a string table, or declare <span class=CodeText><span\r
-style='font-size:10.0pt'>mstring</span></span> as immutable as long as no\r
-operations are provided that modify the value of an <span class=CodeText><span\r
-style='font-size:10.0pt'>mstring</span></span>.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974956"></a><a\r
-name="_Toc344355422"></a><a name="_Ref343109614">4.4<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Polymorphism</a></h2>\r
-\r
-<p class=TextFontCX>In C, all declarators must be\r
-declared to have exactly one type.  This makes it impossible to write functions\r
-that operate on more than one type of parameter \96 for example, we cannot use\r
-the same square function for <span class=CodeText><span style='font-size:10.0pt'>int</span></span>s\r
-and <span class=CodeText><span style='font-size:10.0pt'>float</span></span>s. \r
-Because of the stricter type checking made possible by Splint, it is often\r
-useful to declare a parameter that has more than one possible type.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint provides alternate\r
-types to indicate that a declaration may be one of several possible types.  The\r
-<span class=Annot><span style='font-size:10.0pt'>/*@alt <i>type</i>,<sup>+</sup>@*/\r
-</span></span>annotation creates a union type.  For example, <span\r
-class=CodeText><span style='font-size:10.0pt'>int </span></span><a\r
-href="mailto:/*@alt"><span class=Annot><span style='font-size:10.0pt'>/*@alt</span></span></a><span\r
-class=Annot><span style='font-size:10.0pt'> char, unsigned </span></span><a\r
-href="mailto:char@*/"><span class=Annot><span style='font-size:10.0pt'>char@*/</span></span></a><span\r
-class=CodeText><span style='font-size:10.0pt'> c </span></span>declares <span\r
-class=CodeText><span style='font-size:10.0pt'>c</span></span> such that either\r
-an <span class=CodeText><span style='font-size:10.0pt'>int</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>char</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>unsigned char</span></span> value\r
-may be assigned to it without warning.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>One use of alternate types is\r
-to specify the type of a macro that operates on multiple types of operands (see\r
-Section 11.2.1).  Alternate types are also useful for declaring functions for which the return value may be safely ignored (see Section 8.4.2).  A function can be declared to return <span\r
-class=CodeText><i><span style='font-size:10.0pt'>t</span></i></span> <a\r
-href="mailto:/*@alt"><span class=Annot><span style='font-size:10.0pt'>/*@alt</span></span></a><span\r
-class=Annot><span style='font-size:10.0pt'> </span></span><a\r
-href="mailto:void@*/"><span class=Annot><span style='font-size:10.0pt'>void@*/</span></span></a>\r
-to indicate that it returns a value of type <span class=CodeText><i><span\r
-style='font-size:10.0pt'>t</span></i></span>, but there should be not warning\r
-if that value is ignored.</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534974957"></a><a\r
-name="_Ref534008388">5<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Memory Management</a></h1>\r
-\r
-<p class=TextFontCX>About half the bugs in\r
-typical C programs can be attributed to memory management problems.  Memory management bugs are notoriously difficult to detect through traditional\r
-techniques.  Often, the symptom of the bug is far removed from its actual\r
-source.  Memory management bugs often only appear sporadically and some bugs\r
-may only be apparent when compiler optimizations are turned on or the code is\r
-compiled on a different platform.  Run-time tools offer some help, but are\r
-cumbersome to use and limited to detecting errors that occur when test cases\r
-are run.  By detecting these errors statically, we can be confident that\r
-certain types of errors will never occur and provide verified documentation on\r
-the memory management behavior of a program.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>Splint can detect many memory management errors at compile\r
-time including using storage that may have been deallocated (Section 5.2),\r
-memory leaks (Section 5.2), or returning a pointer to stack-allocated storage (Section 5.2.6).</p>\r
-\r
-\r
-<p align=right>\r
-<i><span style='font-size:9.0pt'>Yea, from the table\r
-  of my memory I'll wipe away all trivial fond records, all saws of books,<br>all\r
-  forms, all pressures past, that youth and observation copied there.</span></i><br>\r
-  <span\r
-  style='font-size:9.0pt'>Hamlet prefers garbage collection\r
-(Shakespeare, Hamlet. Act I, Scene v)</span></p>\r
-\r
-<p class=afterlist>Most of these checks depend on annotations added to programs\r
-to document assumptions related to memory management and pointer values.  By\r
-documenting these assumptions for function interfaces, variables, type\r
-definitions and structure fields, memory management bugs can be detected at\r
-their source \97 where an assumption is violated.  In addition, precise documentation\r
-about memory management decisions makes it easier to change code.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974958"></a><a\r
-name="_Toc344355408">5.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Storage Model</a></h2>\r
-\r
-<p class=TextFontCX>This section describes\r
-execution-time concepts for describing the state of storage more precisely than\r
-can be done using standard C terminology.  Certain uses of storage are likely\r
-to indicate program bugs, and are reported as anomalies.<a href="#_ftn3"\r
-name="_ftnref3" title=""><span class=MsoFootnoteReference><b><span\r
-class=MsoFootnoteReference><b><span style='font-size:11.0pt;font-family:"Times New Roman"'>[3]</span></b></span></b></span></a></p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint assumes a CLU-like object storage model.<a href="#_ftn4" name="_ftnref4" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:11.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a> \r
-An <i>object</i> is a typed region of storage.  Some objects use a fixed amount\r
-of storage that is allocated and deallocated automatically by the compiler. \r
-Other objects use dynamic storage that must be managed by the program.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Storage is <i>undefined</i>\r
-if it has not been assigned a value, and <i>defined</i> after it has been\r
-assigned a value.  An object is <i>completely defined</i> if all storage that\r
-may be reached from it is defined.  What storage is reachable from an object\r
-depends on the type and value of the object.  For example, if <span\r
-class=CodeText><span style='font-size:10.0pt'>p</span></span> is a pointer to a\r
-structure, <span class=CodeText><span style='font-size:10.0pt'>p</span></span>\r
-is completely defined if the value of <span class=CodeText><span\r
-style='font-size:10.0pt'>p</span></span> is <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span>, or if every field of the structure\r
-<span class=CodeText><span style='font-size:10.0pt'>p</span></span> points to\r
-is completely defined.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>When an expression is used as\r
-the left side of an assignment expression we say it is <i>used as an lvalue</i>. \r
-Its location in memory is used, but not its value.  Undefined storage may be\r
-used as an lvalue since only its location is needed.  When storage is used in\r
-any other way, such as on the right side of an assignment, as an operand to a\r
-primitive operator (including the indirection operator, <span class=CodeText><span\r
-style='font-size:10.0pt'>*</span></span>),<a href="#_ftn5" name="_ftnref5"\r
-title=""><span class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>\r
-or as a function parameter, we say it is <i>used as an rvalue</i>.  It is an\r
-anomaly to use undefined storage as an rvalue.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A <i>pointer</i> is a typed\r
-memory address.  A pointer is either <i>live</i> or <i>dead</i>.  A live\r
-pointer is either <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>\r
-or an address within allocated storage.  A pointer that points to an object is\r
-an <i>object</i> pointer.  A pointer that points inside an object (e.g., to the\r
-third element of an allocated block) is an <i>offset</i> pointer.  A pointer\r
-that points to allocated storage that is not defined is an <i>allocated</i>\r
-pointer.  The result of dereferencing an allocated pointer is undefined\r
-storage.  Hence, it is an anomaly to use it as an rvalue.  A dead (or\r
-\93dangling\94) pointer does not point to allocated storage.  A pointer becomes\r
-dead if the storage it points to is deallocated (e.g., the pointer is passed to\r
-the <span class=CodeText><span style='font-size:10.0pt'>free</span></span> library\r
-function.)  It is an anomaly to use a dead pointer as an rvalue.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>There is a special object <i>null</i>\r
-corresponding to the <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span><span\r
-class=Keyword><span style='font-size:10.0pt'> </span></span>pointer in a C\r
-program.  A pointer that may have the value <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span> is a <i>possibly-null</i> pointer. \r
-It is an anomaly to use a possibly-null pointer where a non-null pointer is\r
-expected (e.g., certain function arguments or the indirection operator).</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974959"></a><a\r
-name="_Ref347476065"></a><a name="_Ref347469133"></a><a name="_Ref347465595"></a><a\r
-name="_Ref344893840"></a><a name="_Toc344355409">5.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Deallocation Errors</a></h2>\r
-\r
-<p class=TextFontCX>There are two kinds of\r
-deallocation errors with which we are concerned:  deallocating storage when\r
-there are other live references to the same storage, or failing to deallocate\r
-storage before the last reference to it is lost.  To handle these deallocation\r
-errors, we introduce a concept of an obligation to release storage.  Every time\r
-storage is allocated, it creates an obligation to release the storage.  This\r
-obligation is attached to the reference to which the storage is assigned.<a\r
-href="#_ftn6" name="_ftnref6" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a> \r
-Before the scope of the reference is exited or it is assigned to a new value,\r
-the storage to which it points must be released.  Annotations can be used to indicate that this obligation is transferred through a return value,\r
-function parameter or assignment to an external reference.</p>\r
-\r
-<p align=right><i>\r
- <span style='font-size:9.0pt'>\91Tis\r
-  in my memory lock\92d, and you yourself shall keep the key of it.</span></i><br><span\r
-  style='font-size:9.0pt'>Ophelia prefers explicit deallocation (Hamlet. Act\r
-  I, Scene iii)</span></p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974960">5.2.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Unshared References</a></h3>\r
-\r
-  \r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span> annotation is used to indicate a\r
-reference is the only pointer to the object it points to.  We can view the\r
-reference as having an obligation to release this storage.  This obligation is\r
-satisfied by transferring it to some other reference in one of three ways:</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>pass\r
-it as an actual parameter corresponding to a formal parameter declared with an <span\r
-class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-annotation               </p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>assign\r
-it to an external reference declared with an <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span> annotation</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>return\r
-it as a result declared with an <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-annotation</p>\r
-\r
-<p class=afterlist>After the release obligation is transferred, the original\r
-reference is a dead pointer and the storage it points to may not be used. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>All obligations to release\r
-storage stem from primitive allocation routines (e.g., <span class=CodeText><span\r
-style='font-size:10.0pt'>malloc</span></span>), and are ultimately satisfied by\r
-calls to <span class=CodeText><span style='font-size:10.0pt'>free</span></span>.  The standard library declared the primitive allocation and deallocation routines.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The basic memory allocator, <span\r
-class=CodeText><span style='font-size:10.0pt'>malloc</span></span>, is declared:</p>\r
-\r
-<p class=example><a href="mailto:/*@only@*/">/*@only@*/</a> /*@null@*/ void\r
-*malloc (size_t size);</p>\r
-\r
-<p class=TextFontCX>It returns an object that is\r
-referenced only by the function return value.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The deallocator, <span\r
-class=CodeText><span style='font-size:10.0pt'>free</span></span>, is declared:<a href="#_ftn7" name="_ftnref7" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:11.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a></p>\r
-\r
-<p class=example>void free (/*@only@*/ <a href="mailto:/*@out@*/">/*@out@*/</a>\r
-<a href="mailto:/*@null@*/">/*@null@*/</a> void *ptr);</p>\r
-\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr>\r
-  <td valign=top style='width:193.5pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><a name="_Ref344990094"><span class=Keyword><b><span\r
-  style='font-size:10.0pt;color:white'>only.c</span></b></span></a></p>\r
-  </td>\r
-  <td valign=top style='width:225.0pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td valign=top style='width:193.5pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>1  </span></i><span\r
-  style='font-size:9.5pt'>extern /*@only@*/ int *glob;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>/*@only@*/ int *</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>f (/*@only@*/ int *x, int *y,</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>   int *z)</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>  /*@globals glob;@*/</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>{</span></p>\r
-  <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'> 8</span></i><span\r
-  style='font-size:9.5pt'> int *m = (int *)</span></p>\r
-  <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'> 9</span></i><span\r
-  style='font-size:9.5pt'>    malloc (sizeof (int));</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>11</span></i><span\r
-  style='font-size:9.5pt'> glob = y;    </span><i><span style='font-size:9.5pt;\r
-  font-family:"Times New Roman"'>Memory leak</span></i><span style='font-size:\r
-  9.5pt'> </span></p>\r
-  <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>12</span></i><span\r
-  style='font-size:9.5pt'> free (x);</span></p>\r
-  <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>13</span></i><span\r
-  style='font-size:9.5pt'> *m = *x;     </span><i><span style='font-size:9.5pt;\r
-  font-family:"Times New Roman"'>Use after free</span></i><span\r
-  style='font-size:9.5pt'> </span></p>\r
-  <p class=Verbatim><i><span style='font-size:8.0pt;font-family:Arial'>14</span></i><span\r
-  style='font-size:9.5pt'> return z;    </span><i><span style='font-size:9.5pt;\r
-  font-family:"Times New Roman"'>Memory leak detected</span></i><i><span\r
-  style='font-size:9.5pt;font-family:Arial'>  </span></i></p>\r
-  <p class=TextFontCX><span style='font-size:\r
-  9.5pt'>}</span></p>\r
-  </td>\r
-  <td valign=top style='width:225.0pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint only.c</p>\r
-  <p class=lclintrun>only.c:11: Only storage glob (type int *) not released</p>\r
-  <p class=lclintrun>              before assignment: glob = y</p>\r
-  <p class=lclintrun>   only.c:1: Storage glob becomes only</p>\r
-  <p class=lclintrun>only.c:11: Implicitly temp storage y assigned to only:</p>\r
-  <p class=lclintrun>              glob = y</p>\r
-  <p class=lclintrun>only.c:13: Dereference of possibly null pointer m: *m</p>\r
-  <p class=lclintrun>   only.c:8: Storage m may become null</p>\r
-  <p class=lclintrun>only.c:13: Variable x used after being released</p>\r
-  <p class=lclintrun>   only.c:12: Storage x released</p>\r
-  <p class=lclintrun>only.c:14: Implicitly temp storage z returned as only: z</p>\r
-  <p class=lclintrun>only.c:14: Fresh storage m not released before return</p>\r
-  <p class=lclintrun style='page-break-after:avoid'>   only.c:9: Fresh storage\r
-  m allocated   </p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top align=left style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824610">Figure 6.  Memory Management</a></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<p class=TextFontCX>The parameter to <span\r
-class=CodeText><span style='font-size:10.0pt'>free</span></span> must reference\r
-an unshared object.  Since the parameter is declared using <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span>, the caller may not use the\r
-referenced object after the call, and may not pass in a reference to a shared\r
-object.  There is nothing special about <span class=CodeText><span\r
-style='font-size:10.0pt'>malloc</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>free</span></span> \97 their behavior can be described\r
-entirely in terms of the provided annotations.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Ref347468963"></a><a\r
-name="_Toc534974961"></a><a name="_Ref347469360">5.2.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Temporary Parameters</a></h3>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>temp</span></span> annotation is used to declare a\r
-function parameter that is used temporarily by the function.  An error is\r
-reported if the function releases the storage associated with a <span\r
-class=Annot><span style='font-size:10.0pt'>temp</span></span> formal parameter\r
-or creates new aliases to it that are visible after the function returns.  Any\r
-storage may be passed as a <span class=Annot><span style='font-size:10.0pt'>temp</span></span>\r
-parameter, and it satisfies its original memory constraints after the function\r
-returns.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974962">5.2.3<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Owned and Dependent References</a></h3>\r
-\r
-<p class=TextFontCX>In real programs it is\r
-sometimes necessary to have storage that is shared between several possibly\r
-references.  The <span class=Annot><span style='font-size:10.0pt'>owned</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>dependent</span></span>\r
-annotations provide a more flexible way of managing storage, at the cost of\r
-less checking.  The <span class=Annot><span style='font-size:10.0pt'>owned</span></span>\r
-annotation denotes a reference with an obligation to release storage.  Unlike <span\r
-class=Annot><span style='font-size:10.0pt'>only</span></span>, however, other\r
-external references marked with <span class=Annot><span style='font-size:10.0pt'>dependent</span></span>\r
-annotations may share this object.  It is up to the programmer to ensure that\r
-the lifetime of a <span class=Annot><span style='font-size:10.0pt'>dependent</span></span>\r
-reference is contained within the lifetime of the corresponding <span\r
-class=Annot><span style='font-size:10.0pt'>owned</span></span> reference.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974963"></a><a\r
-name="_Ref347805800">5.2.4<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Keep Parameters</a></h3>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>keep</span></span> annotation is similar to <span\r
-class=Annot><span style='font-size:10.0pt'>only</span></span>, except the\r
-caller may use the reference after the call.  The called function must assign\r
-the <span class=Annot><span style='font-size:10.0pt'>keep</span></span>\r
-parameter to an <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-reference, or pass it as a <span class=Annot><span style='font-size:10.0pt'>keep</span></span>\r
-parameter to another function.  It is up to the programmer to make sure that\r
-the calling function does not use this reference after it is released.  The <span\r
-class=Annot><span style='font-size:10.0pt'>keep</span></span> annotation is\r
-useful for adding an object to a collection (e.g., a symbol table), where it is\r
-known that it will not be deallocated until the collection is. </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974964"></a><a\r
-name="_Ref347469304">5.2.5<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Shared References</a></h3>\r
-\r
-<p class=TextFontCX>If Splint is used to check a\r
-program designed to be used in a garbage-collected environment, there may be\r
-storage that is shared by one or more references and never explicitly\r
-released.  The <span class=Annot><span style='font-size:10.0pt'>shared</span></span> annotation declares storage that may be shared arbitrarily, but never released.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974965"></a><a\r
-name="_Ref348341639">5.2.6<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Stack References</a></h3>\r
-\r
-<p class=TextFontCX>Local variables that are not\r
-allocated dynamically are stored on a call stack.  When a function returns, its\r
-stack frame is deallocated, destroying the storage associated with the\r
-function\92s local variables.  A memory error occurs if a pointer into this\r
-storage is live after the function returns.  Splint detects errors involving stack\r
-references exported from a function through return values or assignments to\r
-references reachable from global variables or actual parameters.  No\r
-annotations are needed to detect stack reference errors, since it is clear from\r
-a declaration if storage is allocated on the function stack.  Figure 7 gives and example of errors reported involving stack-allocated storage.</p>\r
-<p>\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
- style='margin-left:5.4pt;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr>\r
-  <td valign=top style='width:2.25in;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>stack.c</span></b></span></p>\r
-  </td>\r
-  <td valign=top style='width:256.5pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td valign=top style='width:2.25in;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim>int *glob;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>/*@dependent@*/ int *</p>\r
-  <p class=Verbatim>  f (int **x)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  int sa[2] = { 0, 1 };</p>\r
-  <p class=Verbatim>  int loc = 3;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 9</span></span>\r
-  glob = &amp;loc;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10</span></span>\r
-  *x = &amp;sa[0];</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>12</span></span>\r
-  return &amp;loc;</p>\r
-  <p class=Verbatim>}  </p>\r
-  </td>\r
-  <td valign=top style='width:256.5pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint stack.c</p>\r
-  <p class=lclintrun>stack.c:12: Stack-allocated storage &amp;loc reachable</p>\r
-  <p class=lclintrun>               from return value: &amp;loc</p>\r
-  <p class=lclintrun>stack.c:12: Stack-allocated storage *x reachable from</p>\r
-  <p class=lclintrun>               parameter x</p>\r
-  <p class=lclintrun>   stack.c:10: Storage *x becomes stack</p>\r
-  <p class=lclintrun>stack.c:12: Stack-allocated storage glob reachable</p>\r
-  <p class=lclintrun>               from global glob</p>\r
-  <p class=lclintrun>   stack.c:9: Storage glob becomes stack</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left;page-break-after:avoid'><i>A </i><span class=Annot><span\r
-  style='font-size:10.0pt'>dependent</span></span><i> annotation is used on the\r
-  return value.  Without this, other warnings would be reported, since the\r
-  result would have an implicit </i><span class=Annot><span style='font-size:\r
-  10.0pt'>only</span></span><i> annotation.</i></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:5.05pt;padding-right:\r
-  9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824611"></a><a name="_Ref534821941">Figure\r
-  7</a>.  Stack-Allocated Storage</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974966">5.2.7<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Inner Storage</a></h3>\r
-\r
-<p class=TextFontCX>An annotation always applies\r
-to the outermost level of storage.  For example,</p>\r
-\r
-<p class=example>/*@only@*/ int **x;</p>\r
-\r
-<p class=beforelist>declares <span class=CodeText><span style='font-size:10.0pt'>x</span></span>\r
-as an unshared pointer to a pointer to an <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span>.  The <span class=Flag><span\r
-style='font-size:10.0pt'>only</span></span> annotation applies to <span\r
-class=CodeText><span style='font-size:10.0pt'>x</span></span>, but not to <span\r
-class=CodeText><span style='font-size:10.0pt'>*x</span></span>.  To apply\r
-annotations to inner storage a type definition may be used:</p>\r
-\r
-<p class=Verbatim>  typedef /*@only@*/ int *oip;</p>\r
-\r
-<p class=Verbatim>  /*@only@*/ oip *x;</p>\r
-\r
-<p class=afterlist>Now, x is an <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-pointer to an <span class=Annot><span style='font-size:10.0pt'>oip</span></span>,\r
-which is an <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-pointer to an <span class=Annot><span style='font-size:10.0pt'>int</span></span>.</p>\r
-\r
-<p class=afterlist>When annotations are used in type definitions, they may be\r
-overridden in instance declarations.  For example,</p>\r
-\r
-<p class=example>/*@dependent@*/ oip x;</p>\r
-\r
-<p class=TextFontCX>makes <span class=CodeText><span\r
-style='font-size:10.0pt'>x</span></span> a <span class=Annot><span\r
-style='font-size:10.0pt'>dependent</span></span> pointer to an <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span>.  Another way\r
-to apply annotations to inner storage is to use a state clause (see Section 7.4).</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974967"></a><a\r
-name="_Ref347812243"></a><a name="_Ref344893978"></a><a name="_Toc344355410">5.3<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Implicit Memory Annotations</a></h2>\r
-\r
-<p class=TextFontCX>Since it is important that\r
-Splint can check unannotated programs effectively, the meaning of declarations\r
-with no memory annotations is chosen to minimize the number of annotations\r
-needed to get useful checking on an unannotated program. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>An implicit memory management\r
-annotation may be assumed for declarations with no explicit memory management\r
-annotation.  Implicit annotations are checked identically to the corresponding\r
-explicit annotation, except error messages indicate that they result from an\r
-implicit annotation.  Figure 8 illustrates some implicit annotations.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Unannotated function\r
-parameters are assumed to be <span class=Annot><span style='font-size:10.0pt'>temp</span></span>. \r
-This means if memory checking is turned on for an unannotated program, all\r
-functions that release storage referenced by a parameter or assign a global\r
-variable to alias the storage will produce error messages.  (Controlled by <span\r
-class=Flag><span style='font-size:10.0pt'>paramimptemp</span></span>.)</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0  style='width:423.0pt;margin-left:.9pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr style='page-break-inside:avoid'>\r
-  <td colspan=2 valign=top style='width:423.0pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>implicit.c</span></b></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td valign=top style='width:207.0pt;border-top:none;border-left:\r
-  solid black 1.5pt;border-bottom:solid black 1.5pt;border-right:none;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim>typedef struct {</p>\r
-  <p class=Verbatim>   <span class=implicit><b>only</b></span> char *name;</p>\r
-  <p class=Verbatim>   int   val;</p>\r
-  <p class=Verbatim>} *rec;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>extern <span class=implicit><b>only</b></span> rec rec_last\r
-  ;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>extern <span class=implicit><b>only</b></span> rec </p>\r
-  <p class=Verbatim>   rec_create (<span class=implicit><b>temp</b></span> char\r
-  *name, </p>\r
-  <p class=Verbatim>               int val) ;</p>\r
-  <p class=TextFontCX><i>Annotations in </i><span\r
-  class=Keyword><b><i><span style='font-size:10.0pt;color:windowtext'>italics</span></i></b></span><i>\r
-  are not present in the code, but may be implied depending on flag settings.</i></p>\r
-  </td>\r
-  <td valign=top style='width:3.0in;border-top:none;border-left:none;\r
-  border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>&nbsp;</p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'><i>Implicit </i><span class=Annot><i><span\r
-  style='font-size:10.0pt'>only</span></i></span><i> annotation on mutable\r
-  structure field if </i><span class=Flag><span style='font-size:10.0pt'>structimponly</span></span><i>\r
-  </i><i>is on.</i></p>\r
-  <p class=lclintrun><i>&nbsp;</i></p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'><i>Implicit </i><span class=Annot><span\r
-  style='font-size:10.0pt'>only</span></span><i> annotation on mutable global\r
-  variables if </i><span class=Flag><span style='font-size:10.0pt'>globimponly</span></span><i>\r
-  </i><i>is on.</i></p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'><i>&nbsp;</i></p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left;page-break-after:avoid'><i>Implicit </i><span\r
-  class=Annot><span style='font-size:10.0pt'>only</span></span><i> annotation\r
-  on mutable function result if </i><span class=Flag><span style='font-size:\r
-  10.0pt'>retimponly</span></span><i> </i><i>is set. Implicit </i><span\r
-  class=Annot><span style='font-size:10.0pt'>temp</span></span><i> annotation\r
-  on mutable parameter if </i><span class=Flag><span style='font-size:10.0pt'>paramimptemp</span></span><i>\r
-  </i><i>is set.</i></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top align=left style='padding-top:.1in;padding-right:\r
-  9.35pt;padding-bottom:.1in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824612"></a><a name="_Ref534822006">Figure\r
-  8</a>.  Implicit Annotations</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-<p class=TextFontCX>Unannotated return values,\r
-structure fields and global variables are assumed to be <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span>.  With implicit annotations (on by\r
-default), turning on memory checking for an unannotated program will produce\r
-errors for any function that does not return unshared storage or assignment of shared\r
-storage to a global variable or structure field.  If an exposure qualifier is\r
-used (see Section 6.2), the implied <span class=Annot><span style='font-size:\r
-10.0pt'>dependent</span></span> annotation is used instead of the more\r
-generally implied <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-annotation.  (Controlled by <span class=Flag><span style='font-size:10.0pt'>retimponly</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>structimponly</span></span> and <span class=Flag><span style='font-size:10.0pt'>globimponly</span></span>.  The <span\r
-class=Flag><span style='font-size:10.0pt'>allimponly</span></span> flag sets all of the implicit only flags.)   </p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974968"></a><a\r
-name="_Ref534970957"></a><a name="_Ref347469058"></a><a name="_Ref344907383"></a><a\r
-name="_Toc344355411">5.4<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Reference Counting</a></h2>\r
-\r
-<p class=TextFontCX>Another approach to memory\r
-management is to add a field to a type to explicitly keep track of the number\r
-of references to that storage.  Every time a reference is added or lost the\r
-reference count is adjusted accordingly; if it would become zero, the storage\r
-is released.  Reference counting it difficult to do without automatic checking\r
-since it is easy to forget to increment or decrement the reference count, and\r
-exceedingly difficult to track down these errors.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint supports reference\r
-counting by using annotations to constrain the use of reference counted storage\r
-in a manner similar to other memory management annotations.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A reference counted type is\r
-declared using the <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span> annotation.  Only pointer to <span class=CodeText><span style='font-size:10.0pt'>struct</span></span>\r
-types may be declared as <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>,\r
-since reference counted storage must have a field to count the references.  One\r
-field in the structure (or integral type) is preceded by the <span class=Annot><span\r
-style='font-size:10.0pt'>refs</span></span> annotation to indicate that the\r
-value of this field is the number of live references to the structure. For\r
-example (in <span class=Keyword><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>rstring.h</span></span>),</p>\r
-\r
-<p class=Verbatim style='margin-top:6.0pt'>      typedef /*@abstract@*/ /*@refcounted@*/ struct {</p>\r
-\r
-<p class=Verbatim>        /*@refs@*/ int refs;</p>\r
-\r
-<p class=Verbatim>        char *contents;</p>\r
-\r
-<p class=Verbatim>      } *rstring;</p>\r
-\r
-<p class=afterlist>declares <span class=CodeText><span style='font-size:10.0pt'>rstring</span></span>\r
-as an abstract, reference-counted type.  The <span class=CodeText><span\r
-style='font-size:10.0pt'>refs</span></span> field counts the number of\r
-references and the <span class=CodeText><span style='font-size:10.0pt'>contents</span></span>\r
-field holds the contents of a string.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='width:425.5pt;margin-left:.2in;border-collapse:collapse'>\r
- <tr>\r
-  <td valign=top style='width:267.05pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>rstring.c</span></b></span></p>\r
-  </td>\r
-  <td valign=top style='width:158.45pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td valign=top style='width:267.05pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim><span style='font-size:9.0pt'># include\r
-  &quot;rstring.h&quot;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>static rstring rstring_ref\r
-  (rstring r)</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>  r-&gt;refs++;</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>6</span></span><span\r
-  style='font-size:9.0pt'> return r;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>rstring rstring_first\r
-  (rstring r1, rstring r2)</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>{</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>  if (strcmp\r
-  (r1-&gt;contents, r2-&gt;contents) &lt; 0)</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>12</span></span><span\r
-  style='font-size:9.0pt'>   return r1;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>   else</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>14</span></span><span\r
-  style='font-size:9.0pt'>     return rstring_ref (r2);</span></p>\r
-  <p class=Verbatim><span style='font-size:9.0pt'>}</span></p>\r
-  </td>\r
-  <td  valign=top style='width:158.45pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint rstring.c</p>\r
-  <p class=lclintrun>rstring.c:12: Reference counted  </p>\r
-  <p class=lclintrun>   storage returned without modifying</p>\r
-  <p class=lclintrun>   reference count: r1</p>\r
-  <p class=lclintrun><i>&nbsp;</i></p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'><i><span style='font-size:10.0pt'>No error is\r
-  reported for line 6 since the reference count was incremented.  No error is\r
-  reported for line 14, since </span></i><span class=CodeText><i><span\r
-  style='font-size:10.0pt'>rstring_ref</span></i></span><i><span\r
-  style='font-size:10.0pt'> returns a new reference.</span></i></p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left;page-break-after:avoid'><span style='font-size:10.0pt'>&nbsp;</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0 align=center>\r
- <tr>\r
-  <td valign=top align=left style='padding-top:.1in;padding-right:\r
-  0in;padding-bottom:.1in;padding-left:0in'>\r
-  <p class=MsoCaption><a name="_Toc534824613"></a><a name="_Ref534822069">Figure\r
-  9</a>.  Reference Counting</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-<br clear=ALL>\r
-\r
-<p class=TextFontCX>All functions that return <span\r
-class=Annot><span style='font-size:10.0pt'>refcounted</span></span> storage\r
-must increase the reference count before returning.  Splint cannot determine if\r
-the reference count was increased, so any function that directly returns a\r
-reference to <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>\r
-storage will produce an error.  This is avoided, by using a function to return\r
-a new reference (e.g., <span class=CodeText><span style='font-size:10.0pt'>rstring_ref</span></span>\r
-in Figure 9).</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A reference counted type may\r
-be passed as a <span class=Annot><span style='font-size:10.0pt'>temp</span></span>\r
-or <span class=Annot><span style='font-size:10.0pt'>dependent</span></span>\r
-parameter.  It may not be passed as an <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span> parameter.  Instead, the <span\r
-class=Annot><span style='font-size:10.0pt'>killref</span></span> annotation is\r
-used to denote a parameter whose reference is eliminated by the function call. \r
-Like <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-parameters, an actual parameter corresponding to a <span class=Annot><span\r
-style='font-size:10.0pt'>killref</span></span> formal parameter may not be used\r
-in the calling function after the call.  Splint checks that the implementation\r
-of a function releases all <span class=Annot><span style='font-size:10.0pt'>killref</span></span>\r
-parameters, either by passing them as <span class=Annot><span style='font-size:\r
-10.0pt'>killref</span></span> parameters, or assigning or returning them\r
-without increasing the reference count.</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Ref348845247"></a><a\r
-name="_Ref348796245"></a><a name="_Toc344355413"></a><a name="_Ref344355210"></a><a\r
-name="_Ref343064238"></a><a name="_Ref343064188"></a><a name="_Toc534974969"></a><a\r
-name="_Ref534642796"></a><a name="_Ref534642146">6<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Sharing</a></h1>\r
-\r
-<p class=TextFontCX>Errors involving unexpected sharing of storage can cause serious problems.  Undocumented sharing may lead to unpredictable modifications, and some library calls (e.g., <span\r
-class=CodeText><span style='font-size:10.0pt'>strcpy</span></span>) have\r
-undefined behavior if parameters share storage.  Another class of sharing\r
-errors occurs when clients of an abstract type may obtain a reference to\r
-mutable storage that is part of the abstract representation.  This exposes the\r
-representation of the abstract type, since clients may modify an instance of the abstract type indirectly through this shared storage.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Ref534977801"></a><a\r
-name="_Toc534974970">6.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Aliasing</a></h2>\r
-\r
-<p class=TextFontCX>Splint detects errors\r
-involving dangerous aliasing of parameters.  Some of these errors are already\r
-detected through the standard memory annotations (e.g., <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span> parameters may not be aliases.)   Two additional annotations are provided for constraining aliasing of parameters and return values.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974971"></a><a\r
-name="_Ref347469444">6.1.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Unique Parameters</a></h3>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>unique</span></span> annotation denotes a parameter that may not be aliased by any other storage reachable from the function implementation \97 that is, any storage reachable through the other parameters\r
-or global variables used by the function.  The <span class=Annot><span\r
-style='font-size:10.0pt'>unique</span></span> annotation places similar\r
-constraints on function parameters as the <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span> annotation, but it does not transfer\r
-the obligation to release storage.  Splint will report an error if a <span\r
-class=Annot><span style='font-size:10.0pt'>unique</span></span> parameter may\r
-be aliased by another parameter or global variable.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint reports an error if a\r
-function returns a reference to storage reachable from one of its parameters\r
-(if <span class=Flag><span style='font-size:10.0pt'>retalias</span></span> is on) since this may introduce unexpected aliases in the body of the calling\r
-function when the result is assigned.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Figure 10 illustrated sharing checks.  An error is reported since the first parameter to the library function <span\r
-class=CodeText><span style='font-size:10.0pt'>strcpy</span></span> is declared\r
-with unique.  If a <span class=CodeText><span style='font-size:10.0pt'>unique</span></span>\r
-qualifier were added to the parameter declaration for <span class=CodeText><span\r
-style='font-size:10.0pt'>s</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>t</span></span>, no error would be reported.  </p>\r
-<p>\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
-  style='margin-left:5.4pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>unique.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim># include &lt;string.h&gt;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>void  </p>\r
-  <p class=Verbatim>capitalize (/*@out@*/ char *s,</p>\r
-  <p class=Verbatim>            char *t)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> 7</span></span> \r
-  strcpy (s, t);</p>\r
-  <p class=Verbatim>   *s = toupper (*s);</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td  valign=top style='border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint unique.c</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>unique.c: (in function capitalize)</p>\r
-  <p class=lclintrun>unique.c:7: Parameter 1 (s) to function strcpy is</p>\r
-  <p class=lclintrun>    declared unique but may be aliased externally by</p>\r
-  <p class=lclintrun>    parameter 2 (t)</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top align=left style='padding-top:6.5pt;padding-right:\r
-  9.35pt;padding-bottom:6.5pt;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824614"></a><a name="_Ref534822167">Figure\r
-  10</a>.  Unique parameters</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974972"></a><a\r
-name="_Ref347469448">6.1.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Returned Parameters</a></h3>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>returned</span></span> annotation denotes a parameter that may be aliased by the return value.  Splint\r
-checks the call assuming the result may be an alias to the <span class=Annot><span\r
-style='font-size:10.0pt'>returned</span></span> parameter.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Consider the following code\r
-excerpt:</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=Verbatim>extern intSet intSet_insert (/*@returned@*/ intSet s, int x);</p>\r
-\r
-<p class=Verbatim> </p>\r
-\r
-<p class=Verbatim>intSet intSet_singleton (int x)</p>\r
-\r
-<p class=Verbatim>{</p>\r
-\r
-<p class=Verbatim><span class=Line><span style='font-size:8.0pt'>7</span></span> \r
-return (intSet_insert (intSet_new (), x));</p>\r
-\r
-<p class=TextFontCX>}</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Without the <span\r
-class=Annot><span style='font-size:10.0pt'>returned</span></span> qualifier on\r
-the parameter to <span class=CodeText><span style='font-size:10.0pt'>intSet_insert</span></span>,\r
-a memory leak error would be reported for line 7, since the <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span><span style='font-size:10.0pt'> </span>storage\r
-returned by <span class=CodeText><span style='font-size:10.0pt'>intSet_new</span></span>\r
-is not released.  Because of the <span class=Annot><span style='font-size:10.0pt'>returned</span></span>\r
-qualifier, Splint assumes the result of <span class=CodeText><span\r
-style='font-size:10.0pt'>intSet_insert</span></span> is the same storage as its\r
-first parameter, in this case the storage returned by <span class=CodeText><span\r
-style='font-size:10.0pt'>intSet_new</span></span>.  No error is reported, since\r
-the only storage is then transferred through the return value (which has an\r
-implicit only annotation, see Section 5.3).</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Ref344907981"></a><a\r
-name="_Ref344894258"></a><a name="_Ref344809320"></a><a name="_Toc344355414"></a><a\r
-name="_Toc534974973"></a><a name="_Ref345591408"></a><a name="_Ref345591053">6.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Exposure</a></h2>\r
-\r
-<p class=TextFontCX>Splint detects places where\r
-the representation of an abstract type is exposed.  This occurs if a client has\r
-a pointer to storage that is part of the representation of an instance of the\r
-abstract type.  The client can then modify or examine the storage this points\r
-to, and manipulate the value of the abstract type instance without using its\r
-operations.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>There are three ways a\r
-representation may be exposed:</p>\r
-\r
-<p class=TextFontCX style='margin-left:.25in;\r
-text-indent:-.25in'>1.<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Returning (or assigning to a global variable) an object that includes a\r
-pointer to a mutable component of an abstract type representation.  (Controlled by <span class=Flag><span style='font-size:10.0pt'>ret-expose</span></span>).</p>\r
-\r
-<p class=TextFontCX style='margin-left:.25in;\r
-text-indent:-.25in'>2.<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Assigning a mutable component of an abstract object to storage reachable\r
-from an actual parameter or a global variable that may be used after the call.   This means the client may manipulate the abstract object using the actual\r
-parameter after the call.  Note that if the corresponding formal parameter is\r
-declared <span class=Annot><span style='font-size:10.0pt'>only</span></span>,\r
-the caller may not use the actual parameter after the call so the\r
-representation is not exposed.  (Controlled by <span class=Flag><span\r
-style='font-size:10.0pt'>assign-expose</span></span>).</p>\r
-\r
-<p class=TextFontCX style='margin-left:.25in;\r
-text-indent:-.25in'>3.<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Casting mutable storage to or from an abstract type.  (Controlled by <span class=Flag><span style='font-size:10.0pt'>cast-expose</span></span>).</p>\r
-\r
-<p class=afterlist>Annotations may be used to allow exposed storage to be\r
-returned safely by restricting how the caller may use the returned storage.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974974"></a><a\r
-name="_Ref347469553">6.2.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Read-Only Storage</a></h3>\r
-\r
-<p class=beforelist>It is often useful for a function to return a pointer to\r
-internal storage (or an instance of a mutable abstract type) that is intended\r
-only as an <i>observer</i>.  The caller may use the result, but should not\r
-modify the storage it points to.  For example, consider a naïve implementation\r
-of the <span class=CodeText><span style='font-size:10.0pt'>employee_getName</span></span>\r
-operation for the abstract <span class=CodeText><span style='font-size:10.0pt'>employee</span></span>\r
-type:</p>\r
-\r
-<p class=Verbatim>   typedef /*@abstract@*/ struct {</p>\r
-\r
-<p class=Verbatim>      char *name;</p>\r
-\r
-<p class=Verbatim>      int id;</p>\r
-\r
-<p class=Verbatim>   } *employee;</p>\r
-\r
-<p class=Verbatim>   \85</p>\r
-\r
-<p class=Verbatim>   char *employee_getName (employee e) { return e-&gt;name; }</p>\r
-\r
-<p class=afterlist>Splint produces a message to indicate that the return value\r
-exposes the representation.  One solution would be to return a fresh copy of <span\r
-class=CodeText><span style='font-size:10.0pt'>e-&gt;name</span></span>.  This\r
-is expensive, though, especially if we expect <span class=CodeText><span\r
-style='font-size:10.0pt'>employee_getName</span></span> is used mainly just to\r
-get a string for searching or printing.  Instead, we could change the\r
-declaration of <span class=CodeText><span style='font-size:10.0pt'>employee_getName</span></span>\r
-to:</p>\r
-\r
-<p class=example>extern /*@observer@*/ char *employee_getName (employee e);</p>\r
-\r
-<p class=TextFontCX>Now, the original\r
-implementation is correct.  The declaration indicates that the caller may not\r
-modify the result, so it is acceptable to return shared storage.  (The program\r
-must also not use the returned observer storage after any other calls to the\r
-abstract type module using the same parameter.  Splint does not attempt to\r
-check this, and in practice it is rarely a problem.)  Splint checks that the\r
-caller does not modify the return value.  An error is reported if observer\r
-storage is modified directly, passed as a function parameter that may be\r
-modified, assigned to a global variable or reference derivable from a global\r
-variable that is not declared with an <span class=Annot><span style='font-size:\r
-10.0pt'>observer</span></span> annotation , or returned as a function result or\r
-a reference derivable from the function result that is not annotation with an <span\r
-class=Annot><span style='font-size:10.0pt'>observer</span></span> annotation.</p>\r
-\r
-<h4 style='margin-left:0in;text-indent:0in'><a name="_Ref347469563"></a><a\r
-name="_Ref348017065">String Literals</a></h4>\r
-\r
-<p class=TextFontCX>A program that attempts to modify a string literal has undefined behavior [ISO, 6.4.5]. This is not enforced by most C compilers, and can lead to particularly\r
-pernicious bugs that only appear when optimizations are turned on and the\r
-compiler attempts to minimize storage for string literals.  Splint can be used\r
-to check that string literals are not modified, by treating them as -<span\r
-class=Annot><span style='font-size:10.0pt'>observer</span></span> storage.  If <span class=Flag><span style='font-size:10.0pt'>+read-only-strings</span></span>\r
-is set (default in standard mode), Splint will report an error if a string\r
-literal is modified. </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974975">6.2.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Exposed Storage</a></h3>\r
-\r
-<p class=TextFontCX>Sometimes it is necessary to\r
-expose the representation of an abstract type.  This may be evidence of a\r
-design flaw, but in some cases is justified for efficiency reasons.  The <span\r
-class=Annot><span style='font-size:10.0pt'>exposed</span></span> annotation denotes storage that is exposed.  It may be used on a return value for results that\r
-reference storage internal to an abstract representation, on a parameter value\r
-to indicate a parameter that may be assigned directly to part of an abstract\r
-representation (note that if the parameter is annotated with <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span>, it is not an error to assign it to\r
-part of an abstract representation, since the caller may not use the storage\r
-after the call returns), or on a field of an abstract representation to\r
-indicate that external references to the storage may exist.  <a\r
-name="_Toc344355415"></a><a name="_Ref343064165"></a><a name="_Ref347254440"></a><a\r
-name="_Ref347169365">An error is reported if </a><span class=Annot><span\r
-style='font-size:10.0pt'>exposed</span></span> storage is released, but unlike\r
-an <span class=Annot><span style='font-size:10.0pt'>observer</span></span>, no\r
-error is reported if it is modified.  Figure 11 shows examples of exposure problems detected by Splint.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='margin-left:6.75pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr>\r
-  <td width="45%" valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>exposure.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim># include &quot;employee.h&quot;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>char *</p>\r
-  <p class=Verbatim>employee_getName (employee e) </p>\r
-  <p class=Verbatim>{ </p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>6</span></span> \r
-  return e-&gt;name; </p>\r
-  <p class=Verbatim>}</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>/*@observer@*/ char *</p>\r
-  <p class=Verbatim>employee_obsName (employee e) </p>\r
-  <p class=Verbatim>{ return e-&gt;name; }</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>/*@exposed@*/ char *</p>\r
-  <p class=Verbatim>employee_exposeName (employee e)</p>\r
-  <p class=Verbatim>{ return e-&gt;name; }</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>void </p>\r
-  <p class=Verbatim>employee_capName (employee e)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  char *name;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>  name = employee_obsName (e);</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>23 </span></span>*name\r
-  = toupper (*name);</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td  valign=top style='border-top:none;border-left:none;\r
-  border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint exposure.c +checks</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>exposure.c:6: Function returns reference to</p>\r
-  <p class=lclintrun>                 parameter e: e-&gt;name</p>\r
-  <p class=lclintrun>exposure.c:6: Return value exposes rep of</p>\r
-  <p class=lclintrun>                 employee: e-&gt;name</p>\r
-  <p class=lclintrun>exposure.c:6: Released storage e-&gt;name reachable</p>\r
-  <p class=lclintrun>                 from parameter at return point</p>\r
-  <p class=lclintrun>   exposure.c:6: Storage e-&gt;name is released</p>\r
-  <p class=lclintrun>exposure.c:23: Suspect modification of observer</p>\r
-  <p class=lclintrun>                  name: *name = toupper(*name)</p>\r
-  <p class=TextFontCX style='page-break-after:\r
-  avoid'>&nbsp;</p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left;page-break-after:avoid'><i><span style='font-size:\r
-  10.0pt'>Three messages are reported for line 6 where a mutable field of an\r
-  abstract type is returned with no sharing qualifier (without </span></i><span\r
-  class=Flag><span style='font-size:10.0pt'>+checks</span></span><i><span\r
-  style='font-size:10.0pt'> only the third one would be reported.)  The error\r
-  for line 23 reports a modification of an observer.  If the call in line 22\r
-  were changed to call </span></i><span class=CodeText><span style='font-size:\r
-  10.0pt'>employee_exposeName</span></span><i><span style='font-size:10.0pt'>,\r
-  no error would be reported.</span></i></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0 >\r
- <tr>\r
-  <td valign=top style='padding-top:.1in;padding-right:\r
-  9.35pt;padding-bottom:.1in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824615">Figure 11.  Exposure</a></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Ref361649198"></a><a\r
-name="_Ref361649165"></a><a name="_Ref354415790"></a><a name="_Ref350062908"></a><a\r
-name="_Ref348845273"></a><a name="_Ref345591297"></a><a name="_Ref344916609"></a><a\r
-name="_Ref344894369"></a><a name="_Ref344891459"></a><a name="_Ref344798185"></a><a\r
-name="_Toc344355418"></a><a name="_Toc534974976"></a><a name="_Ref534014913"></a><a\r
-name="_Ref534014715"></a><a name="_Ref348871484">7<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Function Interfaces</a></h1>\r
-\r
-<p class=TextFontCX>Functions communicate with their calling environment through an interface.  The caller communicates\r
-the values of actual parameters and global variables to the function, and the\r
-function communicates to the caller through the return value, global variables\r
-and storage reachable from the actual parameters.  By keeping interfaces narrow\r
-(restricting the amount of information visible across a function interface), we\r
-can understand and implement functions independently.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A function prototype\r
-documents the interface to a function.  It serves as a contract between the\r
-function and its caller.  In early versions of C, the function \93prototype\94 was\r
-very limited.  It described the type returned by the function but nothing about\r
-its parameters.  ANSI C (1989) provided function prototypes with the ability to\r
-add information on the number and types of parameter to a function.  Splint\r
-provides the means to express much more about a function interface such as what\r
-global variable the function may use and what values visible to the caller it\r
-may modify.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The extra interface\r
-information places constraints on both how the function may be called and how\r
-it may be implemented.  Splint reports places where these constraints are not\r
-satisfied.  Typically, these indicate bugs in the code or errors in the\r
-interface documentation.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>This section describes\r
-annotations that may be added to a function declaration to document what global\r
-variables the function implementation may use and what values visible to its\r
-caller it may modify.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974977"></a><a\r
-name="_Ref348845225"></a><a name="_Ref344908335"></a><a name="_Ref344892358"></a><a\r
-name="_Toc344355403">7.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Modifications</a></h2>\r
-\r
-<p class=TextFontCX>The modifies clause lists what values visible to the caller may be modified by a function. \r
-Modifies clauses limit what values a function may modify, but they do not\r
-require that listed values are always modified.  The declaration,</p>\r
-\r
-<p class=example>int f (int *p, int *q) /*@modifies *p@*/;</p>\r
-\r
-<p class=TextFontCX>declares a function <span\r
-class=CodeText><span style='font-size:10.0pt'>f</span></span> that may modify\r
-the value pointed to by its first argument but may not modify the value of its\r
-second argument or any global state.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint checks that a function\r
-does not modify any caller-visible value not encompassed by its modifies clause\r
-and does modify all values listed in its modifies clause on some possible\r
-execution of the function.  Figure 12 shows an example of modifies checking done by Splint.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<center>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
- style='margin-left:5.4pt;border-collapse:collapse' width=80%>\r
- <tr>\r
-  <td width="40%" valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><a name="_Ref344908343"><span class=Keyword><b><span\r
-  style='font-size:10.0pt;color:white'>modify.c</span></b></span></a></p>\r
-  </td>\r
-  <td width=60% valign=top style='border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt;height:13.5pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr style='height:120.9pt'>\r
-  <td valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>\r
-  <p class=Verbatim>void setx (int *x, int *y)</p>\r
-  <p class=Verbatim>  /*@modifies *x@*/</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>4</span></span> \r
-  *y = *x;</p>\r
-  <p class=Verbatim>}</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>void sety (int *x, int *y)</p>\r
-  <p class=Verbatim>  /*@modifies *y@*/</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>   setx (y, x);</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td width=60% valign=top style='border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt;height:120.9pt'>\r
-  <p class=lclintrun>&gt; splint modify.c +checks</p>\r
-  <p class=lclintrun>modify.c:4: Undocumented modification of *y: *y = *x</p>\r
-  <p class=lclintrun>modify.c:5: Suspect object listed in modifies of setx</p>\r
-  <p class=lclintrun>               not modified: *x</p>\r
-  <p class=lclintrun>   modify.c:1: Declaration of setx</p>\r
-  <p class=TextFontCX><i><span style='font-size:\r
-  10.0pt'>&nbsp;</span></i></p>\r
-  <p class=TextFontCX style='page-break-after:\r
-  avoid'><i><span style='font-size:10.0pt'>There are n</span></i><i><span\r
-  style='font-size:10.0pt'>o errors for </span></i><span class=CodeText><span\r
-  style='font-size:10.0pt'>sety</span></span><i><span style='font-size:10.0pt'>\r
-  \96 the call to </span></i><span class=CodeText><span style='font-size:10.0pt'>setx</span></span><i><span\r
-  style='font-size:10.0pt'> modifies the value <br>pointed to by its first\r
-  parameter (</span></i><span class=CodeText><span style='font-size:10.0pt'>y</span></span><i><span\r
-  style='font-size:10.0pt'>) as documented by the <br>modifies clause.  The </span></i><span\r
-  class=Flag><span style='font-size:10.0pt'>checks</span></span><i><span style='font-size:10.0pt'> mode turns on </span></i><span class=Flag><span\r
-  style='font-size:10.0pt'>mustmod</span></span><i><span style='font-size:10.0pt'>\r
-  </span></i><i><span style='font-size:10.0pt'>checking,<br> so the second error\r
-  concerning missing documented <br>modifications is reported.</span></i></p>\r
-  </td>\r
- </tr>\r
- <tr height=0>\r
-  <td  style='border:none'></td>\r
-  <td  style='border:none'></td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0 >\r
- <tr>\r
-  <td valign=top style='padding-top:4.3pt;padding-right:\r
-  .3in;padding-bottom:4.3pt;padding-left:.3in'>\r
-  <p class=MsoCaption><a name="_Toc534824616"></a><a name="_Ref534822865">Figure\r
-  12</a>.  Modification</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-<br clear=ALL>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974978">7.1.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>State Modifications</a></h3>\r
-\r
-<p class=beforelist>A few special names are provided for describing function\r
-modifications that effect state not identifiable through parameters or global\r
-variables:</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>internalState</span></span></p>\r
-\r
-<p class=IndentText>The function modifies some internal state (that is, the\r
-value of a <span class=CodeText><span style='font-size:10.0pt'>static</span></span>\r
-variable).  Even though a client cannot access the internal state directly, it\r
-is important to know that something may be modified by the function call both\r
-for clear documentation and for checking undefined order of evaluation (Section 8.2) and side effect free parameters (Section 11.2.1).</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>fileSystem</span></span></p>\r
-\r
-<p class=IndentText>The function modifies the file system.  Any modification\r
-that may change the system state is considered a file system modification.  All\r
-functions that modify an object of type pointer to <span class=CodeText><span\r
-style='font-size:10.0pt'>FILE</span></span> also modify the file system.  In\r
-addition, functions that do not modify a <span class=CodeText><span\r
-style='font-size:10.0pt'>FILE</span></span> pointer but modify some state that\r
-is visible outside this process also modify the file system (e.g., <span\r
-class=CodeText><span style='font-size:10.0pt'>rename</span></span>).   The flag\r
-<span class=Flag><span style='font-size:10.0pt'>mod-file-system</span></span> controls reporting of undocumented file system modifications.</p>\r
-\r
-<p class=MsoListBullet><span class=Annot><span style='font-size:10.0pt'>nothing</span></span></p>\r
-\r
-<p class=IndentText>The function modifies nothing (i.e., it is side effect\r
-free). </p>\r
-\r
-<p class=TextFontCX style='margin-left:.5in'>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The annotation, <span\r
-class=Annot><span style='font-size:10.0pt'>/*@*/</span></span> in a function declaration or definition (after the parameter list, before the\r
-semi-colon or function body) denotes a function that modifies nothing and does\r
-not use any global variables (see Section 7.2).</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974979"></a><a\r
-name="_Ref345591515">7.1.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Missing Modifies Clauses</a></h3>\r
-\r
-<p class=TextFontCX>Splint is designed so\r
-programs with many functions that are declared without modifies clauses can be\r
-checked effectively.  Unless <span class=Flag><span style='font-size:10.0pt'>modnomods</span></span>\r
-is in on, no modification errors are reported checking a function declared with\r
-no modifies clause.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A function with no modifies\r
-clause is an <i>unconstrained</i> function since there are no documented\r
-constraints on what it may modify.  When an unconstrained function is called,\r
-it is checked differently from a function declared with a modifies clause.  To\r
-prevent spurious errors, no modification error is reported at the call site\r
-unless the <span class=Flag><span style='font-size:10.0pt'>mod-uncon</span></span> flag is on.  Flags control whether errors involving unconstrained functions are reported for other checks that depend on modifications (side effect free macro parameters (Section\r
-11.2.1), undefined evaluation order (Section 8.2), and likely infinite loops (Section 8.3.1).)</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Ref534980042"></a><a\r
-name="_Toc534974980"></a><a name="_Ref534972121"></a><a name="_Ref348845219"></a><a\r
-name="_Ref347475720"></a><a name="_Ref347171487"></a><a name="_Ref344908307"></a><a\r
-name="_Ref344893725"></a><a name="_Toc344355404">7.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Global Variables</a></h2>\r
-\r
-<p class=TextFontCX>Another aspect of a\r
-function\92s interface, is the global variables it uses.  A globals list in a function declaration lists external variables that may be used in the\r
-function body.  Splint checks that global variables used in a procedure match\r
-those listed in its globals list. A global is used in a function if it appears\r
-in the body directly, or it is in the globals list of a function called in the\r
-body. Splint reports if a global that is used in a procedure is not listed in\r
-its globals list, and if a listed global is not used in the function\r
-implementation.  Figure 13 shows an example function definition with a globals list and associated checking done by Splint.</p>\r
-<p>\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
- style='margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr style='height:13.25pt'>\r
-  <td  valign=top style='width:202.5pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>globals.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='width:220.5pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt;height:13.25pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr style='height:70.65pt'>\r
-  <td  valign=top style='width:202.5pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>int glob1, glob2;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>&nbsp;</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>3 </span></span><span\r
-  style='font-size:9.5pt'>int f (void) /*@globals glob1;@*/</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>{</span></p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>5  </span></span><span\r
-  style='font-size:9.5pt'>return glob2;</span></p>\r
-  <p class=Verbatim><span style='font-size:9.5pt'>}</span></p>\r
-  </td>\r
-  <td  valign=top style='width:220.5pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt;height:70.65pt'>\r
-  <p class=lclintrun>&gt; splint globals.c +checks</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>globals.c:5: Undocumented use of global glob2</p>\r
-  <p class=lclintrun>globals.c:3: Global glob1 listed but not used</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun style='page-break-after:avoid'>&nbsp;</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top align=left style='padding-top:8.65pt;padding-right:\r
-  9.35pt;padding-bottom:8.65pt;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Ref349498221"></a><a name="_Ref349498215"></a><a\r
-  name="_Ref347468808"></a><a name="_Ref347468791"></a><a name="_Ref344908072"></a><a\r
-  name="_Ref344908069"></a><a name="_Ref344893745"></a><a name="_Toc344355405"></a><a\r
-  name="_Toc534824617"></a><a name="_Ref534822988">Figure 13</a>.  Global\r
-  Variables</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974981">7.2.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Controlling Globals Checking</a></h3>\r
-\r
-<p class=TextFontCX>Whether on not an error is\r
-reported for a use of a global variable in a given function depends on the\r
-scope of the variable (file <span class=CodeText><span style='font-size:10.0pt'>static</span></span>\r
-or external), the checking annotation used in the variable declaration or the\r
-implicit annotation if no checking annotation is used, whether or not the\r
-function is declared with a globals list, and flag settings.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>A global or file static variable declaration may be\r
-preceded by an annotation to indicate how the variable should be checked.  In\r
-order of decreasing checks, the annotations are:</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@checkedstrict@*/</span></span></p>\r
-\r
-<p class=IndentText>Strictest checking.  Undocumented uses and modifications of\r
-the variable are reported in all functions whether or not they have a globals\r
-list (unless <span class=Flag><span style='font-size:10.0pt'>check-strict-globs</span></span>\r
-is off).</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@checked@*/</span></span></p>\r
-\r
-<p class=IndentText>Undocumented use of the variable is reported in a function\r
-with a globals list, but not in a function declared with no globals (unless <span\r
-class=Flag><span style='font-size:10.0pt'>glob-noglobs</span></span> is on).<a name=here></a></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@checkmod@*/</span></span></p>\r
-\r
-<p class=IndentText>Undocumented uses of the variable are not reported, but\r
-undocumented modifications are reported.   (If <span class=Flag><span\r
-style='font-size:10.0pt'>mod-globs-nomods</span></span> is on, errors are\r
-reported even in functions declared with no modifies clause or globals list.)</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@unchecked@*/</span></span></p>\r
-\r
-<p class=IndentText>No messages are reported for undocumented use or\r
-modification of this global variable.</p>\r
-\r
-<p class=afterlist>If a variable has none of these annotations, an implicit\r
-annotation is determined by the flag settings.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Different flags control the\r
-implicit annotation for variables declared with global scope and variables\r
-declared with file scope (i.e., using the <span class=CodeText><span\r
-style='font-size:10.0pt'>static</span></span> storage qualifier). To set the\r
-implicit annotation for global variables declared in <span class=Flag><i><span\r
-style='font-size:10.0pt'>context</span></i></span> (<span class=Flag><span\r
-style='font-size:10.0pt'>globs</span></span> for external variables or <span\r
-class=Flag><span style='font-size:10.0pt'>statics</span></span> for file static\r
-variable) to be <span class=Flag><i><span style='font-size:10.0pt'>annotation</span></i></span>\r
-(<span class=Flag><span style='font-size:10.0pt'>checked</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>checkmod</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>checkedstrict</span></span>) use <span\r
-class=Flag><span style='font-size:10.0pt'>imp<i>&lt;annotation&gt;\r
-&lt;context&gt;</i></span></span>.  For example, <span class=Flag><span\r
-style='font-size:10.0pt'>+imp-checked-strict-statics</span></span> makes the implicit checking on unqualified file static variables <span class=Flag><span\r
-style='font-size:10.0pt'>checkedstrict</span></span>.  See Appendix B for a complete list of globals checking flags. </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974982"></a><a\r
-name="_Ref534971010">7.2.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></a>Definition State</h3>\r
-\r
-<p class=TextFontCX>Annotations can be used in\r
-the globals list of a function declaration to describe the states of global\r
-variables before and after the call.  If a global is preceded by <span\r
-class=Annot><span style='font-size:10.0pt'>undef</span></span>, it is assumed to be undefined before the call. Thus, no error is reported if the\r
-global is not defined when the function is called, but an error is reported if\r
-the global is used in the function body before it is defined.  The <span\r
-class=Annot><span style='font-size:10.0pt'>killed</span></span> annotation\r
-denotes a global variable that may be undefined when the call returns.  For\r
-globals that contain dynamically allocated storage, a <span class=Annot><span\r
-style='font-size:10.0pt'>killed</span></span> global variable is similar to an <span\r
-class=Annot><span style='font-size:10.0pt'>only</span></span> parameter (Section 5.2).  An error is reported if it contains the only reference to\r
-storage that is not released before the call returns.  Figure 14 illustrated <span\r
-class=Annot><span style='font-size:10.0pt'>killed</span></span> and <span\r
-class=Annot><span style='font-size:10.0pt'>undef</span></span> globals.</p>\r
-\r
-<p>\r
-<center>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
-  style='margin-left:.9pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'>            <span class=Keyword><b><span\r
-  style='font-size:10.0pt;color:white'>annotglobs.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='width:198.8pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>\r
-  <p class=Verbatim>int globnum;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>struct {</p>\r
-  <p class=Verbatim>  char *firstname, *lastname;</p>\r
-  <p class=Verbatim>  int id;</p>\r
-  <p class=Verbatim>} globname;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>void </p>\r
-  <p class=Verbatim>initialize (/*@only@*/ char *name)</p>\r
-  <p class=Verbatim>  /*@globals undef globnum,</p>\r
-  <p class=Verbatim>             undef globname @*/</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>13 </span></span>globname.id\r
-  = globnum;</p>\r
-  <p class=Verbatim>  globname.lastname = name;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>15</span></span>}</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>void finalize (void)</p>\r
-  <p class=Verbatim>  /*@globals killed globname@*/</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  free (globname.lastname);</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>21 </span></span>}</p>\r
-  </td>\r
-  <td  valign=top style='width:198.8pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt;height:236.7pt'>\r
-  <p class=lclintrun>&gt; splint annotglobs.c</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>annotglobs.c:13: Undef global globnum used</p>\r
-  <p class=lclintrun>                    before definition</p>\r
-  <p class=lclintrun>annotglobs.c:15: Global storage globname</p>\r
-  <p class=lclintrun>    contains 1 undefined field when call</p>\r
-  <p class=lclintrun>    returns: firstname</p>\r
-  <p class=lclintrun>annotglobs.c:21: Only storage</p>\r
-  <p class=lclintrun>    globname.firstname (type char *) derived</p>\r
-  <p class=lclintrun>    from killed global is not released</p>\r
-  <p class=lclintrun style='page-break-after:avoid'>    (memory leak)</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top align=left style='padding-top:10.1pt;padding-right:\r
-  9.35pt;padding-bottom:10.1pt;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824618"></a><a name="_Ref534823055">Figure\r
-  14</a>.  Annotated Globals Lists</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974983"></a><a\r
-name="_Ref344894947"></a><a name="_Toc344355406">7.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Declaration Consistency</a></h2>\r
-\r
-<p class=TextFontCX>Splint checks that function declarations and definitions are consistent.  The general rule is that the <i>first</i> declaration of a function implies all later declarations and\r
-definitions.  If a function is declared in a header file, the first declaration\r
-processed is its first declaration (if it is declared in more than one header\r
-file an error is reported if <span class=Flag><span style='font-size:10.0pt'>redecl</span></span> is set)<span\r
-style='display:none'> (if the same function is declared in more than one header\r
-file ???)</span>.  Otherwise, the first declaration in the file defining the\r
-function is its first declaration.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Later declarations may not\r
-include variables in the globals list that were not included in the first\r
-declaration.  The exception to this is when the first declaration is in a\r
-header file and the later declaration or definition includes file static\r
-variables.  Since these are not visible in the header file, they can not be\r
-included in the header file declaration.  Similarly, the modifies clause of a\r
-later declaration may not include objects that are not modifiable in the first\r
-declaration.  The later declaration may be more specific.  For example, if the\r
-header declaration is:</p>\r
-\r
-<p class=example style='text-indent:.3in'>extern void setName (employee e, char\r
-*s) /*@modifies e@*/;</p>\r
-\r
-<p class=TextFontCX>the later declaration could\r
-be,</p>\r
-\r
-<p class=example>   void setName (employee e, char *) /*@modifies e-&gt;name@*/;</p>\r
-\r
-<p class=TextFontCX>If <span class=CodeText><span\r
-style='font-size:10.0pt'>employee</span></span> is an abstract type, the declaration in the header should not refer to a particular implementation\r
-(i.e., it shouldn\92t rely on there being a <span class=CodeText><span\r
-style='font-size:10.0pt'>name</span></span> field), but the implementation\r
-declaration can be more specific.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>This rule also applies to\r
-file static variables.  The header declaration for a function that modifies a\r
-file static variable should use <span class=Annot><span style='font-size:10.0pt'>modifies\r
-internalState</span></span> since file static variables are not visible to\r
-clients.  The implementation declaration should list the actual file static\r
-variables that may be modified.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974984"></a><a\r
-name="_Ref354411787">7.4<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>State Clauses</a></h2>\r
-\r
-<p class=TextFontCX>Sometimes it is necessary to\r
-specify function interfaces at a lower level than is possible with the standard\r
-annotations.  For example, if a function defines some fields of a returned\r
-structure but does not define all the fields.  The <span class=Annot><span\r
-style='font-size:10.0pt'>/*@special@*/</span></span> annotation is used to mark\r
-a parameter, global variable, or return value that is described using state\r
-clauses.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>State clauses may be used to\r
-constrain the state of a parameter or return value before or after a call.  One\r
-or more state clauses may appear in a function declaration, before the modifies\r
-or globals clauses.  State clauses may be listed in any order, but the same\r
-state clause should not be used more than once.  In a state clause list, <span\r
-class=CodeText><span style='font-size:10.0pt'>result</span></span> is used to\r
-refer to the return value of the function.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX style='margin-bottom:6.0pt'>The\r
-following state clauses are used to describe the definition state or parameters\r
-before and after the function is called and the return value after the function\r
-returns:</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@uses <i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=indentbefore0>References in a <span\r
-class=Annot><span style='font-size:10.0pt'>uses</span></span> clause must be\r
-completely defined before the function is called.  They are assumed to be\r
-defined at function entrance when the function is checked.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@sets <i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=indentbefore0>References in a <span\r
-class=Annot><span style='font-size:10.0pt'>sets</span></span> clause must be\r
-allocated before the function is called.  They are completely defined after the\r
-function returns. They are assumed to be allocated but undefined storage at\r
-function entrance and an error is reported if there is a path on which they are\r
-not defined before the function returns.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@defines <i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=indentbefore0>References in a <span\r
-class=Annot><span style='font-size:10.0pt'>defines</span></span> clause must\r
-not refer to unshared, allocated storage before the function is called.  They\r
-are completely defined after the function returns. When the function is\r
-checked, they are assumed to be undefined at function entrance and an error is\r
-reported if there is a path on which they are not defined before the function\r
-returns.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@allocates <i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=indentbefore0>References in an <span\r
-class=Annot><span style='font-size:10.0pt'>allocates</span></span> clause must\r
-be unallocated before the function is called.  They are allocated but not necessarily\r
-defined after the function returns. An error is reported if there is a path\r
-through the function on which they are not allocated before the function\r
-returns.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@releases &lt;references&gt;@*/</span></span></p>\r
-\r
-<p class=IndentText>References in the <span\r
-class=Annot><span style='font-size:10.0pt'>releases</span></span> clause are\r
-deallocated by the function.  They must be storage that could be passed as an <span\r
-class=Annot><span style='font-size:10.0pt'>only</span></span> parameter before the function is called, and are dead pointers after the function returns.  They are assumed to be defined at function entrance and an error is reported if they\r
-refer to live, allocated storage at any return point.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Some examples of state\r
-clauses are shown in Figure 15. The <span class=Annot><span style='font-size:\r
-10.0pt'>defines</span></span> clause for <span class=CodeText><span\r
-style='font-size:10.0pt'>record_new</span></span> indicates that the <span\r
-class=CodeText><span style='font-size:10.0pt'>id</span></span> field of the\r
-structure pointed to by the result is defined, but the <span class=CodeText><span\r
-style='font-size:10.0pt'>name</span></span> field is not.  So, <span\r
-class=CodeText><span style='font-size:10.0pt'>record_create</span></span> needs\r
-to call <span class=CodeText><span style='font-size:10.0pt'>record_setName</span></span>\r
-to define the name field.  Similarly, the <span class=Annot><span\r
-style='font-size:10.0pt'>releases</span></span> clause for <span\r
-class=CodeText><span style='font-size:10.0pt'>record_clearName</span></span>\r
-indicates that no storage is associated with the <span class=CodeText><span\r
-style='font-size:10.0pt'>name</span></span> field of its parameter after the\r
-return, so no failure to deallocate storage message is produced for the call to\r
-<span class=CodeText><span style='font-size:10.0pt'>free</span></span> in <span\r
-class=CodeText><span style='font-size:10.0pt'>record_free</span></span>.  The <span\r
-class=Annot><span style='font-size:10.0pt'>ensures isnull</span></span> clause\r
-is described in the next section.</p>\r
-\r
-<p>\r
-<center>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
- style='margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='width:423.0pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>clauses.c</span></b></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:423.0pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim>typedef struct</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  int id;</p>\r
-  <p class=Verbatim>  /*@only@*/ char *name;</p>\r
-  <p class=Verbatim>} *record;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>static /*@special@*/ record record_new (void)</p>\r
-  <p class=Verbatim>  /*@defines result-&gt;id@*/</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  record r = (record) malloc (sizeof (*r));</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>  assert (r != NULL);</p>\r
-  <p class=Verbatim>  r-&gt;id = 3;</p>\r
-  <p class=Verbatim>  return r;</p>\r
-  <p class=Verbatim>}</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>static void </p>\r
-  <p class=Verbatim>   record_setName (/*@special@*/ record r, /*@only@*/ char\r
-  *name)</p>\r
-  <p class=Verbatim>   /*@defines r-&gt;name@*/</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  r-&gt;name = name;</p>\r
-  <p class=Verbatim>}</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>record record_create (/*@only@*/ char *name)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  record r = record_new ();</p>\r
-  <p class=Verbatim>  record_setName (r, name);</p>\r
-  <p class=Verbatim>  return r;</p>\r
-  <p class=Verbatim>}</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>void record_clearName (/*@special@*/ record r)</p>\r
-  <p class=Verbatim>   /*@releases r-&gt;name@*/</p>\r
-  <p class=Verbatim>   /*@ensures isnull r-&gt;name@*/</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  free (r-&gt;name);</p>\r
-  <p class=Verbatim>  r-&gt;name = NULL;</p>\r
-  <p class=Verbatim>}</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>void record_free (/*@only@*/ record r)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  record_clearName (r);</p>\r
-  <p class=Verbatim>  free (r);</p>\r
-  <p class=Verbatim>}</p>\r
-  <p class=Verbatim style='page-break-after:avoid'>&nbsp;</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824619"></a><a name="_Ref354412972">Figure\r
-  15</a>.  State Clauses</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<p class=TextFontCX><span class=Keyword><span\r
-style='font-size:10.0pt'>&nbsp;</span></span></p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974985"></a><a\r
-name="_Ref534888798">7.5<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Requires and Ensures Clauses</a></h2>\r
-\r
-<p class=TextFontCX>More general assumptions\r
-about state of parameters and globals before and after a function is called can\r
-be described using <span class=Annot><i><span style='font-size:10.0pt'>requires</span></i></span>\r
-and <span class=Annot><i><span style='font-size:10.0pt'>ensures</span></i></span>\r
-clauses.  A <span class=Annot><span style='font-size:10.0pt'>requires</span></span>\r
-clause specifies a predicate that must be true at a call site; when checking a\r
-function implementation Splint assumes the constraints given in its <span\r
-class=Annot><span style='font-size:10.0pt'>requires</span></span> clauses are\r
-true at function entry.  An <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-clause specifies a predicate that is true at a call site after the call\r
-returns; when checking a function implementation Splint warns if there is an\r
-execution path that does not return with a state that stratifies the\r
-constraints given in its <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-clauses.  A function declaration can have many <span class=Annot><span\r
-style='font-size:10.0pt'>requires</span></span> and <span class=Annot><span\r
-style='font-size:10.0pt'>ensures</span></span> clauses as long as their\r
-meanings are not contradictory.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The following constraints can\r
-be stated using <span class=Annot><span style='font-size:10.0pt'>requires</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-clauses:</p>\r
-\r
-<h6 style='margin-left:0in;text-indent:0in'><b>Aliasing Annotations</b></h6>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@requires only<i>&lt;references&gt;</i>@*/</span></span>;\r
-<span class=Annot><span style='font-size:10.0pt'>/*@ensures only<i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@requires shared<i>&lt;references&gt;</i>@*/</span></span>;\r
-<span class=Annot><span style='font-size:10.0pt'>/*@ensures shared<i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@requires owned<i>&lt;references&gt;</i>@*/</span></span>;\r
-<span class=Annot><span style='font-size:10.0pt'>/*@ensures owned<i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@requires dependent<i>&lt;references&gt;</i>@*/</span></span>;\r
-<span class=Annot><span style='font-size:10.0pt'>/*@ensures dependent<i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=IndentText>References refer to <span\r
-class=Annot><span style='font-size:10.0pt'>only</span></span>, <span\r
-class=Annot><span style='font-size:10.0pt'>shared</span></span>, <span\r
-class=Annot><span style='font-size:10.0pt'>owned</span></span> or <span\r
-class=Annot><span style='font-size:10.0pt'>dependent</span></span> storage\r
-before (<span class=Annot><span style='font-size:10.0pt'>requires</span></span>)\r
-or after (<span class=Annot><span style='font-size:10.0pt'>ensures</span></span>)\r
-the call.</p>\r
-\r
-<h6 style='margin-left:0in;text-indent:0in'><b>Exposure Annotations</b></h6>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@requires observer<i>&lt;references&gt;</i>@*/</span></span>;\r
-<span class=Annot><span style='font-size:10.0pt'>/*@ensures observer<i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@requires exposed<i>&lt;references&gt;</i>@*/</span></span>;\r
-<span class=Annot><span style='font-size:10.0pt'> /*@ensures exposed <i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=IndentText>References refer to <span class=Annot><span\r
-style='font-size:10.0pt'>observer</span></span> or <span class=Annot><span\r
-style='font-size:10.0pt'>exposed</span></span> storage before (<span\r
-class=Annot><span style='font-size:10.0pt'>requires</span></span>) or after (<span\r
-class=Annot><span style='font-size:10.0pt'>ensures</span></span>) the call.</p>\r
-\r
-<h6 style='margin-left:0in;text-indent:0in'><b>Null</b><b> </b><b>State</b><b>\r
-Annotations</b></h6>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@requires isnull<i>&lt;references&gt;</i>@*/</span></span>;\r
-<span class=Annot><span style='font-size:10.0pt'>/*@ensures isnull<i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=IndentText>References have the value <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span> before (<span class=Annot><span\r
-style='font-size:10.0pt'>requires</span></span>) or after (<span class=Annot><span\r
-style='font-size:10.0pt'>ensures</span></span>) the call.  Note, this is not\r
-the same name or meaning as the <span class=Annot><span style='font-size:10.0pt'>null</span></span>\r
-annotation (which means the value may or may not be <span class=Annot><span\r
-style='font-size:10.0pt'>NULL</span></span>.)</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@requires notnull<i>&lt;references&gt;</i>@*/</span></span>;\r
-<span class=Annot><span style='font-size:10.0pt'>/*@ensures notnull<i>&lt;references&gt;</i>@*/</span></span></p>\r
-\r
-<p class=IndentText>References do not have the value <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span> before (<span class=Annot><span\r
-style='font-size:10.0pt'>requires</span></span>) or after (<span class=Annot><span\r
-style='font-size:10.0pt'>ensures</span></span>) the call.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534974986"></a><a\r
-name="_Ref534642886"></a><a name="_Ref483663682">8<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Control Flow</a></h1>\r
-\r
-<p class=TextFontCX>The section describes\r
-checking done by Splint related to control flow.  Many of these checks are\r
-significantly improved because of the extra information that is known about the\r
-program when annotations are provided.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974987"></a><a\r
-name="_Ref345859337"></a><a name="_Ref344907653"></a><a name="_Ref344894343"></a><a\r
-name="_Ref344873752"></a><a name="_Toc344355417">8.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Execution</a></h2>\r
-\r
-<p class=TextFontCX>To detect certain errors and\r
-avoid spurious errors, it is important to know something about the control flow\r
-behavior of called functions. Without additional information, Splint assumes\r
-that all functions eventually return and execution continues normally at the\r
-call site.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>noreturn</span></span> annotation is used to denote a function that never returns<a href="#_ftn8" name="_ftnref8" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:11.0pt;font-family:"Times New Roman"'>[8]</span></span></span></a>. \r
-For example,</p>\r
-\r
-<p class=example><span class=Annot><span style='font-size:10.0pt'>extern\r
-/*@noreturn@*/ void fatalerror (/*@observer@*/ char *s);</span></span></p>\r
-\r
-<p class=beforelist>declares <span class=CodeText><span style='font-size:10.0pt'>fatalerror</span></span>\r
-to never return.  This enables Splint to correctly analyze code like,</p>\r
-\r
-<p class=TextFontCX><span class=Keyword><span\r
-style='font-size:10.0pt'>   if (x == NULL) fatalerror (&quot;Yikes!&quot;);</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Keyword><span\r
-style='font-size:10.0pt'>   *x = 3;</span></span></p>\r
-\r
-<p class=afterlist>Other functions may return, but sometimes (or usually)\r
-return normally.  The <span class=Annot><span style='font-size:10.0pt'>maynotreturn</span></span>\r
-annotation denotes a function that may or may not return.  This may be useful\r
-for documentation, but does not help checking much, since Splint must assume\r
-that a function declared with <span class=Annot><span style='font-size:10.0pt'>maynotreturn</span></span>\r
-returns normally when checking the code.  The <span class=Annot><span\r
-style='font-size:10.0pt'>alwaysreturns</span></span> annotation denotes a\r
-function that always returns (but Splint does no checking to verify this).</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>To describe non-returning\r
-functions more precisely, the <span class=Annot><span style='font-size:10.0pt'>noreturnwhentrue</span></span> and <span class=Annot><span style='font-size:10.0pt'>noreturnwhenfalse</span></span> annotations may be used.  Similar to <span class=Annot><span style='font-size:\r
-10.0pt'>nullwhentrue</span></span> and <span class=Annot><span\r
-style='font-size:10.0pt'>falsewhennull</span></span> (see Section 2.1.1), <span\r
-class=Annot><span style='font-size:10.0pt'>noreturnwhentrue</span></span> and <span class=Annot><span style='font-size:10.0pt'>noreturnwhenfalse </span></span>mean\r
-that a function never returns if the value of its first argument is true (<span\r
-class=Annot><span style='font-size:10.0pt'>noreturnwhentrue</span></span>) or\r
-false (<span class=Annot><span style='font-size:10.0pt'>noreturnwhenfalse</span></span>). \r
-They may be used only on functions whose first argument is a Boolean.   </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX style='margin-bottom:6.0pt'>Hence,\r
-a function declared with <span class=Annot><span style='font-size:10.0pt'>noreturnwhenwfalse</span></span>\r
-must not return if the value of its argument is false.  For example, the\r
-standard library declares <span class=Keyword><span style='font-size:10.0pt'>assert</span></span> as<a\r
-href="#_ftn9" name="_ftnref9" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>:</p>\r
-\r
-<p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;\r
-margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>/*@noreturnwhenfalse@*/\r
-void </p>\r
-\r
-<p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;\r
-margin-left:0in;margin-bottom:.0001pt;text-indent:.5in'>assert (/*@sef@*/ bool\r
-/*@alt int@*/ pred);</p>\r
-\r
-<p class=beforelist style='margin-top:6.0pt'>This way, code like,</p>\r
-\r
-<p class=Verbatim>   assert (x != NULL);</p>\r
-\r
-<p class=Verbatim>   *x = 3;</p>\r
-\r
-<p class=TextFontCX>is checked without reporting\r
-a false warning, since the <span class=Annot><span style='font-size:10.0pt'>noreturnwhenwfalse\r
-</span></span>annotation on <span class=CodeText><span style='font-size:10.0pt'>assert</span></span>\r
-means the deference of <span class=CodeText><span style='font-size:10.0pt'>x</span></span>\r
-is not reached is <span class=CodeText><span style='font-size:10.0pt'>x != NULL</span></span>\r
-is false.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974988"></a><a\r
-name="_Ref350066608">8.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Undefined </a>Behavior</h2>\r
-\r
-<p class=TextFontCX>The order in which side\r
-effects take place in a C program is not entirely defined by the code.  Certain\r
-execution points are known as <i>sequence points</i> \97 a function call (after the arguments have been evaluated), the end of a full expression (an initializer, expression in an expression statement, the control\r
-expression of an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>switch</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>while</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>do</span></span> statement, each\r
-expression of a <span class=CodeText><span style='font-size:10.0pt'>for</span></span>\r
-statement, and the expression in a <span class=CodeText><span style='font-size:\r
-10.0pt'>return</span></span> statement), and after the first operand or a <span\r
-class=CodeText><span style='font-size:10.0pt'>&amp;&amp;</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>||</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>?</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>,</span></span> operand.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>All side effects before a\r
-sequence point must be complete before the sequence point, and no evaluations\r
-after the sequence point shall have taken place.  Between sequence points, side\r
-effects and evaluations may take place in any order.  Hence, the order in which\r
-expressions or arguments are evaluated is not specified.  Compilers are free to\r
-evaluate function arguments and parts of expressions (that do not contain\r
-sequence points) in any order.  The behavior of code is undefined if it uses a\r
-value that is modified by another expression that is not required to be\r
-evaluated before or after the other use.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint detects instances\r
-where undetermined order of evaluation produces undefined behavior.  If modifies clauses and globals lists are used, this checking is enabled in expressions\r
-involving function calls. Evaluation order checking is controlled by the <span\r
-class=Flag><span style='font-size:10.0pt'>eval-order</span></span> flag.</p>\r
-\r
-<p>\r
-<center>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
- style='margin-left:13.05pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'>            <span class=Keyword><b><span\r
-  style='font-size:10.0pt;color:white'>order.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='width:198.8pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt;height:13.45pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
-\r
-\r
- <tr>\r
-  <td  valign=top style='width:148.95pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim>extern int glob;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>extern int mystery (void);</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>extern int modglob (void)</p>\r
-  <p class=Verbatim>   /*@globals glob@*/</p>\r
-  <p class=Verbatim>   /*@modifies glob@*/;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>int f (int x, int y[])</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>11</span></span>\r
-  int i = x++ * x;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>13</span></span>\r
-  y[i] = i++;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>14</span></span>\r
-  i += modglob() * glob;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>15</span></span>\r
-  i += mystery() * glob;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>16</span></span>\r
-  return i;</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td  valign=top style='width:275.4pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint order.c +evalorderuncon </p>\r
-  <p class=lclintrun>order.c:11: Expression has undefined behavior (value of</p>\r
-  <p class=lclintrun>    right operand modified by left operand): x++ * x</p>\r
-  <p class=lclintrun>order.c:13: Expression has undefined behavior (left\r
-  operand</p>\r
-  <p class=lclintrun>    uses i, modified by right operand): y[i] = i++</p>\r
-  <p class=lclintrun>order.c:14: Expression has undefined behavior (value of</p>\r
-  <p class=lclintrun>    right operand modified by left operand):</p>\r
-  <p class=lclintrun>    modglob() * glob</p>\r
-  <p class=lclintrun>order.c:15: Expression has undefined behavior</p>\r
-  <p class=lclintrun>    (unconstrained function mystery used in left operand</p>\r
-  <p class=lclintrun>    may set global variable glob used in right operand):</p>\r
-  <p class=lclintrun>    mystery() * glob</p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'><i>&nbsp;</i></p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left;page-break-after:avoid'><i>The warning for line 14 is\r
-  reported because the modifies clause of </i><span class=CodeText><span\r
-  style='font-size:10.0pt'>modglob</span></span><i> indicated that it may\r
-  modify </i><span class=CodeText><span style='font-size:10.0pt'>glob</span></span><i>. \r
-  The behavior is undefined since we don\92t  know if </i><span class=CodeText><span\r
-  style='font-size:10.0pt'>glob</span></span><i> is evaluated before, after or\r
-  during the</i><i> modification.  The line 15 warning would not be reported\r
-  without </i><span class=Flag><span style='font-size:10.0pt'>+evalorderuncon</span></span><i>.</i></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824620"></a><a name="_Ref534823183">Figure\r
-  16</a>.  Evaluation Order</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>When checking systems without\r
-modifies and globals information (see Section 7), evaluation order checking may report errors when unconstrained functions are called in procedure arguments.  Since Splint has no annotations to constrain what these functions may modify, it cannot be guaranteed that\r
-the evaluation order is defined if another argument calls an unconstrained\r
-function or uses a global variable or storage reachable from a parameter to the\r
-unconstrained function.  Its best to add modifies and globals clauses to\r
-constrain the unconstrained functions in ways that eliminate the possibility of\r
-undefined behavior.  For large legacy systems, this may require too much\r
-effort.  Instead, the <span class=Flag><span style='font-size:10.0pt'>&#8209;eval-order-uncon</span></span>\r
-flag may be used to prevent reporting of undefined behavior due to the order of\r
-evaluation of unconstrained functions.  Figure 16 illustrates detection of undefined behavior.</p>\r
-<p>\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
- style='margin-left:18.9pt;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>loop.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr style='height:143.1pt'>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>\r
-  <p class=Verbatim>extern int glob1, glob2;</p>\r
-  <p class=Verbatim>extern int f (void)</p>\r
-  <p class=Verbatim>  /*@globals glob1@*/</p>\r
-  <p class=Verbatim>  /*@modifies nothing@*/;</p>\r
-  <p class=Verbatim>extern void g (void)</p>\r
-  <p class=Verbatim>  /*@modifies glob2@*/ ;</p>\r
-  <p class=Verbatim>extern void h (void) ;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>void upto (int x)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>14</span></span> \r
-  while (x &gt; f ()) g();</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>15</span></span> \r
-  while (f () &lt; 3) h();</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td  valign=top style='border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt;height:143.1pt'>\r
-  <p class=lclintrun>&gt; splint loop.c +infloopsuncon </p>\r
-  <p class=lclintrun>loop.c:14: Suspected infinite loop.  No value used in</p>\r
-  <p class=lclintrun>    loop test (x, glob1) is modified by test or loop</p>\r
-  <p class=lclintrun>    body.</p>\r
-  <p class=lclintrun>loop.c:15: Suspected infinite loop.  No condition</p>\r
-  <p class=lclintrun>    values modified.  Modification possible through</p>\r
-  <p class=lclintrun>    unconstrained calls: h </p>\r
-  <p class=TextFontCX style='page-break-after:\r
-  avoid'><i>An error is reported for line 14 since the only value modified by\r
-  <br>the loop test or body if </i><span class=CodeText><span style='font-size:\r
-  10.0pt'>glob2</span></span><i> and the value of the loop test <br>does not depend\r
-  on </i><span class=CodeText><span style='font-size:10.0pt'>glob2</span></span><i>. \r
-  The error for line 15 would not be<br> reported without </i><span class=Flag><span\r
-  style='font-size:10.0pt'>+infloopsuncon</span></span><i>.</i></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824621"></a><a name="_Ref534823256">Figure\r
-  17</a>.  Infinite Loops</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</center>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974989"></a><a\r
-name="_Ref344892701"></a><a name="_Toc344355430">8.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-\r
-\r
-</span>Problematic Control Structures</a></h2>\r
-\r
-<p class=TextFontCX>A number of control structures that are syntactically legal may indicate likely bugs in programs. \r
-Splint can detect errors involving likely infinite loops (Section 8.3.1), fall through cases and missing cases in <span class=CodeText><span\r
-style='font-size:10.0pt'>switch</span></span> statements (Section 8.3.2), <span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-statements within deeply nested loops or switches (Section 8.3.3), clauses of <span\r
-class=CodeText><span style='font-size:10.0pt'>if</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>while</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>for</span></span> statements that\r
-are empty statements or unblocked single statements (Section 8.3.4) and\r
-incomplete if-else logic (Section 8.3.5).  Although any of these may appear in\r
-a correct program, depending on the programming style used they may indicate\r
-likely bugs or style violations that should be detected and eliminated.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974990"></a><a\r
-name="_Ref344810086">8.3.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Likely Infinite Loops</a></h3>\r
-\r
-<p class=TextFontCX>Splint reports an error if it\r
-detects a loop that appears to be infinite.  An error is reported for a loop\r
-that does not modify any value used in its condition test inside the body of\r
-the loop or in the condition test itself.  This checking is enhanced by\r
-modifies clauses and globals lists (see Section 7) since they <a\r
-name="_Ref344818734">provide more information about what global variable may be\r
-used in the condition test and what values may be modified by function calls in\r
-the loop body.</a></p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Figure 17 shows examples of infinite loops detected by Splint. An error is reported for the loop in line 14, since neither of the values used in the loop condition (<span class=CodeText><span style='font-size:10.0pt'>x</span></span>\r
-directly and <span class=CodeText><span style='font-size:10.0pt'>glob1</span></span>\r
-through the call to <span class=CodeText><span style='font-size:10.0pt'>f</span></span>)\r
-is modified by the body of the loop.  If the declaration of <span\r
-class=CodeText><span style='font-size:10.0pt'>g</span></span> is changed to\r
-include <span class=CodeText><span style='font-size:10.0pt'>glob1</span></span>\r
-in the modifies clause no error is reported.  (In this example, if we assume\r
-the annotations are correct, then the programmer has probably called the wrong\r
-function in the loop body.  This isn\92t surprising, given the horrible choices\r
-of function and variable names!)</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>If an unconstrained function\r
-is called within the loop body, Splint will assume that it modifies a value\r
-used in the condition test and not report an infinite loop error, unless <span\r
-class=Flag><span style='font-size:10.0pt'>infloopsuncon</span></span> is on.  If <span class=Flag><span style='font-size:10.0pt'>infloopsuncon</span></span>\r
-is on, Splint will report infinite loop errors for loops where there is no\r
-explicit modification of a value used in the condition test, but where they may\r
-be an undetected modification through a call to an unconstrained function\r
-(e.g., line 12 in Figure 17). </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=center\r
-style='text-align:center'><span style='font-size:10.0pt'>&nbsp;</span></p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974991"></a><a\r
-name="_Ref349899747"></a><a name="_Ref345591205">8.3.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Switches</a></h3>\r
-\r
-<p class=TextFontCX>The automatic fall through of\r
-C switch statements is almost never the intended behavior.<a\r
-href="#_ftn10" name="_ftnref10" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a> \r
-Splint detects <span class=CodeText><span style='font-size:10.0pt'>case</span></span>\r
-statements with code that may fall through to the next <span class=CodeText><span\r
-style='font-size:10.0pt'>case</span></span>.  The <span class=Flag><span\r
-style='font-size:10.0pt'>casebreak</span></span> flag controls reporting of fall through cases.  A single fall through case may be\r
-marked by preceding the <span class=CodeText><span style='font-size:10.0pt'>case</span></span>\r
-keyword with <span class=Annot><span style='font-size:10.0pt'>/*@fallthrough@*/</span></span> to indicate explicitly that execution falls through to this case.  See Figure 18 for an example.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>For switches on <span\r
-class=CodeText><span style='font-size:10.0pt'>enum</span></span> types, Splint\r
-reports an error if a member of the enumerator does not appear as a case in the\r
-switch body (and there is no <span class=CodeText><span style='font-size:10.0pt'>default</span></span>\r
-case).  (Controlled by <span class=Flag><span style='font-size:10.0pt'>misscase</span></span>.)</p>\r
-\r
-<p>\r
-<center>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
- style='margin-left:.2in;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='width:3.0in;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>switch.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim>typedef enum {</p>\r
-  <p class=Verbatim>  YES, NO, DEFINITELY,</p>\r
-  <p class=Verbatim>  PROBABLY, MAYBE } ynm;</p>\r
-  <p class=Verbatim>void decide (ynm y)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  switch (y)</p>\r
-  <p class=Verbatim>    {</p>\r
-  <p class=Verbatim>    case PROBABLY:</p>\r
-  <p class=Verbatim>    case NO: printf (&quot;No!&quot;);</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10 </span></span>  case\r
-  MAYBE: printf (&quot;Maybe&quot;);</p>\r
-  <p class=Verbatim>         /*@fallthrough@*/</p>\r
-  <p class=Verbatim>    case YES: printf (&quot;Yes!&quot;);</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>13 </span></span>  }</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td  valign=top style='border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint switch.c</p>\r
-  <p class=lclintrun>switch.c:10: Fall through case (no preceding break)</p>\r
-  <p class=lclintrun>switch.c:13: Missing case in switch: DEFINITELY</p>\r
-  <p class=TextFontCX>&nbsp;</p>\r
-  <p class=MsoCaption align=left style='text-align:left'><i><span\r
-  style='font-weight:normal'>No fall through error is reported for the </span></i><span\r
-  class=CodeText><span style='font-weight:normal'>NO</span></span><i><span\r
-  style='font-weight:normal'> case,<br> since there are no statements associated\r
-  with the<br> previous case.  </span></i></p>\r
-  <p class=TextFontCX style='page-break-after:\r
-  avoid'><i>The </i><span class=Annot><span style='font-size:10.0pt'>/*@fallthrough@*/</span></span><i>\r
-  comment prevents <br>a message from being produced for the<br> </i><span class=Annot><span\r
-  style='font-size:10.0pt'>YES</span></span><i> case.</i></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.0pt;padding-bottom:0in;padding-left:9.0pt'>\r
-  <p class=MsoCaption><a name="_Toc344355431"></a><a name="_Ref344881581"></a><a\r
-  name="_Toc534824622"></a><a name="_Ref534823308">Figure 18</a>.  Switch Cases</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974992"></a><a\r
-name="_Ref534971227">8.3.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Deep Breaks</a></h3>\r
-\r
-<p class=TextFontCX>There is no syntax provided\r
-by C (other than <span class=CodeText><span style='font-size:10.0pt'>goto</span></span>)\r
-for breaking out of a nested loop.  All <span class=CodeText><span\r
-style='font-size:10.0pt'>break</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>continue</span></span> statements act only on the\r
-innermost surrounding loop or switch.  This can lead to serious problems<a\r
-href="#_ftn11" name="_ftnref11" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>\r
-when a programmer intends to break the outer loop or switch instead.  Splint\r
-optionally reports warnings for <span class=CodeText><span style='font-size:\r
-10.0pt'>break</span></span> and <span class=CodeText><span style='font-size:\r
-10.0pt'>continue</span></span> statements in nested contexts.</p>\r
-\r
-<p class=beforelist>&nbsp;</p>\r
-\r
-<p class=beforelist>Four types of <span class=CodeText><span style='font-size:\r
-10.0pt'>break</span></span> warnings are reported:</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> inside a loop\r
-(<span class=CodeText><span style='font-size:10.0pt'>while</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>for</span></span>) that is inside\r
-a loop.  Controlled by <span class=Flag><span style='font-size:10.0pt'>looploopbreak</span></span>.  To indicate that a <span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> is inside an\r
-inner loop, precede the <span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-by <a href="mailto:/*@innerbreak@*/"><span class=Annot><span style='font-size:\r
-10.0pt'>/*@innerbreak@*/</span></span></a>.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> inside a loop\r
-that is inside a <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>\r
-statement.  Controlled by <span class=Flag><span style='font-size:10.0pt'>switchloopbreak</span></span>.  To mark the <span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> as a loop\r
-break, precede the <span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-by <span class=Annot><span style='font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> inside a <span\r
-class=CodeText><span style='font-size:10.0pt'>switch</span></span> statement that\r
-is inside a loop.  Controlled by <span class=Flag><span style='font-size:10.0pt'>loopswitchbreak</span></span>.  To mark the <span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> as a switch\r
-break, precede the <span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-by <span class=Annot><span style='font-size:10.0pt'>/*@switchbreak@*/</span></span>.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> inside a <span\r
-class=CodeText><span style='font-size:10.0pt'>switch</span></span> inside\r
-another <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>. \r
-Controlled by <span class=Flag><span style='font-size:10.0pt'>switchswitchbreak</span></span>.  To indicate that the <span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> is for the\r
-inner switch, use <span class=Annot><span style='font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>\r
-\r
-<p class=afterlist>Since <span class=CodeText><span style='font-size:10.0pt'>continue</span></span>\r
-only makes sense within loops, warnings are only reported for <span\r
-class=CodeText><span style='font-size:10.0pt'>continue</span></span> statements\r
-within nested loops.  (Controlled by <span class=Flag><span style='font-size:\r
-10.0pt'>looploopcontinue</span></span>.)  A safe inner <span\r
-class=CodeText><span style='font-size:10.0pt'>continue</span></span> may be\r
-preceded by <span class=Annot><span style='font-size:10.0pt'>/*@innercontinue@*/</span></span> to suppress error messages locally. The <span\r
-class=Flag><span style='font-size:10.0pt'>deepbreak</span></span> flag sets all nested break and continue checking flags.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint warns if the marker\r
-preceding a <span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-is not consistent with its placement.  A warning results if <span class=Annot><span\r
-style='font-size:10.0pt'>innerbreak</span></span> precedes a <span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span> that is not\r
-breaking an inner loop, <span class=Annot><span style='font-size:10.0pt'>switchbreak</span></span>\r
-precedes a <span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-that is not breaking a switch, or <span class=Annot><span style='font-size:\r
-10.0pt'>loopbreak</span></span> precedes a <span class=CodeText><span\r
-style='font-size:10.0pt'>break</span></span> that is not breaking a loop.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974993"></a><a\r
-name="_Ref347246280">8.3.4<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span></a>Loop and If Bodies</h3>\r
-\r
-<p class=beforelist>An empty statement after an <span class=CodeText><span\r
-style='font-size:10.0pt'>if</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>while</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>for</span></span> often indicates a potential bug.  A\r
-single statement (i.e., not a compound block) after an <span class=CodeText><span\r
-style='font-size:10.0pt'>if</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>while</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>for</span></span> is not likely to indicate a bug, but\r
-make the code harder to read and edit.  Splint can report errors for if or loop\r
-statements with empty bodies or bodies that are not compound statements. \r
-Separate flags control checking for statements following an <span\r
-class=CodeText><span style='font-size:10.0pt'>if</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>while</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>for</span></span>:</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span><span\r
-class=Flag><span style='font-size:10.0pt'>[if</span></span>,<span class=Flag><span\r
-style='font-size:10.0pt'> while</span></span>,<span class=Flag><span\r
-style='font-size:10.0pt'> for]empty</span></span> \97 report errors for empty\r
-bodies (e.g., <span class=CodeText><span style='font-size:10.0pt'>if (x &gt; 3)\r
-;</span></span> )</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span><span\r
-class=Flag><span style='font-size:10.0pt'>[if</span></span>,<span class=Flag><span\r
-style='font-size:10.0pt'> while</span></span>,<span class=Flag><span\r
-style='font-size:10.0pt'> for]block</span></span> \97 report errors for non-block\r
-bodies (e.g., <span class=CodeText><span style='font-size:10.0pt'>if (x &gt; 3)\r
-x++;</span></span>)</p>\r
-\r
-<p class=MsoListBullet style='margin-left:0in;text-indent:0in'><span\r
-class=Keyword><span style='font-size:10.0pt'>&nbsp;</span></span></p>\r
-\r
-<p class=afterlist>The <span class=CodeText><span style='font-size:10.0pt'>if</span></span>\r
-statement checks also apply to the body of the <span class=CodeText><span\r
-style='font-size:10.0pt'>else</span></span> clause.  No <span class=Flag><span\r
-style='font-size:10.0pt'>ifblock</span></span> warning is reported if the body\r
-of the <span class=CodeText><span style='font-size:10.0pt'>else</span></span>\r
-clause is an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>\r
-statement, to allow conventional <span class=CodeText><span style='font-size:\r
-10.0pt'>else if</span></span> chains.  </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974994"></a><a\r
-name="_Ref347246283">8.3.5<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Complete Logic</a></h3>\r
-\r
-<p class=beforelist>Although it may be perfectly reasonable in many contexts,\r
-an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>-<span\r
-class=CodeText><span style='font-size:10.0pt'>else</span></span> chain with no\r
-final <span class=CodeText><span style='font-size:10.0pt'>else</span></span>\r
-may indicate missing logic or forgetting to check error cases.  If <span\r
-class=Flag><span style='font-size:10.0pt'>elseif-complete</span></span> is on, Splint warns when an <span class=CodeText><span style='font-size:10.0pt'>if</span></span>\r
-statement that is the body of an <span class=CodeText><span style='font-size:\r
-10.0pt'>else</span></span> clause does not have a matching <span\r
-class=CodeText><span style='font-size:10.0pt'>else</span></span> clause.  For\r
-example, the code,</p>\r
-\r
-<p class=Verbatim>   if (x == 0) { return &quot;nil&quot;; }</p>\r
-\r
-<p class=Verbatim>   else if (x == 1) { return &quot;many&quot;; }</p>\r
-\r
-<p class=afterlist>results in a warning since the second <span class=CodeText><span\r
-style='font-size:10.0pt'>if</span></span> has no matching <span class=CodeText><span\r
-style='font-size:10.0pt'>else</span></span> branch.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974995"></a><a\r
-name="_Ref344892802">8.4<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Suspicious Statements</a></h2>\r
-\r
-<p class=TextFontCX>Splint detects errors involving\r
-statements with no apparent effects (Section 8.4.1) and statements that ignore\r
-the result of a called function (Section 8.4.2). </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534974996"></a><a\r
-name="_Ref347247824">8.4.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Statements with No Effects</a></h3>\r
-\r
-<p class=TextFontCX>Splint can report errors for\r
-statements that have no effect.  (Controlled by <span class=Flag><span\r
-style='font-size:10.0pt'>no-effect</span></span>.)   Because of modifies clauses, Splint can detect more errors than traditional checkers.  Unless the <span class=Flag><span style='font-size:10.0pt'>no-effect-uncon</span></span> flag is on, errors are not reported for statements that involve calls to unconstrained functions since the unconstrained function may cause a modification.  Figure 19 shows examples of Splint\92s no effect checking.</p>\r
-<p>\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
-  style='margin-left:5.4pt;border-collapse:collapse;\r
- margin-left:-2.25pt;margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><a name="_Ref344893305"></a><a name="_Ref344874935"><span\r
-  class=StyleKeywordBold><span style='font-size:10.0pt'>noeffect.c</span></span></a></p>\r
-  </td>\r
-  <td  valign=top style='border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim>extern void </p>\r
-  <p class=Verbatim>  nomodcall (int *x) /*@*/;</p>\r
-  <p class=IndentText><i>Recall /*@*/ is shorthand for<br> modifies nothing and use<br>\r
-  no globals.</i></p>\r
-  <p class=Verbatim>extern void mysterycall (int *x);</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>int noeffect (int *x, int y)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim>  y == *x;</p>\r
-  <p class=Verbatim>  nomodcall (x);</p>\r
-  <p class=Verbatim>  mysterycall (x);</p>\r
-  <p class=Verbatim>  return *x;</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td  valign=top style='border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint noeffect.c +noeffectuncon</p>\r
-  <p class=lclintrun>noeffect.c:6: Statement has no effect: y == *x</p>\r
-  <p class=lclintrun>noeffect.c:7: Statement has no effect: nomodcall(x)</p>\r
-  <p class=lclintrun>noeffect.c:8: Statement has no effect (possible</p>\r
-  <p class=lclintrun>    undetected modification through call to</p>\r
-  <p class=lclintrun>    unconstrained function mysterycall):</p>\r
-  <p class=lclintrun>    mysterycall(x)</p>\r
-  <p class=IndentText><i>&nbsp;</i></p>\r
-  <p class=IndentText style='page-break-after:avoid'><i>The warning for line 8\r
-  would not be<br>reported without</i> <span class=Flag><span style='font-size:\r
-  10.0pt'>+noeffectuncon</span></span>.</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Ref534813977"></a><a name="_Toc534824623"></a><a\r
-  name="_Ref534823396">Figure 19</a>.  Statements with No Effect</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Ref534978820"></a><a\r
-name="_Toc534974997">8.4.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Ignored Return Values</a></h3>\r
-\r
-<p class=TextFontCX>Splint reports an error when a return value is ignored.  Checking may be controlled based on the type of\r
-the return value: <span class=Flag><span style='font-size:10.0pt'>ret-val-int</span></span>\r
-controls reporting of ignored return values of type <span class=Keyword><span\r
-style='font-size:10.0pt'>int</span></span>, and <span class=Flag><span\r
-style='font-size:10.0pt'>ret-val-bool</span></span> for return values of type <span class=Keyword><span style='font-size:10.0pt'>bool</span></span>,\r
-and <span class=Flag><span style='font-size:10.0pt'>ret-val-others</span></span> for all other types.  A function statement may be cast to <span class=Keyword><span\r
-style='font-size:10.0pt'>void</span></span> to prevent this error from being\r
-reported. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Alternate types (Section 4.4) can be used to declare functions that return values that may safely\r
-be ignored by declaring the result type to alternately be <span class=Keyword><span\r
-style='font-size:10.0pt'>void</span></span>.  Several functions in the standard\r
-library are specified to alternately return <span class=Keyword><span\r
-style='font-size:10.0pt'>void</span></span> to prevent ignored return value\r
-errors for standard library functions (e.g., <span class=Keyword><span\r
-style='font-size:10.0pt'>strcpy</span></span>) where the result may be safely\r
-ignored (see Section 14.1).  Figure 20 shows examples of ignored return value errors reported by Splint.</p>\r
-\r
-<p class=MsoNormal align=left style='text-align:left;background:white'><span\r
-style='font-size:10.0pt'>&nbsp;</span></p>\r
-<p>\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
- style='margin-left:9.9pt;border-collapse:collapse'>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>ignore.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim># include \93bool.h\94</p>\r
-  <p class=Verbatim>extern int fi (void);</p>\r
-  <p class=Verbatim>extern bool fb (void);</p>\r
-  <p class=Verbatim>extern int /*@alt void@*/</p>\r
-  <p class=Verbatim>  fv (void);</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>int ignore (void)</p>\r
-  <p class=Verbatim>{</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>  8</span></span> \r
-  fi ();</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>  9</span></span> \r
-  (void) fi ();</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10</span></span> \r
-  fb ();</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>11</span></span> \r
-  fv ();</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>12</span></span> \r
-  return fv ();</p>\r
-  <p class=Verbatim>}</p>\r
-  </td>\r
-  <td  valign=top style='border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint ignore.c</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>ignore.c:8: Return value (type int) ignored: fi()</p>\r
-  <p class=lclintrun>ignore.c:10: Return value (type bool) ignored: fb()</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=MsoNormal style='background:white'><i><span style='font-size:10.0pt'>The\r
-  message for line 8 would not be reported if </span></i><span class=Flag><span\r
-  style='font-size:10.0pt'>&#8209;retvalint</span></span><i><span\r
-  style='font-size:10.0pt'> </span></i><i><span\r
-  style='font-size:10.0pt'>is set;<br> for line 10, if </span></i><span class=Flag><span\r
-  style='font-size:10.0pt'>&#8209;retvalbool</span></span><i><span\r
-  style='font-size:10.0pt'> </span></i><i><span\r
-  style='font-size:10.0pt'>is set. </span></i></p>\r
-  <p class=MsoNormal style='background:white'><i><span style='font-size:10.0pt'>&nbsp;</span></i></p>\r
-  <p class=MsoNormal style='background:white'><i><span style='font-size:10.0pt'> No\r
-  message is reported for line 9 because the result is cast to </span></i><span\r
-  class=CodeText><span style='font-size:10.0pt'>void</span></span><i><span\r
-  style='font-size:10.0pt'>,<br> and no message is reported for line 11 because </span></i><span\r
-  class=CodeText><span style='font-size:10.0pt'>fv</span></span><i><span\r
-  style='font-size:10.0pt'> is declared<br> to alternately return </span></i><span\r
-  class=CodeText><span style='font-size:10.0pt'>void</span></span><i><span\r
-  style='font-size:10.0pt'>.</span></i></p>\r
-  <p class=TextFontCX style='page-break-after:\r
-  avoid'>&nbsp;</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.0pt;padding-bottom:0in;padding-left:9.0pt'>\r
-  <p class=MsoCaption><a name="_Toc534824624"></a><a name="_Ref534823436">Figure\r
-  20</a>.  Ignored Return Values</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<p class=MsoNormal align=left style='text-align:left;background:white'><span\r
-style='font-size:10.0pt'>&nbsp;</span></p>\r
-\r
-<b><span style='font-size:16.0pt;font-family:"Times New Roman"'><br clear=all\r
-style='page-break-before:always'>\r
-</span></b>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in;page-break-before:auto'><a\r
-name="_Toc534974998"></a><a name="_Ref534963019"></a><a name="_Ref534962975">9<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Buffer Sizes</a></h1>\r
-\r
-<p class=TextFontCX>Buffer overflow errors are a\r
-particularly dangerous type of bug in C programs.  They are directly\r
-responsible for about half of all security attacks [Larochelle01].  For\r
-performance reasons, C does not perform run time bounds checking.  Referencing\r
-storage outside allocated regions can cause memory corruption and lead to\r
-strange behavior.  Moreover, they are particularly insidious because they can\r
-go undetected in testing or normal use, but usually result in security critical\r
-bugs.  Reads beyond the end of a buffer can cause the program to leak\r
-information.  Writes beyond the end a buffer (buffer overflows) can usually be\r
-exploited make the program run arbitrary code.  Attackers can exploit these\r
-programming bugs to replace the return address on the stack and place arbitrary\r
-code in memory thereby gaining full access to the machine.  Splint is able to\r
-detect many memory bounds errors.<span class=MsoFootnoteReference> </span><a\r
-href="#_ftn12" name="_ftnref12" title=""><span style='font-size:11.0pt;\r
-font-family:"Times New Roman"'>[12]</span></a>  </p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534974999">9.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Checking Accesses</a></h2>\r
-\r
-<p class=TextFontCX>Splint models blocks of\r
-contiguous memory using two properties: <span class=Annot><span\r
-style='font-size:10.0pt'>maxSet</span></span> and <span class=Annot><span\r
-style='font-size:10.0pt'>maxRead</span></span>.  Given a buffer <span\r
-class=CodeText><i><span style='font-size:10.0pt'>b</span></i></span>, <span\r
-class=Annot><span style='font-size:10.0pt'>maxSet(<i>b</i>)</span></span>\r
-denotes the highest address beyond <span class=CodeText><i><span\r
-style='font-size:10.0pt'>b</span></i></span> that can be safely used as an\r
-lvalue.  For the declaration <span class=CodeText><span style='font-size:10.0pt'>char\r
-buf[MAXSIZE]</span></span> we have <span class=Annot><span style='font-size:\r
-10.0pt'>maxSet(buf) </span></span><span class=CodeText><span style='font-size:\r
-10.0pt'>= MAXSIZE - 1</span></span>.  Similarly, <span class=Annot><span\r
-style='font-size:10.0pt'>maxRead</span></span> denotes the highest index of a\r
-buffer that can be safely used an rvalue.  It is inappropriate to read an\r
-uninitialized element or beyond the <span class=CodeText><span\r
-style='font-size:10.0pt'>NUL</span></span> terminator of a null terminated\r
-buffer.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>When a buffer is accessed as\r
-an lvalue, Splint generates a precondition constraint involving the <span\r
-class=Annot><span style='font-size:10.0pt'>maxSet</span></span> property.  When\r
-a buffer is accessed as an rvalue, Splint generates a precondition constraint\r
-involving the <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span>\r
-property.  For the expression <span class=CodeText><span style='font-size:10.0pt'>*<i>ptr</i></span></span>,\r
-Splint generates the constraints <span class=Annot><span style='font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>\r
-<span class=CodeText><span style='font-size:10.0pt'>&gt;= 0</span></span> or <span\r
-class=Annot><span style='font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span> <span\r
-class=CodeText><span style='font-size:10.0pt'>&gt;= 0</span></span> depending\r
-on whether <span class=CodeText><i><span style='font-size:10.0pt'>ptr</span></i></span>\r
-is used as an lvalue or rvalue.  Similarly, for accesses of the form <span\r
-class=CodeText><span style='font-size:10.0pt'>ptr[i]</span></span>, splint\r
-generates the constraints <span class=Annot><span style='font-size:10.0pt'>maxSet(<i>ptr</i>)</span></span>\r
-<span class=CodeText><span style='font-size:10.0pt'>&gt;= i</span></span> or <span\r
-class=Annot><span style='font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span> <span\r
-class=CodeText><span style='font-size:10.0pt'>&gt;= i</span></span>.  If <span\r
-class=Flag><span style='font-size:10.0pt'>+boundswrite</span></span> is set, Splint\r
-warns if it is unable to resolve a constraint involving <span class=Annot><span\r
-style='font-size:10.0pt'>maxSet</span></span>. If <span class=Flag><span\r
-style='font-size:10.0pt'>+boundsread</span></span> is set, Splint warns about\r
-unresolved <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span>\r
-constraints also.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint generates\r
-postconditions for statements to help resolve precondition constraints.  When a\r
-buffer is written to we know that an element of a buffer is initialized and is\r
-safe to read.  We generate the postcondition <span class=Annot><span\r
-style='font-size:10.0pt'>maxRead(<i>ptr</i>)</span></span> <span\r
-class=CodeText><span style='font-size:10.0pt'>&gt;= 0</span></span> if the\r
-buffer is accessed using <span class=CodeText><span style='font-size:10.0pt'>*ptr</span></span>\r
-or <span class=Annot><span style='font-size:10.0pt'>maxRead(ptr)</span></span> <span\r
-class=CodeText><span style='font-size:10.0pt'>&gt;= i</span></span> if the\r
-buffer is accessed using <span class=CodeText><i><span style='font-size:10.0pt'>ptr</span></i></span><span\r
-class=CodeText><span style='font-size:10.0pt'>[<i>i</i>]</span></span>.  Splint\r
-generates additional postconditions for a variety of C constructs.  For\r
-assignment statements Splint generates a postcondition equating the two\r
-operands.  Splint also generates post condition constraints for the <span\r
-class=Annot><span style='font-size:10.0pt'>maxSet</span></span> value of fixed\r
-sized arrays.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975000">9.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Annotating Buffer Sizes</a></h2>\r
-\r
-<p class=TextFontCX>Function declarations may\r
-include <span class=Annot><span style='font-size:10.0pt'>requires</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-clauses that specify assumptions about buffer sizes for function preconditions. \r
-They are interpreted like <span class=Annot><span style='font-size:10.0pt'>requires</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-clauses for simple memory states (see Section 7.5) but can be more expressive.  Where a function with a <span\r
-class=Annot><span style='font-size:10.0pt'>requires</span></span> clause is\r
-called, the call site must be checked to satisfy the constraints implied by the\r
-<span class=Annot><span style='font-size:10.0pt'>requires</span></span> clause. \r
-Similarly, an <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-clause can be used to specify function post conditions.  If the <span\r
-class=Flag><span style='font-size:10.0pt'>+checkpost</span></span> flag is set,\r
-Splint warns if it cannot verify that a function implementation satisfies its\r
-declared postconditions.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Constraints can contain\r
-function parameters as well as global variables and integer constants. The\r
-unary operators, <span class=Annot><span style='font-size:10.0pt'>maxSet</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span> which\r
-correspond to the properties described above are also supported.  Multiple\r
-predicates may be conjoined using <span class=CodeText><span style='font-size:\r
-10.0pt'>/\</span></span>.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-<p class=TextFontCX>For example, the standard\r
-library annotates <span class=CodeText><span style='font-size:10.0pt'>strcpy</span></span>:</p>\r
-\r
-<p class=MsoPlainText style='line-height:normal'>&nbsp;</p>\r
-\r
-<p class=Verbatim style='margin-left:22.5pt'>void /*@alt char * @*/strcpy </p>\r
-\r
-<p class=Verbatim style='margin-left:22.5pt;text-indent:13.5pt'>(/*@unique@*/\r
-/*@out@*/ /*@returned@*/ char *s1, char *s2)</p>\r
-\r
-<p class=Verbatim style='margin-left:.5in'>/*@modifies *s1@*/</p>\r
-\r
-<p class=Verbatim style='margin-left:.5in'>/*@requires maxSet(s1) &gt;=\r
-maxRead(s2) @*/</p>\r
-\r
-<p class=Verbatim>      /*@ensures maxRead(s1) == maxRead (s2) @*/;     </p>\r
-\r
-<p class=MsoPlainText style='margin-left:.5in;line-height:normal'><b>&nbsp;</b></p>\r
-\r
-<p class=MsoPlainText style='text-align:justify;line-height:normal'>The <span\r
-class=Annot><span style='font-size:10.0pt'>requires</span></span> clause\r
-indicates that the buffer passed as <span class=CodeText><span\r
-style='font-size:10.0pt'>s1</span></span> must be large enough to hold the\r
-string passed as <span class=CodeText><span style='font-size:10.0pt'>s2</span></span>. \r
-The <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-clause specifies that <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span>\r
-of <span class=CodeText><span style='font-size:10.0pt'>s1</span></span> after\r
-the call is equal to <span class=Annot><span style='font-size:10.0pt'>maxRead</span></span>\r
-of <span class=CodeText><span style='font-size:10.0pt'>s2</span></span>.  In\r
-cases where the size of <span class=CodeText><span style='font-size:10.0pt'>s2</span></span>\r
-is unknown, programs should use <span class=CodeText><span style='font-size:\r
-10.0pt'>strncpy</span></span>, annotated as: </p>\r
-\r
-<p class=Verbatim>&nbsp;</p>\r
-\r
-<p class=Verbatim style='margin-left:22.5pt'>void /*@alt char * @*/ strncpy </p>\r
-\r
-<p class=Verbatim style='margin-left:22.5pt'>   (/*@unique@*/ /*@out@*/\r
-/*@returned@*/ char *s1, char *s2,</p>\r
-\r
-<p class=Verbatim style='margin-left:22.5pt;text-indent:13.5pt'>  size_t n)</p>\r
-\r
-<p class=Verbatim style='margin-left:22.5pt'>  /*@modifies *s1@*/      </p>\r
-\r
-<p class=Verbatim style='margin-left:22.5pt'>  /*@requires maxSet(s1) &gt;= ( n\r
-- 1 ); @*/ </p>\r
-\r
-<p class=Verbatim style='margin-left:22.5pt'>  /*@ensures maxRead (s2) &gt;= maxRead(s1)\r
-/\ maxRead (s1) &lt;= n;@*/;</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The syntax for buffer size\r
-constraint clauses is:</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-22.5pt;text-align:left'><i><span lang=FR>constraint</span></i><span lang=FR>   </span><span\r
-style='font-family:Symbol'>Þ</span><span lang=FR> (</span><span class=Annot><span\r
-style='font-size:10.0pt'>requires</span></span><span lang=FR> | </span><span\r
-class=Annot><span style='font-size:10.0pt'>ensures</span></span><span lang=FR>)\r
-<i>consExpr relOp consExpr</i></span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-22.5pt;text-align:left'><i><span lang=FR>relOp</span></i><span lang=FR>        </span><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>==</span></span><span lang=FR> | </span><span class=Annot><span\r
-style='font-size:10.0pt'>&gt;</span></span><span lang=FR> | </span><span\r
-class=Annot><span style='font-size:10.0pt'>&gt;=</span></span><span lang=FR> | </span><span\r
-class=Annot><span style='font-size:10.0pt'>&lt;</span></span><span lang=FR> | </span><span\r
-class=Annot><span style='font-size:10.0pt'>&lt;=</span></span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-22.5pt;text-align:left'><i><span lang=FR>consExpr  </span></i><span\r
-style='font-family:Symbol'>Þ</span> <i><span lang=FR>consExpression binOp\r
-consExpr</span></i><span lang=FR> </span>| <i>unaryOp</i> <span class=Annot><span\r
-style='font-size:10.0pt'>(</span></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:"Times New Roman";color:windowtext'> </span></span><i>consExpr</i>\r
-<span class=Annot><span style='font-size:10.0pt'>)</span></span> | <i>term</i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-22.5pt;text-align:left'><i>binOp</i>       <span style='font-family:Symbol'>Þ</span>\r
-<span class=Annot><span style='font-size:10.0pt'>+</span></span> | <span\r
-class=Annot><span style='font-size:10.0pt'>-</span></span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-22.5pt;text-align:left'><i>unaryOp</i>   <span style='font-family:Symbol'>Þ</span>\r
-<span class=Annot><span style='font-size:10.0pt'>maxSet</span></span> | <span\r
-class=Annot><span style='font-size:10.0pt'>maxRead</span></span> </p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-22.5pt;text-align:left'><i>term</i>          <span style='font-family:Symbol'>Þ</span>\r
-<i>identifier</i> | <i>literal</i> | <span class=Annot><span style='font-size:\r
-10.0pt'>result</span></span></p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975001">9.3<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Warnings</a></h2>\r
-\r
-<p class=TextFontCX>Since bounds checking is more\r
-complex than other checks done by Splint, memory bounds warnings contain\r
-extensive information about the unresolved constraint.  Warning messages for\r
-unresolved constraints contain both the original constraints and the simplified\r
-form of the constraint which cannot be resolved.  If the constraint was derived\r
-from a function precondition, the original precondition is included in the\r
-error message.  If the <span class=Flag><span style='font-size:10.0pt'>+showconstraintlocation</span></span>\r
-flag is set, the message includes the expression that the constraint is derived\r
-from.  The <span class=Flag><span style='font-size:10.0pt'>+showconstraintparens</span></span>\r
-flag directs Splint to display fully parenthesized constraints in warnings to\r
-remove ambiguity.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Consider the code excerpt\r
-below containing a trivial out-of-bounds write:</p>\r
-\r
-<p class=Verbatim>&nbsp;</p>\r
-\r
-<p class=Verbatim style='text-indent:.5in'>int buf[10];</p>\r
-\r
-<p class=Verbatim style='text-indent:.5in'>buf[10] = 3;</p>\r
-<p class=TextFontCX>&nbsp;</p>\r
-<p class=TextFontCX style='margin-bottom:6.0pt'>Splint\r
-warns:</p>\r
-\r
-<p align=left class=lclintrun style='margin-left:.5in'>setChar.c:5:4: Possible\r
-out-of-bounds write to buf: buf[10] = 3</p>\r
-\r
-<p class=lclintrun align=left style='margin-left:.5in'>    Unable to resolve constraint:\r
-requires 9 &gt;= 10</p>\r
-\r
-<p class=lclintrun align=left style='margin-top:0in;margin-right:0in;margin-bottom:6.0pt;\r
-margin-left:.5in'>    needed to satisfy precondition: requires maxSet(buf @\r
-setChar.c:5:4) &gt;= 10</p>\r
-\r
-<p class=TextFontCX>Splint has simplified the constraint\r
-from the <span class=Annot><span style='font-size:10.0pt'>requires</span></span>\r
-clause to <span class=CodeText><span style='font-size:10.0pt'>9 &gt;= 10</span></span>\r
-by substituting for the known value of <span class=Annot><span\r
-style='font-size:10.0pt'>maxSet(buf)</span></span> and generated a warning\r
-because 9<span class=CodeText><span style='font-size:10.0pt'> </span></span>(the\r
-highest index of <span class=CodeText><span style='font-size:10.0pt'>buf</span></span>\r
-that may be safely written to) is not greater than or equal to 10.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A more realistic example is\r
-shown Figure 21.  The function <span\r
-class=CodeText><span style='font-size:10.0pt'>updateEnv</span></span> is a\r
-naïve implementation of a function to copy an environmental variable.  There is\r
-no standard restriction on the length of the return value of <span\r
-class=CodeText><span style='font-size:10.0pt'>getenv</span></span> so this can\r
-cause a buffer overflow.  A safe version of <span class=CodeText><span\r
-style='font-size:10.0pt'>updateEnv</span></span> (such as <span class=CodeText><span\r
-style='font-size:10.0pt'>updateEnvSafe</span></span> in Figure 21) would ensure that the buffer \r
-is large enough to hold the environment variable string before copying.\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>requires</span></span> clause means Splint will report\r
-a warning if a call to <span class=CodeText><span style='font-size:10.0pt'>updateEnvSafe</span></span>\r
-passed in a buffer as <span class=CodeText><span style='font-size:10.0pt'>str</span></span>\r
-that is not big enough to hold the value passed as <span class=CodeText><span\r
-style='font-size:10.0pt'>strSize</span></span> characters.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>In many cases, functions will\r
-have multiple unresolved constraints which are similar.  For example, if a subsequence\r
-statement writes to the next element of a buffer.  Usually all these\r
-constraints represent all real problems or are all spurious.  If the <span\r
-class=Flag><span style='font-size:10.0pt'>+redundantconstraints</span></span>\r
-flag is set, Splint reports even apparently redundant warning messages.  Otherwise,\r
-if satisfying one unresolved constraint would imply satisfying another, Splint\r
-only prints a warning message for the stronger constraint. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
- style='margin-left:9.9pt;border-collapse:collapse'>\r
- <tr>\r
-  <td  valign=top style='width:202.5pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>bounds.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='width:3.0in;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt;height:12.15pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:202.5pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim><span style='font-family:Courier'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>void updateEnv(char *\r
-  str)</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>{</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>   char * tmp;</span></p>\r
-  <p class=Verbatim><i><span style='font-size:9.0pt;font-family:Courier'>7</span></i><span\r
-  style='font-family:Courier'>  tmp = getenv(\93MYENV\94);</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>   if (tmp != NULL)</span></p>\r
-  <p class=Verbatim><i><span style='font-size:9.0pt;font-family:Courier'>9</span></i><span\r
-  style='font-family:Courier'>     strcpy (str, tmp);</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>}</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>&nbsp;</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>void updateEnvSafe (char\r
-  * str,</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>                size_t\r
-  strSize) </span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>  </span><a\r
-  href="mailto:/*@requires"><span style='font-family:Courier'>/*@requires</span></a><span\r
-  style='font-family:Courier'> maxSet(str) </span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>              &gt;=\r
-  strSize \961@*/</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>{</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>   char * tmp;</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>   tmp = getenv(\93MYENV\94);</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>   if (tmp != NULL)</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>   {</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>      strncpy (str, tmp,</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>               strSize\r
-  -1);</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>      str[strSize -1] =\r
-  \91/0\92;</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>   }</span></p>\r
-  <p class=Verbatim><span style='font-family:Courier'>}</span></p>\r
-  </td>\r
-  <td  valign=top style='width:3.0in;border-top:none;border-left:none;\r
-  border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint bounds.c +bounds +showconstraintlocation </p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>bounds.c:9: Possible out-of-bounds store:</p>\r
-  <p class=lclintrun>    strcpy(str, tmp)</p>\r
-  <p class=lclintrun>    Unable to resolve constraint:</p>\r
-  <p class=lclintrun>    requires maxSet(str @ bounds.c:9) &gt;=</p>\r
-  <p class=lclintrun>    maxRead(getenv(&quot;MYENV&quot;) @ bounds.c:7)</p>\r
-  <p class=lclintrun>     needed to satisfy precondition:</p>\r
-  <p class=lclintrun>    requires maxSet(str @ bounds.c:9) &gt;=</p>\r
-  <p class=lclintrun>    maxRead(tmp @ bounds.c:9)</p>\r
-  <p class=lclintrun>     derived from strcpy precondition: requires</p>\r
-  <p class=lclintrun>    maxSet(&lt;parameter 1&gt;) &gt;= </p>\r
-  <p class=lclintrun>    maxRead(&lt;parameter 2&gt;)</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Ref534909813"></a><a name="_Ref534909817">Figure\r
-  21</a>.  Memory Bounds</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<br clear=ALL>\r
-\r
-<p class=TextFontCX>The <span class=Flag><span\r
-style='font-size:10.0pt'>+functionpost</span></span> flag is useful for\r
-determining if array bounds warnings are spurious.  If this flag is set, Splint\r
-will print the constraints that it established at the end of the function.  If the\r
-warnings are spurious, localized control comments can be used to suppress them.\r
-</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534975002"></a><a\r
-name="_Ref534642928"></a><a name="_Ref534642285">10<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Extensible Checking</a></h1>\r
-\r
-<p class=TextFontCX>Splint provides mechanisms\r
-for defining new checks and annotations using metastate definitions. \r
-User-defined checks can be used to check and document properties not supported\r
-by the provided checks.<a href="#_ftn13" name="_ftnref13" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:11.0pt;font-family:"Times New Roman"'>[13]</span></span></span></a>\r
-</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A large class of useful\r
-checks can be described as constraints on attributes associated with program\r
-objects or the global execution state. Unlike types, however, the values of\r
-these attributes can change along an execution path.  Splint provides a general\r
-language that lets users define attributes associated with different kinds of\r
-program objects as well as rules that both constrain attributes\92 values at\r
-interface points and specify how attributes change.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Because user-defined\r
-attribute checking is integrated with normal checking, Splint\92s analysis of\r
-user-defined attributes can take advantage of other analyses, such as alias and\r
-nullness analysis. </p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975003">10.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>Defining\r
-Attributes</a></h2>\r
-\r
-<p class=TextFontCX>To define an attribute,\r
-create a metastate file (<span class=ProgramNameChar><span style='font-size:\r
-10.0pt'>.mts</span></span>) that defined the possible values and transfer rules\r
-of the attribute.  Attributes can either be associated with a particular kind\r
-of program object (for example, all <span class=CodeText><span\r
-style='font-size:10.0pt'>char *</span></span>\92s) or with the global state\r
-(whether or not the network has been initialized).  The <span class=Flag><span\r
-style='font-size:10.0pt'>\96mts <i>&lt;file&gt;</i></span></span> flag is used to\r
-direct Splint to read a metastate file (which will be found on the <span\r
-class=CodeText><span style='font-size:10.0pt'>LARCH_PATH</span></span> with\r
-default extension <span class=ProgramNameChar><span style='font-size:10.0pt'>.mts</span></span>).</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>An example attribute\r
-definition is shown in Figure 22.  It defines the <span\r
-class=Annot><span style='font-size:10.0pt'>taintedness</span></span> attribute\r
-for recording whether or not a <span class=CodeText><span style='font-size:\r
-10.0pt'>char *</span></span> came from a possibly untrustworthy source. \r
-Knowing whether a value is possibly hostile is useful for preventing several\r
-security vulnerabilities including format string bugs.<a href="#_ftn14"\r
-name="_ftnref14" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a> \r
-(A simpler way to detect format vulnerabilities is to warn for any format\r
-string that is unknown at compile time. Splint provides this checking, issuing\r
-a warning if the <span class=Flag><span style='font-size:10.0pt'>+formatconst</span></span>\r
-flag is set and finds any unknown format strings at compile time. This can\r
-produce spurious messages, however, because there might be unknown format\r
-strings that are not vulnerable to hostile input.)</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The first three lines of the\r
-attribute definition define the <span class=Annot><span style='font-size:10.0pt'>taintedness</span></span>\r
-attribute associated with <span class=CodeText><span style='font-size:10.0pt'>char\r
-*</span></span> objects, which can be in one of two states: <span class=Annot><span\r
-style='font-size:10.0pt'>untainted</span></span> or <span class=Annot><span\r
-style='font-size:10.0pt'>tainted</span></span>.  The <span class=Annot><span\r
-style='font-size:10.0pt'>context</span></span> clause gives a context selector\r
-for which objects have the attribute.   In this case, <span class=Annot><span\r
-style='font-size:10.0pt'>reference char *</span></span> means that every\r
-reference that is a <span class=CodeText><span style='font-size:10.0pt'>char *</span></span>\r
-has an associated <span class=Annot><span style='font-size:10.0pt'>taintedness</span></span>\r
-attribute.  Other contexts include <span class=Annot><span style='font-size:\r
-10.0pt'>parameter</span></span> (only parameter declarations), <span\r
-class=Annot><span style='font-size:10.0pt'>literal</span></span> (only string\r
-or number literals), and <span class=Annot><span style='font-size:10.0pt'>null</span></span>\r
-(only known <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>\r
-values).  Attribute can also be defined that are not associated with any\r
-particular object, but instead are associated with the global state of a program\r
-execution.  The <span class=Annot><span style='font-size:10.0pt'>global</span></span>\r
-keyword is used before <span class=Annot><span style='font-size:10.0pt'>attribute</span></span>\r
-to define a global attribute.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>oneof</span></span> clause introduces two identifiers\r
-for representing the <span class=Annot><span style='font-size:10.0pt'>taintedness</span></span>\r
-value: <span class=Annot><span style='font-size:10.0pt'>untainted</span></span>\r
-for references that are not derived from untrustworthy input, and <span\r
-class=Annot><span style='font-size:10.0pt'>tainted</span></span> for references\r
-that may contain hostile data.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>annotations</span></span> clause defines two new\r
-annotations that may be used to describe <span class=Annot><span\r
-style='font-size:10.0pt'>taintedness</span></span> assumptions.  In this case,\r
-the annotations match the names of the value choices, but they may be any\r
-identifier.  The clause <span class=Annot><span style='font-size:10.0pt'>tainted\r
-<b>reference ==&gt;</b> tainted </span></span>defines the <span class=Annot><span\r
-style='font-size:10.0pt'>tainted</span></span> annotation that may be used on a\r
-reference to indicate that it has <span class=Annot><span style='font-size:\r
-10.0pt'>tainted</span></span> state.  </p>\r
-\r
-<p>\r
-<center>\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top align=left height=264 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=Verbatim><span class=Annot><b>attribute</b></span><span class=Annot>\r
-  taintedness</span></p>\r
-  <p class=Verbatim><span class=Annot>   <b>context</b> <b>reference</b> char *</span></p>\r
-  <p class=Verbatim><span class=Annot>   <b>oneof</b> untainted, tainted</span></p>\r
-  <p class=Verbatim><span class=Annot>   <b>annotations</b></span></p>\r
-  <p class=Verbatim><span class=Annot>     tainted <b>reference ==&gt;</b>\r
-  tainted</span></p>\r
-  <p class=Verbatim><span class=Annot>     untainted <b>reference ==&gt;</b>\r
-  untainted</span></p>\r
-  <p class=Verbatim><span class=Annot>   <b>transfers</b></span></p>\r
-  <p class=Verbatim><span class=Annot>     tainted <b>as</b> untainted <b>==&gt;\r
-  error</b> &quot;Possibly tainted storage used where untainted required.&quot;</span></p>\r
-  <p class=Verbatim><span class=Annot>   <b>merge</b></span></p>\r
-  <p class=Verbatim><span class=Annot>      tainted <b>+</b> untainted <b>==&gt;</b>\r
-  tainted</span></p>\r
-  <p class=Verbatim><span class=Annot>   <b>defaults</b></span></p>\r
-  <p class=Verbatim><span class=Annot>      reference <b>==&gt;</b> tainted</span></p>\r
-  <p class=Verbatim><span class=Annot>      literal <b>==&gt;</b> untainted</span></p>\r
-  <p class=Verbatim><span class=Annot>      null <b>==&gt;</b> untainted</span></p>\r
-  <p class=Verbatim><span class=Annot><b>end</b></span></p>\r
-  <p class=MsoCaption><a name="_Ref534921559">Figure 22</a>.  Taintedness\r
-  Attribute</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<br clear=ALL>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>transfers</span></span> clause defines rules for state\r
-changes and warning when objects are passed as parameters, returned, or\r
-assigned to externally visible references.  The rule, <span class=Annot><span\r
-style='font-size:10.0pt'>tainted <b>as</b> untainted <b>==&gt; error</b>\r
-&quot;Possibly tainted storage used where untainted required.&quot;</span></span>,\r
-means it is an error to pass a <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>\r
-value as a parameter that has <span class=Annot><span style='font-size:10.0pt'>untainted</span></span>\r
-taintedness.  All other transfers are implicitly permitted, and leave the\r
-passed storage in the same state as before the transfer.  We may also use a <span\r
-class=Annot><span style='font-size:10.0pt'>transfers</span></span> clause to\r
-indicate that the reference changes state after a transfer.  A <span\r
-class=Annot><span style='font-size:10.0pt'>losereference</span></span> clause\r
-(not used in taintedness) is similar to a <span class=Annot><span\r
-style='font-size:10.0pt'>transfers</span></span> clause, except it is used to\r
-provide rules for when a reference to storage is lost, either by leaving the\r
-scope in which it was declared, returning from a function, or assigning it to a\r
-new value.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>merge</span></span> clause defined rules for combining\r
-state along paths.  The clause<span class=Annot><span style='font-size:10.0pt'>\r
-merge tainted + untainted ==&gt; tainted</span></span> indicates that combining\r
-<span class=Annot><span style='font-size:10.0pt'>tainted</span></span> and <span\r
-class=Annot><span style='font-size:10.0pt'>untainted</span></span> objects\r
-produces a <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>\r
-object. Thus, if a reference is <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>\r
-along one control path and <span class=Annot><span style='font-size:10.0pt'>untainted</span></span>\r
-along another control path, checking assumes that it is <span class=Annot><span\r
-style='font-size:10.0pt'>tainted</span></span><span class=ProgramCode><span\r
-style='font-size:9.0pt'> </span></span>after the two branches merge. It is also\r
-used to merge taintedness states in function specifications (see the <span\r
-class=CodeText><span style='font-size:10.0pt'>strcat</span></span> example in\r
-the next section).  We can also define error combinations so that a warning is\r
-reported if the states on different paths are incompatible.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>defaults</span></span> clause specifies default values\r
-used for declarators without explicit attribute annotations. We choose default\r
-values to make it easy to start checking an unannotated program. Here we assume\r
-unannotated references are <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>\r
-and Splint will report a warning where unannotated references are passed to\r
-functions that require untainted parameters. The warnings indicate either a\r
-format bug in the code or a place where an <span class=Annot><span\r
-style='font-size:10.0pt'>untainted</span></span> annotation should be added.\r
-Running Splint again after adding the annotation will propagate the newly\r
-documented assumption through the program.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX style='margin-bottom:6.0pt'>The\r
-full grammar for metastate definitions is given in Appendix C.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975004">10.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>Annotations</a></h2>\r
-\r
-<p class=TextFontCX>The annotations defined by\r
-metastate definitions can be used like normal annotations.  The context\r
-specifier for an annotation indicates where it may be used.  For the\r
-taintedness example, we can use <span class=Annot><span style='font-size:10.0pt'>tainted</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>untainted</span></span> as\r
-annotations wherever <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-could be used.  This includes <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>requires</span></span>\r
-clauses, which allows us to specify functions that modify state associated with\r
-metastate definitions.  The syntax <span class=Annot><i><span style='font-size:\r
-10.0pt'>&lt;expr&gt;</span></i></span><span class=Annot><span style='font-size:\r
-10.0pt'>:<i>&lt;attribute&gt;</i></span></span> is used to refer to the value\r
-of the user-defined attribute for expression <span class=Annot><i><span\r
-style='font-size:10.0pt'>&lt;expr&gt;</span></i></span>.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>It is often necessary to\r
-extend the library specifications with metastate annotations.  We don\92t want to\r
-have different versions of the library for different metastate annotations, so\r
-instead Splint provides a mechanism for adding annotations separately using an <span\r
-class=ProgramNameChar><span style='font-size:10.0pt'>.xh</span></span> file. \r
-For the taintedness example, we do this by providing annotated declarations in\r
-the <span class=ProgramNameChar><span style='font-size:10.0pt'>tainted.xh</span></span>\r
-file. Example specifications in this file include:</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=Verbatim>int printf  (/*@untainted@*/ char *fmt, ...);</p>\r
-\r
-<p class=Verbatim>&nbsp;</p>\r
-\r
-<p class=Verbatim>char *fgets (char *s, int n, FILE *stream) /*@ensures tainted\r
-s@*/ ;</p>\r
-\r
-<p class=Verbatim>&nbsp;</p>\r
-\r
-<p class=Verbatim>char *strcat (/*@returned@*/ char *s1,  char *s2)  </p>\r
-\r
-<p class=Verbatim>   /*@ensures s1:taintedness = s1:taintedness |\r
-s2:taintedness @*/</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=CodeText><span\r
-style='font-size:10.0pt'>strcat</span></span> specification uses <span\r
-class=Annot><span style='font-size:10.0pt'>/*@ensures s1:taintedness =\r
-s1:taintedness | s2:taintedness @*/</span></span> to indicate that the\r
-taintedness of <span class=CodeText><span style='font-size:10.0pt'>s1</span></span>\r
-after <span class=CodeText><span style='font-size:10.0pt'>strcat</span></span>\r
-returns is the result of merging the taintedness of <span class=CodeText><span\r
-style='font-size:10.0pt'>s1</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>s2</span></span> before the call.  Because the\r
-parameters lack annotations, they are implicitly tainted according to the\r
-default rules and either untainted or tainted references can be passed as\r
-parameters to <span class=CodeText><span style='font-size:10.0pt'>strcat</span></span>.\r
-The <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-clause means that after <span class=CodeText><span style='font-size:10.0pt'>strcat</span></span>\r
-returns the first parameter (and the result, because of the returned annotation\r
-on <span class=CodeText><span style='font-size:10.0pt'>s1</span></span>) will\r
-be tainted if either passed object was tainted.  Splint merges the two taintedness\r
-states using the attribute definition rules\97hence, if the <span class=CodeText><span\r
-style='font-size:10.0pt'>s1</span></span> parameter is untainted and the <span\r
-class=CodeText><span style='font-size:10.0pt'>s2</span></span> parameter is\r
-tainted, the result and first parameter will be tainted after <span\r
-class=CodeText><span style='font-size:10.0pt'>strcat</span></span> returns.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534975006"></a><a\r
-name="_Ref534642895"></a><a name="_Ref534642215">11<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Macros</a></h1>\r
-\r
-<p class=TextFontCX>Macros are commonly used in C\r
-programs to implement constants or to mimic functions without the overhead of a\r
-function call.  Macros that are used to implement functions are a persistent\r
-source of bugs in C programs, since they may not behave like the intended\r
-function when they are invoked with certain parameters or used in certain\r
-syntactic contexts.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint eliminates most of the\r
-potential problems by detecting macros with dangerous implementations and\r
-dangerous macro invocations.  Whether or not a macro definition is checked or\r
-expanded normally depends on flag settings and control comments (see Section 11.3). \r
-Stylized macros can also be used to define control structures for iterating\r
-through many values (see Section 11.4).</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975007"></a><a\r
-name="_Ref361651263"></a><a name="_Ref344916524"></a><a name="_Ref344908437"></a><a\r
-name="_Toc344355419">11.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Constant Macros</a></h2>\r
-\r
-<p class=TextFontCX>Macros may be used to\r
-implement constants.  To get type-checking for constant macros, use the <span\r
-class=Annot><span style='font-size:10.0pt'>constant</span></span> annotation. \r
-For example,</p>\r
-\r
-<p class=example>/*@constant null char *mstring_undefined@*/</p>\r
-\r
-<p class=TextFontCX>Declared constants are not\r
-expanded and are checked according to the declaration.  A constant with a <span\r
-class=Annot><span style='font-size:10.0pt'>null</span></span> annotation may be used as <span class=Annot><span style='font-size:10.0pt'>only</span></span> storage.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975008"></a><a\r
-name="_Toc344355420"></a><a name="_Ref343363760">11.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Function-like Macros</a></h2>\r
-\r
-<p class=TextFontCX>Using macros to imitate\r
-functions is notoriously dangerous.  Consider this broken macro for squaring a\r
-number:</p>\r
-\r
-<p class=example># define square(x) x * x</p>\r
-\r
-<p class=TextFontCX>This works fine for a simple\r
-invocation like <span class=CodeText><span style='font-size:10.0pt'>square(i)</span></span>. \r
-It behaves unexpectedly, though, if it is instantiated with a parameter that\r
-has a side effect.  For example, <span class=CodeText><span style='font-size:\r
-10.0pt'>square(i++)</span></span> expands to <span class=CodeText><span\r
-style='font-size:10.0pt'>i++ * i++</span></span>.  Not only does this give the\r
-incorrect result, it has undefined behavior since the order in which the\r
-operands are evaluated is not defined.  (See Section 8.2 for more information\r
-on how expressions exhibiting undefined evaluation order behavior are detected\r
-by Splint.)  To correct the problem we either need to rewrite the macro so that\r
-its parameter is evaluated exactly once, or prevent clients from invoking the\r
-macro with a parameter that has a side effect.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Another possible problem with\r
-macros is that they may produce unexpected results because of operator\r
-precedence rules.  The instantiation, <span class=CodeText><span\r
-style='font-size:10.0pt'>square(i+1)</span></span> expands to <span\r
-class=CodeText><span style='font-size:10.0pt'>i+1*i+1</span></span>, which\r
-evaluates to <span class=CodeText><span style='font-size:10.0pt'>i+i+1</span></span>\r
-instead of the square of <span class=CodeText><span style='font-size:10.0pt'>i+1</span></span>. \r
-To ensure the expected behavior, the macro parameter should be enclosed in\r
-parentheses where it is used in the macro body.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Macros may also behave\r
-unexpectedly if they are not syntactically equivalent to an expression. \r
-Consider the macro definition,</p>\r
-\r
-<p class=example># define incCounts()  ntotal++; ncurrent++;</p>\r
-\r
-<p class=TextFontCX>This works fine, unless it is\r
-used as a statement.  For example,</p>\r
-\r
-<p class=example>if (x &lt; 3) incCounts();</p>\r
-\r
-<p class=TextFontCX>increments <span\r
-class=CodeText><span style='font-size:10.0pt'>ntotal</span></span> if <span\r
-class=CodeText><span style='font-size:10.0pt'>x &lt; 3</span></span> but always\r
-increments <span class=CodeText><span style='font-size:10.0pt'>ncurrent</span></span>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>One solution is to use the\r
-comma operator to define the macro:</p>\r
-\r
-<p class=example># define incCounts()  (ntotal++, ncurrent++)</p>\r
-\r
-<p class=beforelist>More complicated macros can be written using a <span\r
-class=CodeText><span style='font-size:10.0pt'>do \85 while</span></span>\r
-construction:</p>\r
-\r
-<p class=Verbatim>  # define incCounts() \</p>\r
-\r
-<p class=Verbatim>     do { ntotal++; ncurrent++; } while (FALSE)</p>\r
-\r
-<p class=afterlist>Splint detects these pitfalls in macro definitions, and\r
-checks that a macro behaves as much like a function as possible.  A client\r
-should only be able to tell that a function was implemented by a macro if it\r
-attempts to use the macro as a pointer to a function.</p>\r
-\r
-<p class=MsoListBullet>&nbsp;</p>\r
-\r
-<p class=beforelist>Splint does these checks on a macro definition\r
-corresponding to a function:</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Each\r
-parameter to a macro (except those declared to be side effect free, see Section\r
-11.2.1) must be used exactly once in all possible executions of the macro, so\r
-side effecting arguments behave as expected.<a href="#_ftn15" name="_ftnref15"\r
-title=""><span class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:11.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a> \r
-(Controlled by <span class=Flag><span style='font-size:10.0pt'>macroparams</span></span>.)</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>A\r
-parameter to a macro may not be used as the left-hand side of an assignment\r
-expression or as the operand of an increment or decrement operator in the macro\r
-text, since this produces non-functional behavior.  (Controlled by <span\r
-class=Flag><span style='font-size:10.0pt'>macroassign</span></span>.)</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Macro\r
-parameters must be enclosed in parentheses when they are used in potentially\r
-dangerous contexts.  (Controlled by <span class=Flag><span style='font-size:\r
-10.0pt'>macroparens</span></span>.)</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>A\r
-macro definition must be syntactically equivalent to a statement when it is\r
-invoked followed by a semicolon. (Controlled by <span class=Flag><span\r
-style='font-size:10.0pt'>macrostmt</span></span>.)</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>The\r
-type of the macro body must match the return type of the corresponding\r
-function.  If the macro is declared with type <span class=CodeText><span\r
-style='font-size:10.0pt'>void</span></span>, its body may have any type but the\r
-macro value may not be used.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>All\r
-variables declared in the body of a macro definition must be in the macro\r
-variable namespace, so they do not conflict with variables in the scope where\r
-the macro is invoked (which may be used in the macro parameters).  By default,\r
-the macro namespace is all names prefixed by <span class=CodeText><span\r
-style='font-size:10.0pt'>m_</span></span>.  (See Section 12.2 for information\r
-on controlling namespaces.)</p>\r
-\r
-<p class=afterlist>At the call site, a macro is checked like any other function\r
-call.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975009"></a><a\r
-name="_Toc344355421"></a><a name="_Ref343109609">11.2.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;\r
-</span>Side Effect Free Parameters</a></h3>\r
-\r
-<p class=beforelist>Suppose we really do want to implement <span\r
-class=CodeText><span style='font-size:10.0pt'>square</span></span> as a macro,\r
-but want do so in a safe way.  One way to do this is to require that it is\r
-never invoked with a parameter that has a side effect.  Splint will check that\r
-this constraint holds, if the parameter is annotated to be side effect free. \r
-That is, the expression corresponding to this parameter must not modify any state, so it does not matter how many times it is evaluated.  The <span\r
-class=Annot><span style='font-size:10.0pt'>sef</span></span> annotation is used to denote a parameter that may not have any side effects:</p>\r
-\r
-<p class=Verbatim><span style='font-size:9.5pt'>   extern int square (/*@sef@*/\r
-int x);</span></p>\r
-\r
-<p class=Verbatim><span style='font-size:9.5pt'>   # define square(x) ((x)\r
-*(x))</span></p>\r
-\r
-<p class=afterlist>Now, Splint will not report an error checking the definition\r
-of <span class=CodeText><span style='font-size:10.0pt'>square</span></span>\r
-even though <span class=CodeText><span style='font-size:10.0pt'>x</span></span>\r
-is used more than once.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A message will be reported,\r
-however, if <span class=CodeText><span style='font-size:10.0pt'>square</span></span>\r
-is invoked with a parameter that has a side effect.  For the code fragment,</p>\r
-\r
-<p class=example>square (i++)</p>\r
-\r
-<p class=beforelist>Splint produces the message:</p>\r
-\r
-<p class=Verbatim>   <span style='font-family:Arial'>Parameter 1 to square is\r
-declared sef,</span><span style='font-family:Arial'> </span><span\r
-style='font-family:Arial'>but the argument may modify: i++</span></p>\r
-\r
-<p class=betweenlists>It is also an error to pass a macro parameter that is not\r
-annotated with <span class=Annot><span style='font-size:10.0pt'>sef</span></span>\r
-as a <span class=Annot><span style='font-size:10.0pt'>sef</span></span> macro\r
-parameter in the body of a macro definition.  For example,</p>\r
-\r
-<p class=Verbatim><span style='font-size:9.5pt'>   extern int sumsquares (int\r
-x, int y);</span></p>\r
-\r
-<p class=Verbatim><span style='font-size:9.5pt'>   # define sumsquares(x,y)\r
-(square(x) + square(y))</span></p>\r
-\r
-<p class=afterlist>Although <span class=CodeText><span style='font-size:10.0pt'>x</span></span>\r
-only appears once in the definition of <span class=CodeText><span\r
-style='font-size:10.0pt'>sumsquares</span></span> it will be evaluated twice\r
-since <span class=CodeText><span style='font-size:10.0pt'>square</span></span>\r
-is expanded.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>A parameter may be passed as\r
-a <span class=Annot><span style='font-size:10.0pt'>sef</span></span> parameter\r
-without an error being reported, if Splint can determine that evaluating the\r
-parameter has no side effects.  For function calls, the modifies clause is used to determine if a side effect is possible.<a href="#_ftn16"\r
-name="_ftnref16" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>  \r
-To prevent many spurious errors, if the called function has no modifies clause,\r
-Splint will report an error only if <span class=Flag><span style='font-size:\r
-10.0pt'>sef-uncon</span></span> is on.  Justifiably paranoid programmers will\r
-insist on setting <span class=Flag><span style='font-size:10.0pt'>sef-uncon</span></span>\r
-on, and will add modifies clauses to unconstrained functions that are used in <span\r
-class=Annot><span style='font-size:10.0pt'>sef</span></span> macro arguments.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>One common application of macros is to get around the lack\r
-of polymorphism in C.  We can use the <span class=Annot><span style='font-size:\r
-10.0pt'>/*@alt &lt;type&gt;,<sup>+</sup>@&gt;</span></span> syntax  (see Section 4.4) to indicate that an alternate type may be used.  For example,</p>\r
-\r
-<p class=Verbatim><span style='font-size:9.5pt'>  extern int /*@alt float@*/\r
-square (/*@sef@*/ int /*@alt float@*/ x);</span></p>\r
-\r
-<p class=Verbatim><span style='font-size:9.5pt'>  # define square(x) ((x) *(x))</span></p>\r
-\r
-<p class=afterlist>declares <span class=CodeText><span style='font-size:10.0pt'>square</span></span>\r
-for both <span class=CodeText><span style='font-size:10.0pt'>int</span></span>s\r
-and <span class=CodeText><span style='font-size:10.0pt'>float</span></span>s. \r
-Note however, that the return type is either <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>float</span></span>, regardless of the actual\r
-parameter type.  This is weaker than what is actually known about the return\r
-type. </p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975010"></a><a\r
-name="_Ref347227227">11.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Controlling Macro Checking</a></h2>\r
-\r
-<p class=TextFontCX>By default, Splint expands\r
-macros normally and checks the resulting code after macros have been expanded. \r
-Flags and control comments may be used to control which macros are expanded and\r
-which are checked as functions or constants.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>If the <span class=Flag><span\r
-style='font-size:10.0pt'>fcn-macros</span></span> flag is on, Splint assumes all macros defined with parameter lists implement\r
-functions and checks them accordingly.  Parameterized macros are not expanded\r
-and are checked as functions with unknown result and parameter types (or using\r
-the types in the prototype, if one is given).  The analogous flag for macros\r
-that define constants is <span class=Flag><span style='font-size:10.0pt'>const-macros</span></span>.  If it is on, macros with no parameter lists are assumed to be constants, and checked accordingly.  The <span class=Flag><span style='font-size:10.0pt'>all-macros</span></span> flag sets both <span class=Flag><span style='font-size:10.0pt'>fcn-macros</span></span>\r
-and <span class=Flag><span style='font-size:10.0pt'>const-macros</span></span>. \r
-If the <span class=Flag><span style='font-size:10.0pt'>macro-fcn-decl</span></span> flag is set, a message reports parameterized macros with no corresponding function prototype.  If the <span class=Flag><span style='font-size:10.0pt'>macro-const-decl</span></span> flag is set, a similar message reports macros with no parameters that have no corresponding constant declaration.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>The macro checks described in the previous sections make\r
-sense only for macros that are intended to replace functions or constants. \r
-When <span class=Flag><span style='font-size:10.0pt'>fcnmacros</span></span> or <span class=Flag><span style='font-size:10.0pt'>constmacros</span></span> is on, more general macros need to be marked so they will not be checked as\r
-functions or constants, and will be expanded normally.  Macros that are not\r
-meant to behave like functions should be preceded by the /<span class=Annot><span\r
-style='font-size:10.0pt'>*@notfunction@*/</span></span><span class=Annot><span style='font-size:10.0pt'> </span></span>comment.  For\r
-example,</p>\r
-\r
-<p class=Verbatim><span style='font-size:9.5pt'>   /*@notfunction@*/</span></p>\r
-\r
-<p class=Verbatim><span style='font-size:9.5pt'>   # define forever for(;;)</span></p>\r
-\r
-<p class=afterlist>Macros preceded by <span class=Annot><span style='font-size:\r
-10.0pt'>notfunction</span></span> are expanded normally before regular checking\r
-is done.  If a macro that is not syntactically equivalent to a statement\r
-without a semi-colon (e.g., a macro which enters a new scope) is not preceded\r
-by <span class=Annot><span style='font-size:10.0pt'>notfunction</span></span>,\r
-parse errors may result when <span class=Flag><span style='font-size:10.0pt'>fcn-macros</span></span> or <span\r
-class=Flag><span style='font-size:10.0pt'>const-macros</span></span> is on.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Ref345771875"></a><a\r
-name="_Ref345489124"></a><a name="_Toc344355423"></a><a name="_Toc534975011"></a><a\r
-name="_Ref361651257"></a><a name="_Ref349897909"></a><a name="_Ref344916532"></a><a\r
-name="_Ref344908410"></a><a name="_Toc344355424">11.4<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Iterators</a></h2>\r
-\r
-<p class=TextFontCX>It is often useful to be able\r
-to execute the same code for many different values.  For example, we may want\r
-to sum all elements in an <span class=CodeText><span style='font-size:10.0pt'>intSet</span></span>\r
-that represents a set of integers.  If <span class=CodeText><span\r
-style='font-size:10.0pt'>intSet</span></span> is an abstract type, there is no easy way of doing this in a client module without depending on the\r
-concrete representation of the type.  Instead, we could provide such a\r
-mechanism as part of the type\92s implementation.  We call a mechanism for\r
-looping through many values an <i>iterator</i>.</p>\r
-\r
-<p class=TextFontCX> </p>\r
-\r
-<p class=TextFontCX>The C language provides no\r
-mechanism for creating user-defined iterators.  Splint supports a stylized form\r
-of iterators declared using syntactic comments and defined using macros.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Iterator declarations are\r
-similar to function declarations except instead of returning a value, they\r
-assign values to their <span class=Annot><span style='font-size:10.0pt'>yield</span></span>\r
-parameters in each iteration.  For example, we could add this iterator\r
-declaration to <span class=Keyword><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>intSet.h</span></span>:</p>\r
-\r
-<p class=example>/*@iter intSet_elements (intSet s, yield int el);@*/</p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>yield</span></span> annotation means that the variable\r
-passed as the second actual argument is declared as a local variable of type <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span> and assigned a\r
-value in each loop iteration.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975012">11.4.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Defining\r
-Iterators</a></h3>\r
-\r
-<p class=beforelist>An iterator is defined using a macro.  Here\92s one (not\r
-particularly efficient) way of defining <span class=CodeText><span\r
-style='font-size:10.0pt'>intSet_elements</span></span>:</p>\r
-\r
-<p class=Verbatim>   typedef /*@abstract@*/ struct {</p>\r
-\r
-<p class=Verbatim>      int nelements;</p>\r
-\r
-<p class=Verbatim>      int *elements; </p>\r
-\r
-<p class=Verbatim>   } intSet;</p>\r
-\r
-<p class=Verbatim>   \85</p>\r
-\r
-<p class=Verbatim>   # define intSet_elements(s,m_el) \</p>\r
-\r
-<p class=Verbatim>     { int m_i; \ </p>\r
-\r
-<p class=Verbatim>       for (m_i = (0); m_i &lt;= ((s)-&gt;nelements); m_i++)\r
-{ \</p>\r
-\r
-<p class=Verbatim>           int m_el = (s)-&gt;elements[(m_i)];</p>\r
-\r
-<p class=Verbatim>&nbsp;</p>\r
-\r
-<p class=Verbatim>   # define end_intSet_elements }}</p>\r
-\r
-<p class=afterlist>Each time through the loop, the yield parameter <span\r
-class=CodeText><span style='font-size:10.0pt'>m_el</span></span> is assigned to\r
-the next value.  After each value has been assigned to <span class=CodeText><span\r
-style='font-size:10.0pt'>m_el</span></span> for one iteration, the loop\r
-terminates.  Variables declared by the iterator macro (including the <span\r
-class=Annot><span style='font-size:10.0pt'>yield</span></span> parameter) are\r
-preceded by the macro variable namespace prefix <span class=CodeText><span\r
-style='font-size:10.0pt'>m_</span></span> (see Section 11.2) to avoid conflicts\r
-with variables defined in the scope where the iterator is used.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975013">11.4.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Using Iterators</a></h3>\r
-\r
-<p class=TextFontCX>The general structure for\r
-using an iterator is,</p>\r
-\r
-<p class=example><i>iter</i> (<i>&lt;params&gt;</i>) stmt; end_<i>iter</i></p>\r
-\r
-<p class=beforelist>For example, a client could use <span class=CodeText><span\r
-style='font-size:10.0pt'>intSet_elements</span></span> to sum the elements of\r
-an <span class=CodeText><span style='font-size:10.0pt'>intSet</span></span>:</p>\r
-\r
-<p class=Verbatim>   intSet s;</p>\r
-\r
-<p class=Verbatim>   int sum = 0;</p>\r
-\r
-<p class=Verbatim>   ...</p>\r
-\r
-<p class=Verbatim>   intSet_elements (s, el) { </p>\r
-\r
-<p class=Verbatim style='text-indent:.5in'>sum += el; </p>\r
-\r
-<p class=Verbatim>   } end_intSet_elements;</p>\r
-\r
-<p class=afterlist>The actual parameter corresponding to a yield parameter, <span\r
-class=CodeText><span style='font-size:10.0pt'>el</span></span>, is not declared\r
-in the function scope.  Instead, it is declared by the iterator and assigned to\r
-an appropriate value for each iteration.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>Splint will do the following checks for uses of stylized\r
-iterators:</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>An\r
-invocation of the iterator <span class=CodeText><i><span style='font-size:10.0pt'>iter</span></i></span>\r
-must be balanced by a corresponding end, named <span class=CodeText><span\r
-style='font-size:10.0pt'>end_<i>iter</i></span></span>.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>All\r
-actual parameters must be defined, except those corresponding to yield\r
-parameters.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Yield\r
-parameters must be new identifiers, not declared in the current scope or any\r
-enclosing scope.</p>\r
-\r
-<p class=afterlist>Iterators are a bit awkward to implement, but they enable\r
-compact, easily understood client code.  For abstract collection types, an\r
-iterator can be used to enable clients to operate on elements of the collection\r
-without breaking data abstraction.<a name="_Ref348845281"></a><a\r
-name="_Toc344355425"></a><a name="_Ref343247905"></a></p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534975014"></a><a\r
-name="_Ref483663681"></a><a name="_Ref350065611">12<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Naming Conventions</a></h1>\r
-\r
-<p class=TextFontCX>Naming conventions tend to be\r
-a religious issue. Generally, it doesn't matter too much what naming convention\r
-is followed as long as one is chosen and followed religiously.  There are two\r
-kinds of naming conventions supported by Splint.  Type-based naming conventions\r
-(Section 12.1) constrain identifier names according to the abstract types that are accessible where the identifier is defined.  Prefix naming conventions\r
-(Section 12.2) constrain the initial characters of identifier names according\r
-to what is being declared and its scope.  Naming conventions may be combined or\r
-different conventions may be selected for different kinds of identifiers.  In\r
-addition, Splint supports checking that names do not conflict with names\r
-reserved for the standard library or implementation (Section 12.3) and are\r
-sufficiently distinguishable from other names. </p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975015"></a><a\r
-name="_Ref348079373"></a><a name="_Ref347240654"></a><a name="_Toc344355426">12.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>Type-Based\r
-Naming Conventions</a></h2>\r
-\r
-<p class=TextFontCX>Generic naming conventions\r
-constrain valid names of identifiers.  By limiting valid names, namespaces may\r
-be preserved and programs may be more easily understood since the name gives\r
-clues as to how and where the name is defined and how it should be used.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Names may be constrained by\r
-the scope of the name (external, file static, internal), the file in which the\r
-identifier is defined, the type of the identifier, and global constraints.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975016"></a><a\r
-name="_Ref347994687">12.1.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;\r
-</span>Czech Names</a></h3>\r
-\r
-<p class=TextFontCX>Czech<a href="#_ftn17" name="_ftnref17" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>\r
-names denote operations and variables of abstract types by preceding the names\r
-by <span class=CodeText><i><span style='font-size:10.0pt'>&lt;type&gt;</span></i></span><span\r
-class=CodeText><span style='font-size:10.0pt'>_</span></span>.  The remainder\r
-of the name should begin with a lowercase character, but may use any other\r
-character besides the underscore.  Types may be named using any non-underscore\r
-characters.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX style='margin-bottom:6.0pt'>The\r
-Czech naming convention is selected by the <span class=Flag><span\r
-style='font-size:10.0pt'>czech</span></span> flag.  If <span\r
-class=Flag><span style='font-size:10.0pt'>access-czech</span></span> is on, a function, variable, constant or iterator named <span class=CodeText><i><span\r
-style='font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=CodeText><span\r
-style='font-size:10.0pt'>_<i>&lt;name&gt;</i></span></span> has access to the\r
-abstract type <span\r
-class=CodeText><i><span style='font-size:10.0pt'>&lt;type&gt;</span></i></span>. \r
-Reporting of violations of the Czech naming convention is controlled by\r
-different flags depending on what is being declared:</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-fcns</span></span></p>\r
-\r
-<p class=TextFontCX style='margin-left:13.5pt'>Functions\r
-and iterators.  An error is reported for a function name of the form <span\r
-class=CodeText><i><span style='font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span\r
-class=CodeText><span style='font-size:10.0pt'>_<i>&lt;name&gt;</i></span></span>\r
-where <span class=CodeText><i><span style='font-size:10.0pt'>&lt;prefix&gt;</span></i></span>\r
-is not the name of an accessible type.  Note that if <span class=Flag><span\r
-style='font-size:10.0pt'>accessczech</span></span> is on, a type named <span class=CodeText><i><span style='font-size:10.0pt'>&lt;prefix&gt;</span></i></span>\r
-would be accessible in a function beginning with <span class=CodeText><i><span\r
-style='font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span class=CodeText><span\r
-style='font-size:10.0pt'>_</span></span>.  If <span class=Flag><span\r
-style='font-size:10.0pt'>access-czech</span></span> is off, an error is\r
-reported instead.  An error is reported for a function name that does not have\r
-an underscore if any abstract types are accessible where the function is\r
-defined.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-vars</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-constants</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-macros</span></span></p>\r
-\r
-<p class=IndentText>Variables, constants and expanded macros.  An error is\r
-reported if the identifier name starts with <span class=CodeText><i><span\r
-style='font-size:10.0pt'>&lt;prefix&gt;</span></i></span><span class=CodeText><span\r
-style='font-size:10.0pt'>_</span></span><span class=Keyword><span\r
-style='font-size:10.0pt'> </span></span>and <span class=CodeText><i><span\r
-style='font-size:10.0pt'>prefix</span></i></span> is not the name of an\r
-accessible abstract type, or if an abstract type is accessible and the\r
-identifier name does not begin with <span class=CodeText><i><span\r
-style='font-size:10.0pt'>&lt;type&gt;</span></i></span><span class=CodeText><span\r
-style='font-size:10.0pt'>_</span></span> where <span class=CodeText><i><span\r
-style='font-size:10.0pt'>type</span></i></span> is the name of an accessible abstract\r
-type.  If <span class=Flag><span style='font-size:10.0pt'>access-czech</span></span> is on, the representation of the type is visible in the constant or variable definition.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-types</span></span></p>\r
-\r
-<p class=TextFontCX style='margin-left:13.5pt'>User-defined\r
-types.  An error is reported if a type name includes an underscore character.</p>\r
-<p>\r
-  <p class=Sidebar align=right>Of course, this is a complete jumble to the uninitiated, and\r
-  that\92s the joke.</p>\r
-  <p class=Sidebar align=right style='text-align:right'><i>Charles Simonyi, on\r
-  the Hungarian naming convention</i></p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975017"></a><a\r
-name="_Ref344878566">12.1.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;\r
-</span>Slovak Names</a></h3>\r
-\r
-<p class=TextFontCX>Slovak names are similar to Czech names, except they are spelled differently.  A Slovak name\r
-is of the form <span class=CodeText><i><span style='font-size:10.0pt'>&lt;type&gt;&lt;Name&gt;</span></i></span>. \r
-The type prefix may not use uppercase characters.  The remainder of the name\r
-starts with the first uppercase character.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The <span class=Flag><span\r
-style='font-size:10.0pt'>slovak</span></span> flag selects the Slovak naming convention.  Like Czech names, it may be used with <span class=Flag><span style='font-size:10.0pt'>access-slovak</span></span> to control access to abstract representations. The <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-fcns</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-vars</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-constants</span></span>, and <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-macros</span></span> flags are analogous to the similar Czech flags.  If <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-type</span></span> is on, an\r
-error is reported if a type name includes an uppercase letter.<span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975018"></a><a\r
-name="_Ref347994743">12.1.3<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;\r
-</span>Czechoslovak Names</a></h3>\r
-\r
-<p class=TextFontCX>Czechoslovak names are a combination of Czech names and Slovak names.  Operations may be\r
-named either <span class=CodeText><i><span style='font-size:10.0pt'>&lt;type&gt;</span></i></span><span\r
-class=CodeText><span style='font-size:10.0pt'>_</span></span> followed by any\r
-sequence of non-underscore characters, or <span class=CodeText><i><span\r
-style='font-size:10.0pt'>&lt;type&gt;</span></i></span> followed by an\r
-uppercase letter and any sequence of characters.  Czechoslovak names have been\r
-out of favor since 1993, but may be necessary for checking legacy code. The <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-fcns</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-vars</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-macros</span></span>, and <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-constants</span></span>\r
-flags are analogous to the similar Czech flags.  If <span class=Flag><span\r
-style='font-size:10.0pt'>czechoslovak-type</span></span> is on, an error is reported if a type name contains either an uppercase letter or\r
-an underscore character.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975019"></a><a\r
-name="_Ref347240687"></a><a name="_Ref347222192">12.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Namespace Prefixes</a></h2>\r
-\r
-<p class=TextFontCX>Another way to restrict names\r
-is to constrain the leading character sequences of various kinds of\r
-identifiers.  For example, the names of all user-defined types might begin with\r
-<span class=CodeText><span style='font-size:10.0pt'>T</span></span> followed by\r
-an uppercase letter and all file static names begin with an uppercase letter. \r
-This may be useful for enforcing a namespace (e.g., all names exported by the\r
-X-windows library should begin with <span class=CodeText><span\r
-style='font-size:10.0pt'>X</span></span>) or just making programs easier to\r
-understand by establishing an enforced convention.  Splint can be used to\r
-constrain identifiers in this way to detect identifiers inconsistent with\r
-prefixes.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>All namespace flags are of\r
-the form, <span class=Flag><span style='font-size:10.0pt'>-<i>&lt;context&gt;</i>prefix\r
-<i>&lt;string&gt;</i></span></span>.  For example, the macro variable namespace\r
-restricting identifiers declared in macro bodies to be preceded by <span\r
-class=CodeText><span style='font-size:10.0pt'>m_</span></span> would be\r
-selected by <span class=Flag><span style='font-size:10.0pt'>-macrovarprefix </span></span><span\r
-class=Flag><span style='font-size:10.0pt'>&quot;m_&quot;</span></span>.  The\r
-string may contain regular characters that may appear in a C identifier.  These\r
-must match the initial characters of the identifier name.  In addition, special\r
-characters (shown in Figure 23) can be used to denote a class of characters.<a\r
-href="#_ftn18" name="_ftnref18" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a> \r
-The <span class=CodeText><span style='font-size:10.0pt'>*</span></span>\r
-character may be used at the end of a prefix string to specify the rest of the\r
-identifier is zero or more characters matching the character immediately before\r
-the <span class=CodeText><span style='font-size:10.0pt'>*</span></span>.  For\r
-example, the prefix string <span class=CodeText><span style='font-size:10.0pt'>T&amp;*</span></span>\r
-matches <span class=CodeText><span style='font-size:10.0pt'>T</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>TWINDOW</span></span> but not <span\r
-class=CodeText><span style='font-size:10.0pt'>Twin</span></span>.</p>\r
-\r
-<p class=beforelist>&nbsp;</p>\r
-\r
-<p class=beforelist>Different prefixes can be selected for the following\r
-identifier contexts:</p>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
- style='margin-left:.45in;border-collapse:collapse'>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>macro-var-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any variable declared inside\r
-  a macro body </p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>unchecked-macro-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any macro that is not\r
-  checked as a function or constant (see Section 11.4)</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>tag-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Tags for <span\r
-  class=CodeText><span style='font-size:10.0pt'>struct</span></span>, <span\r
-  class=CodeText><span style='font-size:10.0pt'>union</span></span> and <span\r
-  class=CodeText><span style='font-size:10.0pt'>enum</span></span> declarations</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>enum-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Members of <span\r
-  class=CodeText><span style='font-size:10.0pt'>enum</span></span> types</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>type-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Name of a user-defined type</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>file-static-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any identifier with file\r
-  static scope</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>glob-var-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any variable (not of\r
-  function type) with global scope</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>const-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any constant (see Section 11.1)</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>iter-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>An iterator (see Section 11.4)</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>proto-param-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>A parameter in a function\r
-  declaration prototype</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:2.0in;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>external-prefix</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:247.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any exported identifier</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<p class=afterlist>If an identifier is in more than one of the namespace\r
-contexts, the most specific defined namespace prefix is used (e.g., a global variable is also an exported identifier, so if <span class=Flag><span\r
-style='font-size:10.0pt'>global-var-prefix</span></span> is set, it is checked\r
-against the variable name; if not, the identifier is checked against the <span\r
-class=Flag><span style='font-size:10.0pt'>external-prefix</span></span>.)</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>For each prefix flag, a\r
-corresponding flag named <span class=Flag><i><span style='font-size:10.0pt'>&lt;prefixname&gt;</span></i></span><span\r
-class=Flag><span style='font-size:10.0pt'>exclude</span></span> controls\r
-whether errors are reported if identifiers in a different namespace match the\r
-namespace prefix.  For example, if <span class=Flag><span style='font-size:\r
-10.0pt'>macro-var-prefix-exclude</span></span> is on, Splint checks that no identifier that is not a variable declared inside a macro body uses the macro variable prefix. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>Here is a (somewhat draconian) sample naming convention:</p>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
- style='margin-left:5.4pt;border-collapse:collapse'>\r
- <tr>\r
-  <td  valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>-unchecked-macro-prefix </span></span><span\r
-  class=Flag><span style='font-size:10.0pt'>&quot;~*&quot;</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Unchecked macros have no\r
-  lowercase letters.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>-type-prefix </span></span><span\r
-  class=Flag><span style='font-size:10.0pt'>&quot;T^&amp;*&quot;</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>All type names begin with <span\r
-  class=CodeText><span style='font-size:10.0pt'>T</span></span> followed by an\r
-  uppercase letter.  The rest of the name is all lowercase letters.</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>+type-prefix-exclude</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>No identifier that does not\r
-  name a user-defined type name begins with the type name prefix.</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>-file-static-prefix </span></span><span\r
-  class=Flag><span style='font-size:10.0pt'>&quot;^&amp;&amp;&amp;&quot;</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>File static scope variables\r
-  begin with an uppercase letter and three lowercase letters.</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>-proto-param-prefix &quot;p_&quot;</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>All parameters in\r
-  prototypes must begin with <span class=CodeText><span style='font-size:10.0pt'>p_</span></span>.</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>-glob-var-prefix &quot;G&quot;</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>All global variables start\r
-  with <span class=CodeText><span style='font-size:10.0pt'>G</span></span>.</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:189.35pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>+glob-var-prefix-exclude</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:238.15pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>No identifier that is not a\r
-  global variable starts with <span class=CodeText><span style='font-size:10.0pt'>G</span></span>.</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<p class=beforelist>&nbsp;</p>\r
-\r
-<p class=beforelist>The prefix for parameters in function prototypes is useful\r
-for making sure parameter names are not in conflict with macros defined before\r
-the function prototype.  In most cases, it may be preferable to not name\r
-prototype parameters.  If the <span class=Flag><span style='font-size:10.0pt'>proto-param-name</span></span> flag is set, an error is reported for any named parameter in a prototype declaration.  If a <span class=Flag><span style='font-size:10.0pt'>proto-param-prefix</span></span> is set, no error is reported for unnamed parameters.</p>\r
-\r
-<p class=TextFontCX>It may also be useful to\r
-check the names of prototype parameters correspond to the names in\r
-definitions.  While using header files as documentation is not generally\r
-recommended, it is common enough practice that it makes sense to check that\r
-parameter names are consistent.  A discrepancy may indicate an error in the\r
-parameter order in the function prototype.  If <span class=Flag><span\r
-style='font-size:10.0pt'>proto-param-match</span></span> is set, Splint will report an error if the name of a definition parameter does not match the corresponding prototype parameter (after removing the <span class=Flag><span\r
-style='font-size:10.0pt'>protoparamprefix</span></span>).</p>\r
-<p>\r
-<center>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
- style='margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='width:22.0pt;border-top:solid black 1.5pt;\r
-  border-left:solid black 1.5pt;border-bottom:none;border-right:none;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=CodeText><span\r
-  style='font-size:10.0pt'>^</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:401.55pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any uppercase letter, <span\r
-  class=CodeText><span style='font-size:10.0pt'>A</span></span>-<span\r
-  class=CodeText><span style='font-size:10.0pt'>Z</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=CodeText><span\r
-  style='font-size:10.0pt'>&amp;</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any lowercase letter, <span\r
-  class=CodeText><span style='font-size:10.0pt'>a</span></span>-<span\r
-  class=CodeText><span style='font-size:10.0pt'>z</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=CodeText><span\r
-  style='font-size:10.0pt'>%</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any character that is not\r
-  an uppercase letter (allows lowercase letters, digits and underscore)</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=CodeText><span\r
-  style='font-size:10.0pt'>~</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any character that is not a\r
-  lowercase letter (allows uppercase letters, digits and underscore)</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=CodeText><span\r
-  style='font-size:10.0pt'>$</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any letter (<span\r
-  class=CodeText><span style='font-size:10.0pt'>a</span></span>-<span\r
-  class=CodeText><span style='font-size:10.0pt'>z</span></span>, <span\r
-  class=CodeText><span style='font-size:10.0pt'>A</span></span>-<span\r
-  class=CodeText><span style='font-size:10.0pt'>Z</span></span>)</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=CodeText><span\r
-  style='font-size:10.0pt'>/</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any letter or digit (<span\r
-  class=CodeText><span style='font-size:10.0pt'>A</span></span>-<span\r
-  class=CodeText><span style='font-size:10.0pt'>Z</span></span>, <span\r
-  class=CodeText><span style='font-size:10.0pt'>a</span></span>-<span\r
-  class=CodeText><span style='font-size:10.0pt'>z</span></span>, <span\r
-  class=CodeText><span style='font-size:10.0pt'>0</span></span>-<span\r
-  class=CodeText><span style='font-size:10.0pt'>9</span></span>)</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:22.0pt;border:none;border-left:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=CodeText><span\r
-  style='font-size:10.0pt'>?</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:401.55pt;border:none;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX>Any character valid in a C\r
-  identifier</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:22.0pt;border-top:none;border-left:solid black 1.5pt;\r
-  border-bottom:solid black 1.5pt;border-right:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=CodeText><span\r
-  style='font-size:10.0pt'>#</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:401.55pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX style='page-break-after:\r
-  avoid'>Any digit, <span class=CodeText><span style='font-size:10.0pt'>0</span></span>-<span\r
-  class=CodeText><span style='font-size:10.0pt'>9</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824625"></a><a name="_Ref347220245"></a><a\r
-  name="_Ref347220226"></a><a name="_Toc347255399"></a><a name="_Ref347222037"></a><a\r
-  name="_Ref347222045"></a><a name="_Ref534824531">Figure 23</a>.  Prefix Character\r
-  Codes</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975020"></a><a\r
-name="_Ref348079479"></a><a name="_Ref347240790"></a><a name="_Toc344355427">12.3<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>Naming\r
-Restrictions</a></h2>\r
-\r
-<p class=TextFontCX>Additional naming restrictions can be used to check that names do no conflict with names reserved for the standard library, and that identifier are sufficiently distinct (either for\r
-the compiler and linker, or for the programmer.)  Restrictions may be different\r
-for names that are needed by the linker (<i>external</i> names) and names that\r
-are only needed during compilations (<i>internal</i> names).  Names of non-<span\r
-class=CodeText><span style='font-size:10.0pt'>static</span></span> functions\r
-and global variables are external; all other names are internal.</p>\r
-<p>\r
-  <p class=Sidebar align=right><a name="_Ref350062822"></a><a name="_Ref348845288"></a><a\r
-  name="_Toc344355429"></a><a name="_Ref343248602">&nbsp;</a></p>\r
-  <p class=Sidebar align=right>The decision to retain the old six-character\r
-  case-insensitive restriction on significance was most painful.</p>\r
-  <p class=Sidebar align=right style='text-align:right'><i>ANSI C Rationale</i></p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975021">12.3.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Reserved Names</a></h3>\r
-\r
-<p class=TextFontCX>Many names are reserved for the implementation and standard library.  A complete list of reserved names can be found in [vdL, p. 126-128].  Some name prefixes such as <span\r
-class=CodeText><span style='font-size:10.0pt'>str</span></span> followed by a\r
-lowercase character are reserved for future library extensions.  Most C\r
-compilers do not detect naming conflicts, and they can lead to unpredictable\r
-program behavior.  If <span class=Flag><span style='font-size:10.0pt'>ansi-reserved</span></span>\r
-is on, Splint warns about external names that conflict with reserved names.  If\r
-<span class=Flag><span style='font-size:10.0pt'>ansi-reserved-internal</span></span> is on, warnings are also produced for internal names.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>If <span class=Flag><span\r
-style='font-size:10.0pt'>+cpp-names</span></span> is set, Splint warns about\r
-identifier names that are keywords or reserved words in C++.  This is useful if\r
-the code may later be compiled with a C++ compiler (of course, this is not\r
-enough to ensure the meaning of the code is not changed when it is compiled as\r
-C++.)</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975022">12.3.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Distinct Names</a></h3>\r
-\r
-<p class=TextFontCX>Splint can check that names differ within a given number of characters, optionally ignoring alphabetic\r
-case and differences between characters that look similar.  The number of\r
-significant characters may be different for external and internal names.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Using <span class=Flag><span\r
-style='font-size:10.0pt'>+distinct-external-names</span></span> sets the number of significant characters for external names to six and makes alphabetical case insignificant for external names.  This is the minimum significance acceptable in an\r
-ANSI-conforming compiler.  Most modern compilers exceed these minimums (which\r
-are particularly hard to follow if one uses the Czech or Slovak naming convention).  The number of significant characters can be changed using the <span class=Flag><span\r
-style='font-size:10.0pt'>external-name-length <i>&lt;number&gt;</i></span></span>\r
-flag.  If <span class=Flag><span style='font-size:10.0pt'>external-name-case-insensitive</span></span>\r
-is on, alphabetical case is ignored in comparing external names. Splint reports\r
-identifiers that differ only in alphabetic case. </p>\r
-\r
-<p class=TextFontCX>For internal identifiers, a\r
-conforming compiler must recognize at least 31 characters and treat\r
-alphabetical cases distinctly.  Nevertheless, it may still be useful to check\r
-that internal names are more distinct then required by the compiler to minimize\r
-the likelihood that identifiers are confused in the program.  Analogously to\r
-external names, the <span class=Flag><span style='font-size:10.0pt'>internal-name-length</span></span><span class=Flag><span style='font-size:10.0pt'> <i>&lt;number&gt;</i></span></span>\r
-flag sets the number of significant characters in an internal name and <span\r
-class=Flag><span style='font-size:10.0pt'>internal-name-case-insensitive</span></span>\r
-sets the case sensitivity.  The <span class=Flag><span style='font-size:10.0pt'>internal-name-look-alike</span></span>\r
-flag further restricts distinctions between identifiers.  When set,\r
-similar-looking characters match \97 the lowercase letter <span class=CodeText><span\r
-style='font-size:10.0pt'>l</span></span> matches the uppercase letter <span\r
-class=CodeText><span style='font-size:10.0pt'>I</span></span> and the number <span\r
-class=CodeText><span style='font-size:10.0pt'>1</span></span>; the letter <span\r
-class=CodeText><span style='font-size:10.0pt'>O</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>o</span></span> matches the\r
-number <span class=CodeText><span style='font-size:10.0pt'>0</span></span>; <span\r
-class=CodeText><span style='font-size:10.0pt'>5</span></span> matches <span\r
-class=CodeText><span style='font-size:10.0pt'>S</span></span>; and <span\r
-class=CodeText><span style='font-size:10.0pt'>2</span></span> matches <span\r
-class=CodeText><span style='font-size:10.0pt'>Z</span></span>.  Identifiers\r
-that are not distinct except for look-alike characters will produce an error\r
-message.  External names are also internal names, so they must satisfy both the\r
-external and internal distinct identifier checks.  Figure 24 provides some examples of distinct name checking.</p>\r
-<p>\r
-<center>\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0\r
- style='margin-left:9.9pt;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='width:166.5pt;border:solid black 1.5pt;\r
-  border-bottom:none;background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><span class=Keyword><b><span style='font-size:10.0pt;\r
-  color:white'>names.c</span></b></span></p>\r
-  </td>\r
-  <td  valign=top style='width:256.5pt;border-top:solid black 1.5pt;\r
-  border-left:none;border-bottom:none;border-right:solid black 1.5pt;\r
-  background:black;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'><b><span style='color:white'>Running Splint</span></b></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:166.5pt;border:solid black 1.5pt;\r
-  border-top:none;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> </span></span>char\r
-  *stringrev (char *s);</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>3</span></span>\r
-  int f (int x)</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'> </span></span> {</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>5</span></span>\r
-  int lookalike = 1;</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>6</span></span>\r
-  int looka1ike = 2;</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>  if (x &gt; 3)</p>\r
-  <p class=Verbatim>    {</p>\r
-  <p class=Verbatim><span class=Line><span style='font-size:8.0pt'>10</span></span>   \r
-  int x = lookalike;</p>\r
-  <p class=Verbatim>      x += looka1ike;</p>\r
-  <p class=Verbatim>    }</p>\r
-  <p class=Verbatim>&nbsp;</p>\r
-  <p class=Verbatim>  return x;</p>\r
-  <p class=Verbatim>}                        </p>\r
-  </td>\r
-  <td  valign=top style='width:256.5pt;border-top:none;border-left:\r
-  none;border-bottom:solid black 1.5pt;border-right:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=lclintrun>&gt; splint names.c\r
-  +distinctinternalnames                         </p>\r
-  <p class=lclintrun>           +internalnamelookalike  +isoreserved</p>\r
-  <p class=lclintrun>&nbsp;</p>\r
-  <p class=lclintrun>names.c:1: Name stringreverse is reserved for future</p>\r
-  <p class=lclintrun>    library extensions.  Functions that begin with</p>\r
-  <p class=lclintrun>    &quot;str&quot; and a lowercase letter may be added to</p>\r
-  <p class=lclintrun>    &lt;stdlib.h&gt; or &lt;string.h&gt;. (ISO99:7.26.9)</p>\r
-  <p class=lclintrun>names.c:6: Internal identifier looka1ike is not</p>\r
-  <p class=lclintrun>    distinguishable from lookalike except by lookalike</p>\r
-  <p class=lclintrun>    characters</p>\r
-  <p class=lclintrun>   names.c:5: Declaration of lookalike</p>\r
-  <p class=lclintrun>names.c:10: Variable x shadows outer declaration</p>\r
-  <p class=lclintrun style='page-break-after:avoid'>   names.c:3: Previous\r
-  declaration of x: int</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:5.05pt;padding-right:\r
-  9.35pt;padding-bottom:5.05pt;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Ref343085825"></a><a name="_Ref343085797"></a><a\r
-  name="_Ref343065542"></a><a name="_Ref349992283"></a><a name="_Ref534642902"></a><a\r
-  name="_Ref534642319"></a><a name="_Toc534824626"></a><a name="_Ref534823650">Figure\r
-  24</a>.  Distinct Names</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Ref534981356"></a><a\r
-name="_Ref534978939"></a><a name="_Toc534975023">13<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Completeness</a></h1>\r
-\r
-<p class=TextFontCX>Splint can report warnings for unused declarations and exported declarations that are not used externally.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975024"></a><a\r
-name="_Ref534744216">13.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Unused Declarations</a></h2>\r
-\r
-<p class=TextFontCX>Splint detects constants,\r
-functions, parameters, variables, types, enumerator members, and structure or\r
-union fields that are declared but never used.  The flags <span class=Flag><span\r
-style='font-size:10.0pt'>constuse</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>fcnuse</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>paramuse</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>varuse</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>typeuse</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>enummemuse</span></span> and <span class=Flag><span style='font-size:10.0pt'>fielduse</span></span> control whether unused declaration errors are reported for each kind of\r
-declaration.  Errors for exported declarations are reported only if <span\r
-class=Flag><span style='font-size:10.0pt'>topuse</span></span> is on (see Section 13.2).</p>\r
-\r
-<p class=TextFontCX><a name="_Ref349900444"></a><a\r
-name="_Ref349850608"></a><a name="_Ref349850429">&nbsp;</a></p>\r
-\r
-<p class=TextFontCX>The <span class=Annot><span\r
-style='font-size:10.0pt'>/*@unused@*/</span></span> annotation can be used before a declaration to indicate that the item declared need\r
-not be used.  Unused declaration errors are not reported for identifiers\r
-declared with <span class=Annot><span style='font-size:10.0pt'>unused</span></span><a\r
-name="_Toc344355432"></a><a name="_Ref343110935">.</a></p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975025"></a><a\r
-name="_Toc344355433"></a><a name="_Ref343110504">13.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Complete </a>Programs</h2>\r
-\r
-<p class=TextFontCX>Splint can be used on both complete and partial programs.  When checking complete programs, additional checks can\r
-be done to ensure that every identifier declared by the program is defined and\r
-used, and that functions that do not need to be exported are declared <span\r
-class=CodeText><span style='font-size:10.0pt'>static</span></span>. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint checks that all\r
-declared variables and functions are defined (controlled by <span class=Flag><span\r
-style='font-size:10.0pt'>compdef</span></span><span\r
-class=Flag><span style='font-size:10.0pt'>)</span></span>.  Declarations of\r
-functions and variables that are defined in an external library, may be\r
-preceded by <span class=Annot><span style='font-size:10.0pt'>/*@external@*/</span></span> to suppress undefined declaration errors.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint reports external\r
-declarations that are unused (controlled by <span class=Flag><span\r
-style='font-size:10.0pt'>topuse</span></span>).  Which declarations are reported also depends on the declaration use flags (Section 13.1).  The <span\r
-class=Flag><span style='font-size:10.0pt'>+partial</span></span> flag sets flags for checking a partial system.  Top-level unused declarations, undefined declarations, and unnecessary external names are not reported if <span class=Flag><span\r
-style='font-size:10.0pt'>+partial</span></span> is set.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975026">13.2.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Unnecessarily\r
-External Names</a></h3>\r
-\r
-<p class=TextFontCX>Splint can report variables and functions that are declared with global scope (i.e., without using <span\r
-class=CodeText><span style='font-size:10.0pt'>static</span></span>), that are\r
-not used outside the file in which they are defined.  In a stand-alone system,\r
-these identifiers should usually be declared using <span class=CodeText><span\r
-style='font-size:10.0pt'>static</span></span> to limit their scope.  If the <span\r
-class=Flag><span style='font-size:10.0pt'>export-static</span></span> flag is\r
-on, Splint will report declarations that could have file scope.  It should only\r
-be used when all relevant source files are listed on the Splint command line;\r
-otherwise, variables and functions may be incorrectly identified as only used\r
-in the file scope since Splint did not process the other file in which they are\r
-used.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975027">13.2.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Declarations\r
-Missing from Headers</a></h3>\r
-\r
-<p class=TextFontCX>A common practice in C\r
-programming styles, is that every function or variable exported by <span\r
-class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>\r
-is declared in <span class=Keyword><i><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>M</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>. \r
-If the <span class=Flag><span style='font-size:10.0pt'>export-header</span></span>\r
-flag is on, Splint will report exported declarations in <span class=Keyword><i><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>\r
-that are not declared in <span class=Keyword><i><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>M</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>.</p>\r
-\r
-<h1 style='margin-left:0in;text-indent:0in'><a name="_Toc534975028"></a><a\r
-name="_Ref534642392"></a><a name="_Ref349900301">14<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Libraries</a> and Header File Inclusion</h1>\r
-\r
-<p class=TextFontCX>Libraries can be used to\r
-record interface information.  A library containing information about the\r
-standard C Library is used to enable checking of library calls.  Program\r
-libraries can be created to enable fast checking of single modules in a large\r
-program.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975029"></a><a\r
-name="_Ref534035506"></a><a name="_Ref348801560"></a><a name="_Ref347465531"></a><a\r
-name="_Ref344887939"></a><a name="_Toc344355445">14.1<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Standard Librar</a>ies</h2>\r
-\r
-<p class=TextFontCX>In order to check calls to library functions, Splint uses an annotated standard library.  This\r
-contains more information about function interfaces then is available in the\r
-system header files since it uses annotations.  Further, it contains only those\r
-functions documented in the ISO C99 standard.  Many systems include extra\r
-functions in their system libraries; programs that use these functions cannot\r
-be compiled on other systems that do not provide them.  Certain types defined\r
-by the library are treated as abstract types (e.g., a program should not rely\r
-on how the <span class=CodeText><span style='font-size:10.0pt'>FILE</span></span>\r
-type is implemented).  When checking source code, Splint does include system\r
-headers corresponding to files in the library, but instead uses the library\r
-description of the standard library.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The Splint distribution\r
-includes several different standard libraries: the ANSI standard library, the\r
-POSIX standard library<a href="#_ftn19" name="_ftnref19" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:11.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>,\r
-and a UNIX library based on the Open Group\92s Single Unix Specification.  Each\r
-library comes in two versions: the standard version and the strict version.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975030">14.1.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>ISO Standard\r
-Library</a></h3>\r
-\r
-<p class=TextFontCX>The default behavior of\r
-Splint is to use the ISO standard library (loaded from <span class=CodeText><span\r
-style='font-size:10.0pt'>standard.lcd</span></span>).  This library is based on\r
-the standard library described in the ISO C99 standard. </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975031">14.1.2<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>POSIX Library</a></h3>\r
-\r
-<p class=TextFontCX>The POSIX library is selected\r
-by the <span class=Flag><span style='font-size:10.0pt'>+posixlib</span></span> flag.   The POSIX library is based on the IEEE Std 1003.1-1990.   </p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975032">14.1.3<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>UNIX Library</a></h3>\r
-\r
-<p class=afterlist>The UNIX library is selected by the <span class=Flag><span\r
-style='font-size:10.0pt'>+unixlib</span></span> flag.  This library is based on\r
-the Open Group\92s Single Unix Specification, Version 2.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=MsoListBullet style='margin-left:0in;text-indent:0in'>In the UNIX\r
-library, <span class=CodeText><span style='font-size:10.0pt'>free</span></span>\r
-is declared with a non-null parameter.  ISO specifies that <span\r
-class=CodeText><span style='font-size:10.0pt'>free</span></span> should handle\r
-the argument <span class=CodeText><span style='font-size:10.0pt'>NULL</span></span>,\r
-but several UNIX platforms crash if <span class=CodeText><span\r
-style='font-size:10.0pt'>NULL</span></span> is passed to <span class=CodeText><span\r
-style='font-size:10.0pt'>free</span></span>.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975033">14.1.4<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Strict Libraries</a></h3>\r
-\r
-<p class=TextFontCX>Stricter versions of the\r
-libraries are used is the <span class=Flag><span style='font-size:10.0pt'>-ansi-strict</span></span>, <span class=Flag><span style='font-size:10.0pt'>posix-strict-lib</span></span> or <span class=Flag><span style='font-size:10.0pt'>unix-strict-lib</span></span> flag is used. These libraries use a stricter interpretation of the library. \r
-They will detect more errors in some programs, but may to produce many spurious\r
-errors for typical code.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>The differences between the standard libraries and the strict\r
-libraries are:</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>The\r
-standard libraries declare the printing functions (<span class=CodeText><span\r
-style='font-size:10.0pt'>fprintf</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>printf</span></span>, and <span class=CodeText><span\r
-style='font-size:10.0pt'>sprintf</span></span>) that may return error codes to\r
-return <span class=CodeText><span style='font-size:10.0pt'>int</span></span> or\r
-<span class=CodeText><span style='font-size:10.0pt'>void</span></span>.  This\r
-prevents typical programs from leading to deluge of ignored return value errors,\r
-but may mean some relevant errors are not detected.  In the strict library,\r
-they are declared to return <span class=CodeText><span style='font-size:10.0pt'>int</span></span>,\r
-so ignored return value errors will be reported (depending on other flag\r
-settings).  Programs should check that this return value is non-negative. </p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>The\r
-standard libraries declare some parameters and return values to be alternate\r
-types (<span class=CodeText><span style='font-size:10.0pt'>int</span></span> or\r
-<span class=CodeText><span style='font-size:10.0pt'>bool</span></span>, or <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>char</span></span>).  The ISO C99\r
-standard specifies these types as <span class=CodeText><span style='font-size:\r
-10.0pt'>int</span></span> to be compatible with older versions of the library,\r
-but logically they make more sense as <span class=CodeText><span\r
-style='font-size:10.0pt'>bool</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>char</span></span>.  In the strict library, the\r
-stronger type is used.  The parameter to <span class=CodeText><span\r
-style='font-size:10.0pt'>assert</span></span> is <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>bool</span></span> in the standard library, and <span\r
-class=CodeText><span style='font-size:10.0pt'>bool</span></span> in the strict\r
-library.  The parameter to the character functions <span class=CodeText><span\r
-style='font-size:10.0pt'>isalnum</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>isalpha</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>iscntrl</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>isdigit</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>isgraph</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>islower</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>isprint</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>ispunct</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>isspace</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>isupper</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>isxdigit</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>tolower</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>toupper</span></span> is <span class=CodeText><span\r
-style='font-size:10.0pt'>char</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>unsigned char</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span> in the standard library and <span\r
-class=CodeText><span style='font-size:10.0pt'>char</span></span> in the strict\r
-library.  The type of the return value of the character classification\r
-functions (all of the previous character functions except <span class=CodeText><span\r
-style='font-size:10.0pt'>tolower</span></span> and <span class=CodeText><span\r
-style='font-size:10.0pt'>toupper</span></span>) is <span class=CodeText><span\r
-style='font-size:10.0pt'>bool</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span> in the standard library and <span\r
-class=CodeText><span style='font-size:10.0pt'>bool</span></span> in the strict\r
-library.  The type of the first parameter to <span class=CodeText><span\r
-style='font-size:10.0pt'>ungetc</span></span> is <span class=CodeText><span\r
-style='font-size:10.0pt'>char</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span> in the standard library and <span\r
-class=CodeText><span style='font-size:10.0pt'>char</span></span> in the strict\r
-library (<span class=CodeText><span style='font-size:10.0pt'>EOF</span></span>\r
-should not be passed to <span class=CodeText><span style='font-size:10.0pt'>ungetc</span></span>). \r
-The second parameter to <span class=CodeText><span style='font-size:10.0pt'>strchr</span></span> and <span class=CodeText><span style='font-size:10.0pt'>strrchr</span></span> is <span class=CodeText><span style='font-size:10.0pt'>char</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span> in the standard\r
-library and <span class=CodeText><span style='font-size:10.0pt'>char</span></span>\r
-in the strict library.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>The\r
-global variables <span class=CodeText><span style='font-size:10.0pt'>stdin</span></span>, <span class=CodeText><span style='font-size:10.0pt'>stdout</span></span> and <span class=CodeText><span style='font-size:10.0pt'>stderr</span></span> are declared as <span class=CodeText><span style='font-size:10.0pt'>unchecked</span></span>\r
-variables (see Section 7.2) in the standard libraries.  In the strict libraries, they are<span\r
-class=CodeText><span style='font-size:10.0pt'> checked</span></span>.</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>The\r
-global variable <span class=CodeText><span style='font-size:10.0pt'>errno</span></span> is declared <span class=CodeText><span style='font-size:10.0pt'>unchecked</span></span> in the standard libraries, but declared <span class=CodeText><span\r
-style='font-size:10.0pt'>checkedstrict</span></span> in the strict libraries.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>If no library flag is used,\r
-Splint will load the standard library, <span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>standard.lcd</span></span>. \r
-If <span class=Flag><span style='font-size:10.0pt'>+nolib</span></span> is set, no library is loaded.  The library source files can easily be modified, and\r
-new libraries created to better suit a particular application.</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Toc534975034"></a><a\r
-name="_Toc344355447">14.2<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Generating Libraries</a></h2>\r
-\r
-<p class=TextFontCX>To enable running Splint on\r
-large systems, mechanisms are provided for creating libraries containing\r
-necessary information.  This means source files can be checked independently,\r
-after a library has been created. The command line option <span class=Flag><span\r
-style='font-size:10.0pt'>-dump </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>library</i></span></span> stores\r
-information in the file <span class=Keyword><i><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>library</span></i></span> (the default\r
-extension <span class=Keyword><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>.lcd </span></span>is added). Then, <span class=Flag><span\r
-style='font-size:10.0pt'>-load </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>library</i></span></span> loads\r
-the library.  The library contains interface information from the files checked\r
-when the library was created.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975035">14.2.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Generating the\r
-Standard Libraries</a></h3>\r
-\r
-<p class=TextFontCX>The standard libraries are\r
-generated from header files included in the Splint distribution.  Some\r
-libraries are generated from more than one header file.  Since the POSIX\r
-library subsumes the standard library, the headers for the standard and POSIX\r
-libraries are combined to produce the POSIX library.  Similarly, the UNIX library\r
-is composed of the standard, POSIX and UNIX headers.  The header files include\r
-some sections that are conditionally selected by defining <span class=CodeText><span\r
-style='font-size:10.0pt'>STRICT</span></span>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX style='margin-bottom:6.0pt'>The\r
-commands to generate the standard libraries are:</p>\r
-\r
-<p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;\r
-margin-left:.2in;margin-bottom:.0001pt'>splint -nolib ansi.h -dump ansi </p>\r
-\r
-<p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;\r
-margin-left:.2in;margin-bottom:.0001pt'>splint -nolib -DSTRICT ansi.h -dump\r
-ansistrict</p>\r
-\r
-<p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;\r
-margin-left:.2in;margin-bottom:.0001pt'>splint -nolib ansi.h posix.h -dump\r
-posix</p>\r
-\r
-<p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;\r
-margin-left:.2in;margin-bottom:.0001pt'>splint -nolib -DSTRICT ansi.h posix.h\r
--dump posixstrict</p>\r
-\r
-<p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;\r
-margin-left:.2in;margin-bottom:.0001pt'>splint -nolib ansi.h posix.h unix.h\r
--dump unix</p>\r
-\r
-<p class=example style='margin-top:0in;margin-right:.2in;margin-bottom:0in;\r
-margin-left:.2in;margin-bottom:.0001pt'>splint -nolib -DSTRICT ansi.h posix.h\r
-unix.h -dump unixstrict</p>\r
-\r
-<h2 style='margin-left:0in;text-indent:0in'><a name="_Ref534979539"></a><a\r
-name="_Toc534975036"></a><a name="_Ref348080056"></a><a name="_Toc344355448">14.3<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span>Header\r
-File Inclusion</a></h2>\r
-\r
-<p class=TextFontCX>The standard behavior of Splint on encountering </p>\r
-\r
-<p class=example><span class=Keyword><span style='font-size:10.0pt'>#include\r
-&lt;<i>X</i>.h&gt;</span></span></p>\r
-\r
-<p class=TextFontCX>is to search for a file named\r
-<span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>X</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span> on\r
-the include search path (set using <span class=Flag><span style='font-size:\r
-10.0pt'>\96I</span></span>) and then the system base include path (read from the <span\r
-class=CodeText><span style='font-size:10.0pt'>include</span></span> environment\r
-variable if set or using a default value, usually <span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>). \r
-If <span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>X</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span> is\r
-the name of a header file in a loaded standard library and <span class=Keyword><i><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>\r
-is found in a directory that is a system directory (as set by the <span\r
-class=Flag><span style='font-size:10.0pt'>-sysdirs</span></span> flag; the default is <span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>/usr/include</span></span>),\r
-<span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>X</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>\r
-will not be included if <span class=Flag><span style='font-size:10.0pt'>+skip-iso-headers</span></span> or <span\r
-class=Flag><span style='font-size:10.0pt'>+skip-posix-headers</span></span> (depending on whether <span\r
-class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>X</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>\r
-is an ISO or POSIX header file) is on (both are on by default).  To force all\r
-headers to be included normally, use <span class=Flag><span style='font-size:\r
-10.0pt'>&#8209;skip-iso-headers</span></span>.  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Sometimes headers in system\r
-directories contain non-standard syntax that Splint is unable to parse.  The <span\r
-class=Flag><span style='font-size:10.0pt'>+skip-sys-headers</span></span> flag may be used to prevent any include file in a system directory from being included.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint is fast enough that it\r
-can be run on medium-size (10,000 line) programs without performance concerns. \r
-Libraries can be used to enable efficient checking of small modules in large\r
-programs.  To further improve performance, header file inclusion can be\r
-optimized.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>When processing a complete\r
-system in which many files include the same headers, a large fraction of\r
-processing time is wasted re-reading header files unnecessarily.  If you are\r
-checking a 100-file program, and every file includes <span class=Flag><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>utils.h</span></span>,\r
-Splint will have to process <span class=Keyword><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>utils.h</span></span> 100 times (as would\r
-most C compilers).  If the <span class=Flag><span style='font-size:10.0pt'>+single-include</span></span>\r
-flag is used, each header file is processed only once.  Single header file\r
-processing produces a significant efficiency improvement when checking large\r
-programs split into many files, but is only safe if the same header file\r
-included in different contexts always has the same meaning (i.e., it does not\r
-depend on preprocessor variable defined differently at different inclusion\r
-sites).</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>When processing a single file\r
-in a large system, a large fraction of the time is spent processing included\r
-header files.  This can be avoided if the information in the header files is\r
-stored in a library instead.  If <span class=Flag><span style='font-size:10.0pt'>+never-include</span></span>\r
-is set, inclusion of files ending in <span class=Flag><span style='font-size:\r
-10.0pt;font-family:Arial;color:windowtext'>.h</span></span> is prevented. \r
-Files with different suffixes are included normally.  To do this the header\r
-files must not include any expanded macros. That is, the header file must be\r
-processed with <span class=Flag><span style='font-size:10.0pt'>+all-macros</span></span>, and there must be no <span\r
-class=Annot><span style='font-size:10.0pt'>/*@notfunction@*/</span></span> control comments in the header.  Then, the <span\r
-class=Flag><span style='font-size:10.0pt'>+never-include</span></span> flag may\r
-be used to prevent inclusion of header files.  Alternately, non-function macros\r
-can be moved to a different file with a name that does not end in <span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>. \r
-Remember, that this file must be included directly from the <span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>\r
-file, since if it is included from an <span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>\r
-file indirectly, that <span class=Keyword><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>.h</span></span> file is ignored so the\r
-other file is never included.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>These options can be used for\r
-significant performance improvements on large systems.  The performance depends\r
-on how the code is structured, but checking a single module in a large program\r
-is several times faster if libraries and <span class=Flag><span\r
-style='font-size:10.0pt'>+noinclude</span></span> are used.</p>\r
-\r
-<h3 style='margin-left:0in;text-indent:0in'><a name="_Toc534975037">14.3.1<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp; </span>Preprocessing\r
-Constants</a></h3>\r
-\r
-<p class=TextFontCX>Splint defines the\r
-preprocessor constant <span class=CodeText><span style='font-size:10.0pt'>S_SPLINT_S</span></span>\r
-when preprocessing source files.  If you want to include code that is processed\r
-only when Splint is used, surround the code with </p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'><span class=Keyword><span style='font-size:10.0pt'>&nbsp;</span></span></p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'><span class=Keyword><span style='font-size:10.0pt'># ifdef S_SPLINT_S</span></span></p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>     \85 </p>\r
-\r
-<p class=TextFontCX><span class=Keyword><span\r
-style='font-size:10.0pt'># endif</span></span></p>\r
-\r
-<p>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0 align=right>\r
- <tr>\r
-  <td valign=top align=left height=239 style='padding-top:9.35pt;padding-right:\r
-  9.35pt;padding-bottom:9.35pt;padding-left:9.35pt'>\r
-  <p class=IndentText><span style='font-size:9.0pt;font-family:Arial'>From          \r
-       bnelson@netcom.com (Bob Nelson)</span></p>\r
-  <p class=IndentText><span style='font-size:9.0pt;font-family:Arial'>Subject       \r
-      Re: NT vs. Linux</span></p>\r
-  <p class=IndentText><span style='font-size:9.0pt;font-family:Arial'>Date          \r
-        </span><span style='font-size:9.0pt;font-family:Arial'>Fri, 5 Jul 1996</span><span\r
-  style='font-size:9.0pt;font-family:Arial'> </span><span style='font-size:9.0pt;font-family:Arial'>05:11:22 GMT</span></p>\r
-  <p class=IndentText><span style='font-size:9.0pt;font-family:Arial'>Newsgroups  \r
-  comp.os.linux.advocacy,comp.sys.ibm.pc.hardware, </span></p>\r
-  <p class=IndentText style='margin-left:1.0in'><span style='font-size:9.0pt;\r
-  font-family:Arial'>comp.os.ms-windows.win95.misc, comp.os.mswindows.nt.misc,\r
-  alt.flame,alt.fan.bill-gates,alt.destroy.microsoft</span></p>\r
-  <p class=IndentText><i><span style='font-size:9.0pt'>------------------------------------------------------------------------</span></i></p>\r
-  <p class=IndentText><i><span style='font-size:9.0pt'>Toni Anzlovar\r
-  (toni.anzlovar@kiss.uni-lj.si) wrote:</span></i></p>\r
-  <p class=IndentText><i><span style='font-size:9.0pt'>&nbsp;</span></i></p>\r
-  <p class=IndentText><i><span style='font-size:9.0pt'>&gt; Why does everybody\r
-  want to RUN WORD? Why does nobody want to write and edit</span></i></p>\r
-  <p class=IndentText><i><span style='font-size:9.0pt'>&gt; text?</span></i></p>\r
-  <p class=IndentText><i><span style='font-size:9.0pt'>&nbsp;</span></i></p>\r
-  <p class=IndentText><i><span style='font-size:9.0pt'>Simple. A *tremendous*\r
-  number of documents are written using Microsoft Word.  One that is\r
-  particularly ironic is the guide to LCLint -- a very popular lint tool --\r
-  often the lint of choice in the linux world.</span></i></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-</div>\r
-\r
-<span style='font-size:11.0pt;font-family:"Times New Roman"'><br clear=all\r
-style='page-break-before:right'>\r
-</span>\r
-\r
-<div class=Section5>\r
-\r
-<p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975038"></a><a name="_Toc344355451"></a><a name="_Ref343065611">Appendix\r
-A<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Availability</a></p>\r
-\r
-<p class=afterlist>The web home page for Splint is <span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'><a\r
-href="http://www.splint.org/">http://www.splint.org</a></span></span>.  It\r
-includes this guide in HTML format, samples demonstrating Splint, and links to\r
-related web sites.  Splint is available as source code and binary executables\r
-for several platforms.  Splint may be freely distributed and modified under the\r
-GNU General Public License.  The latest development code is available through\r
-SourceForge.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint development is largely\r
-driven by suggestions and comments from users.  We are also very interested in\r
-hearing about your experiences using Splint in developing or maintaining\r
-programs, enforcing coding standards, or teaching courses.  For general\r
-information, suggestions, and questions on Splint send mail to <span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>splint@cs.virginia.edu</span></span>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>To report a bug in Splint send\r
-a message to <span class=Keyword><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>splint-bug@cs.virginia.edu</span></span>.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>There are two mailing lists associated with Splint:</p>\r
-\r
-<p class=URL><span class=Keyword><span style='font-family:Arial;color:windowtext'>splint-announce@virginia.edu</span></span></p>\r
-\r
-<p class=IndentText>Reserved for announcements of new releases and bug fixes. \r
-All users should add themselves to this list.  </p>\r
-\r
-<p class=URL><span class=Keyword><span style='font-family:Arial;color:windowtext'>splint-interest@virginia.edu</span></span></p>\r
-\r
-<p class=IndentText>Informal discussions on the use and development of Splint. \r
-</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX><a name="_Ref344882161"></a><a\r
-name="_Ref344871249"></a><a name="_Ref344870532"></a><a name="_Ref344870294">To\r
-subscribe to a mailing list, send a message to </a><span class=PlainText><span\r
-style='font-size:10.0pt;font-family:Arial'>majordomo@virginia.edu</span></span>\r
-containing the body</p>\r
-\r
-<p class=URL><span class=Keyword><span style='font-family:Arial;color:windowtext'>subscribe\r
-splint-announce</span></span><span class=Keyword><span style='font-size:11.0pt;\r
-font-family:"Times New Roman";color:windowtext'> </span></span><span\r
-style='font-size:11.0pt;font-family:"Times New Roman"'>or</span> <span\r
-class=Keyword><span style='font-family:Arial;color:windowtext'>subscribe\r
-splint-interest</span></span><a name="_Ref348343340"></a><a name="_Ref348330382">.</a></p>\r
-\r
-<p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975039"></a><a name="_Ref397875360">Appendix B<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Flags</a><a name="_Toc344355437"></a></p>\r
-\r
-<p class=beforelist>There are four different types of flags: </p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Global\r
-flags for controlling initializations and global behavior</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Message\r
-format flags for controlling how messages are displayed</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Mode\r
-selectors for coarse control of Splint checking</p>\r
-\r
-<p class=MsoListBullet><span style='font-family:Symbol'>·<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </span></span>Checking\r
-flags that control checking and what classes of messages are reported.</p>\r
-\r
-<p class=afterlist>Global flags can be used in initialization files and at the\r
-command line; all other flags may also be used in control comments.</p>\r
-\r
-<p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975040">Global Flags</a></p>\r
-\r
-<p class=TextFontCX>Global flags can be set at\r
-the command line or in an options file, but cannot be set locally using stylized\r
-comments.  These flags control on-line help, initialization files,\r
-pre-processor flags, libraries and output. </p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975041">Help</a></p>\r
-\r
-<p class=beforelist>On-line help provides documentation on Splint operation and\r
-flags.  When a help flag is used, no checking is done by Splint.  Help flags\r
-may be preceded by <span class=Flag><span style='font-size:10.0pt'>-</span></span>\r
-or <span class=Flag><span style='font-size:10.0pt'>+</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>help</span></span></p>\r
-\r
-<p class=IndentText>Display general help overview, including list of additional\r
-help topics.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>help </span></span><span\r
-class=Flag><span style='font-size:10.0pt'>&lt;topic&gt;</span></span></p>\r
-\r
-<p class=indentbefore>Display help on <i>&lt;topic&gt;</i>. Available topics:</p>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
- style='width:400.5pt;margin-left:27.9pt;border-collapse:collapse'>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX style='text-indent:5.4pt'><span\r
-  class=Flag><span style='font-size:10.0pt'>annotations</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>describe annotations</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>comments</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>describe control comments</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>flags </span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>describe flag categories</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>flags <i>&lt;category&gt;</i></span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>all flags pertaining to &lt;category&gt; (one of the\r
-  categories listed by <span class=Flag><span style='font-size:10.0pt'>splint\r
-  -help flags</span></span>)</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>flags alpha</span></span>         </p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>all flags in alphabetical order</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>flags full</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>print a full description of all flags</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>mail</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>print information on mailing lists</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>modes</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>flags settings in modes</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>prefixcodes</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>character codes for setting namespace prefixes</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>references</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>print references to relevant papers and web sites</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>vars</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>describe environment variables</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:144.65pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>version</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:255.85pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>print maintainer and version information</p>\r
-  <p class=TextFontCX align=left\r
-  style='text-align:left'>&nbsp;</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<p class=afterlist><span class=Flag><span style='font-size:10.0pt'>help </span></span><span\r
-class=Flag><span style='font-size:10.0pt'>&lt;flag&gt;</span></span></p>\r
-\r
-<p class=IndentText>Describe flag <i>&lt;flag&gt;</i>.  (May list several\r
-flags.)</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>warn-flags</span></span></p>\r
-\r
-<p class=IndentText>Display a warning when a flag is set in a surprising way. \r
-An error is reported if an obsolete flag is set, a flag is set to its current\r
-value (i.e., the <span class=Flag><span style='font-size:10.0pt'>+</span></span>\r
-or <span class=Flag><span style='font-size:10.0pt'>-</span></span> may be\r
-wrong), or a mode selector flag is set after mode checking flags that will be\r
-reset by the mode were set.  By default, <span class=Flag><span\r
-style='font-size:10.0pt'>+warn-flags</span></span> is on.  To suppress flag\r
-warnings, use <span class=Flag><span style='font-size:10.0pt'>&#8209;warn-flags</span></span>.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975042">Initialization</a></p>\r
-\r
-<p class=beforelist>These flags control directories and files used by Splint.  They may be used from the command line or in an options file, but may not be used as control comments in the source code.  Except where noted. they have the same meaning\r
-preceded by <span class=Flag><span style='font-size:10.0pt'>-</span></span> or <span\r
-class=Flag><span style='font-size:10.0pt'>+</span></span>.  </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>tmpdir </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;directory&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set directory for writing temp files.  Default is <span\r
-class=ProgramNameChar><span style='font-size:10.0pt'>/tmp/</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>I<i>&lt;directory&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Add directory to path searched for C include files.  Note\r
-there is no space after the <span class=Flag><span style='font-size:10.0pt'>I</span></span>,\r
-to be consistent with C preprocessor flags.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>S<i>&lt;directory&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Add directory to path search for <span\r
-class=ProgramNameChar><span style='font-size:10.0pt'>.lcl</span></span>\r
-specification files.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>larchpath </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;path&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set path to search for library files.  Overrides <span\r
-class=CodeText><span style='font-size:10.0pt'>LARCH_PATH</span></span> environment variable.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>lclimportdir </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;directory&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set directory to search for LCL import files.  Overrides<span\r
-class=Keyword><span style='font-size:10.0pt'> </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>LCLIMPORTDIR</span></span>\r
-environment variable.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>f </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>\r
-\r
-<p class=MsoNormal style='margin-left:13.5pt'>Load options from <span\r
-class=Flag><i><span style='font-size:10.0pt'>&lt;file&gt;</span></i></span>. \r
-If this flag is used from the command line, the default <span\r
-class=FileNameChar><span style='font-size:10.0pt'>~/.splintrc</span></span> file is not loaded.  This flag may be used in an options file to include another options file.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>nof</span></span></p>\r
-\r
-<p class=IndentText>Prevents the default options files (<span\r
-class=FileNameChar><span style='font-size:10.0pt'>./.splintrc</span></span><span\r
-class=ProgramNameChar><span style='font-size:10.0pt'> </span></span>and <span\r
-class=FileNameChar><span style='font-size:10.0pt'>~/.splintrc</span></span>)\r
-from being loaded.  (Setting <span class=Flag><span style='font-size:10.0pt'>-nof</span></span>\r
-overrides <span class=Flag><span style='font-size:10.0pt'>+nof</span></span>,\r
-causing the options files to be loaded normally.)</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sys-dirs</span></span></p>\r
-\r
-<p class=IndentText>Set directories for system files (default is <span\r
-class=FileNameChar><span style='font-size:10.0pt'>/usr/include</span></span>). \r
-Separate directories with the path separator for your operating system (e.g., semi-colons\r
-for Windows or colons for Unix: <span class=FileNameChar><span\r
-style='font-size:10.0pt'>/usr/include:/usr/local/lib</span></span>).  Flag\r
-settings propagate to files in a system directory.  If <span class=Flag><span\r
-style='font-size:10.0pt'>-sys-dir-errors</span></span> is set, no errors are reported for files in system directories.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975043"></a><a name="_Ref345883190">Pre-processor</a></p>\r
-\r
-<p class=beforelist>These flags are used to define or undefine pre-processor constants.  The <span\r
-class=Flag><span style='font-size:10.0pt'>-I<i>&lt;directory&gt;</i></span></span>\r
-flag is also passed to the C pre-processor.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>D&lt;initializer&gt;</span></span></p>\r
-\r
-<p class=IndentText>Passed to the C pre-processor.</p>\r
-\r
-<p class=FileName0 style='margin-left:0in'><span class=Flag>U&lt;initializer&gt;</span></p>\r
-\r
-<p class=IndentText>Passed to the C pre-processor.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975044">Libraries</a></p>\r
-\r
-<p class=beforelist>These flags control the creation and use of libraries.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>dump </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;file&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Save state in <span class=Flag><i><span style='font-size:\r
-10.0pt'>&lt;file&gt;</span></i></span> for loading.  The default extension <span\r
-class=ProgramNameChar><span style='font-size:10.0pt'>.lcd</span></span> is\r
-added if <span class=Flag><i><span style='font-size:10.0pt'>&lt;file&gt;</span></i></span>\r
-has no extension.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>load</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;file&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Load state from <span class=Flag><i><span style='font-size:\r
-10.0pt'>&lt;file&gt;</span></i></span> (created by <span class=Flag><span\r
-style='font-size:10.0pt'>-dump</span></span>).  The default extension <span\r
-class=FileNameChar><span style='font-size:10.0pt'>.lcd</span></span> is added\r
-if <span class=Flag><i><span style='font-size:10.0pt'>&lt;file&gt;</span></i></span>\r
-has no extension.  Only one library file may be loaded.</p>\r
-\r
-<p class=betweenlists>By default, the standard library is loaded if the <span\r
-class=Flag><span style='font-size:10.0pt'>-load</span></span> flag is not used to load a user library.  If no user library is loaded, one of the\r
-following flags may be used to select a different standard library.  Precede\r
-the flag by <span class=Flag><span style='font-size:10.0pt'>+</span></span> to\r
-load the described library (or to prevent a library from being loaded using <span\r
-class=Flag><span style='font-size:10.0pt'>no-lib</span></span>). See Section 14.1 for information on the provided libraries.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>no-lib</span></span></p>\r
-\r
-<p class=IndentText>Do not load any library.  This prevents the standard\r
-library from being loaded. </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ansi-lib</span></span></p>\r
-\r
-<p class=IndentText>Use the ANSI standard library (selected by default). </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>strict-lib</span></span></p>\r
-\r
-<p class=IndentText>Use strict version of the ANSI standard library.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>posix-lib</span></span></p>\r
-\r
-<p class=IndentText>Use the POSIX standard library. </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>posix-strict-lib</span></span></p>\r
-\r
-<p class=IndentText>Use the strict version of the POSIX standard library. </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unix-lib</span></span></p>\r
-\r
-<p class=IndentText>Use UNIX version of standard library. </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unix-strict-lib</span></span></p>\r
-\r
-<p class=IndentText>Use the strict version of the UNIX standard library. </p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>which-lib</span></span></p>\r
-\r
-<p class=IndentText>Print out the standard library filename and creation\r
-information.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975045">Output</a></p>\r
-\r
-<p class=beforelist>These flags control what additional information Splint\r
-prints.  Setting <span class=Flag><span style='font-size:10.0pt'>+<i>&lt;flag&gt;</i></span></span>\r
-causes the described information to be printed; setting <span class=Flag><span\r
-style='font-size:10.0pt'>-<i>&lt;flag&gt;</i></span></span> prevents it.  By\r
-default, all these flags are off.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>use-stderr</span></span></p>\r
-\r
-<p class=IndentText>Send error messages to standard error (instead of standard\r
-output).</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>show-summary</span></span></p>\r
-\r
-<p class=IndentText>Show a summary of all errors reported and suppressed. \r
-Counts of suppressed errors are not necessarily correct since turning a flag\r
-off may prevent some checking from being done to save computation, and errors\r
-that are not reported may propagate differently from when they are reported.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>show-scan</span></span></p>\r
-\r
-<p class=IndentText>Show file names are they are processed.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>show-all-uses</span></span></p>\r
-\r
-<p class=IndentText>Show list of uses of all external identifiers sorted by\r
-number of uses.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>stats</span></span></p>\r
-\r
-<p class=IndentText>Display number of lines processed and checking time.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>time-dist</span></span></p>\r
-\r
-<p class=IndentText>Display distribution of where checking time is spent.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>quiet</span></span></p>\r
-\r
-<p class=IndentText>Suppress herald and error count.  (If <span class=Flag><span\r
-style='font-size:10.0pt'>quiet</span></span> is not set, Splint prints out a\r
-herald with version information before checking begins, and a line summarizing\r
-the total number of errors reported.)</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>which-lib</span></span></p>\r
-\r
-<p class=IndentText>Print out the standard library filename and creation\r
-information.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>limit </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>At most <span class=Flag><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>\r
-similar errors are reported consecutively.  Further errors are suppressed, and\r
-a message showing the number of suppressed messages is printed.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975046">Expected Errors</a></p>\r
-\r
-<p class=beforelist>Normally, Splint will expect to report no errors.  The exit\r
-status will be success (<span class=Keyword><span style='font-size:10.0pt'>0</span></span>)\r
-if no errors are reported, and failure if any errors are reported.  Flags can\r
-be used to set the expected number of reported errors.  Because of the provided\r
-error suppression mechanisms, these options should probably not be used for\r
-final checking real programs but may be useful in developing programs using\r
-make.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>expect </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Exactly <span class=Flag><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>\r
-code errors are expected.  Splint will exit with failure exit status unless <span\r
-class=Flag><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>\r
-code errors are detected. </p>\r
-\r
-<p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975047">Message Format</a></p>\r
-\r
-<p class=beforelist>These flags control how messages are printed.  They may be\r
-set at the command line, in options files, or locally in syntactic comments. \r
-The <span class=Flag><span style='font-size:10.0pt'>line-len</span></span> and <span class=Flag><span style='font-size:10.0pt'>limit</span></span> flags may be preceded by <span class=Flag><span style='font-size:10.0pt'>+</span></span>\r
-or <span class=Flag><span style='font-size:10.0pt'>-</span></span> with the\r
-same meaning; for the other flags, <span class=Flag><span style='font-size:\r
-10.0pt'>+</span></span> turns on the describe printing and <span class=Flag><span\r
-style='font-size:10.0pt'>-</span></span> turns it off.  The box to the left of\r
-each flag gives its default value.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span class=Flag><span\r
-  style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>show-column</span></span></p>\r
-\r
-<p class=IndentText>Show column number where error is found.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span class=Flag><span\r
-  style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>show-func</span></span></p>\r
-\r
-<p class=IndentText>Show name of function (or macro) definition containing\r
-error.  The function name is printed once before the first message detected in\r
-that function.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span class=Flag><span\r
-  style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>show-all-conjs</span></span></p>\r
-\r
-<p class=IndentText>Show all possible alternate types (see Section 4.4).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span class=Flag><span\r
-  style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>paren-file-format</span></span></p>\r
-\r
-<p class=IndentText>Use <span class=Flag><i><span style='font-size:10.0pt'>&lt;file&gt;</span></i></span><span\r
-class=CodeText><span style='font-size:10.0pt'>(</span></span><span class=Flag><i><span\r
-style='font-size:10.0pt'>&lt;line&gt;</span></i></span><span class=CodeText><span\r
-style='font-size:10.0pt'>)</span></span> format in messages.  (Default is + for\r
-Win32 for compatibility with Microsoft VisualStudio.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span class=Flag><span\r
-  style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>hints</span></span></p>\r
-\r
-<p class=IndentText>Provide hints describing an error and how a message may be\r
-suppressed for the first error reported in each error class. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span class=Flag><span\r
-  style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>force-hints</span></span></p>\r
-\r
-<p class=IndentText>Provide hints for all errors reported, even if the hint has\r
-already been displayed for the same error class.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span class=Flag><span\r
-  style='font-size:10.0pt'>80</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>line-len </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set length of maximum message line to <span class=Flag><i><span\r
-style='font-size:10.0pt'>&lt;number&gt;</span></i></span> characters.  Splint\r
-will split messages longer than <span class=Flag><i><span style='font-size:\r
-10.0pt'>&lt;number&gt;</span></i></span> characters long into multiple lines.</p>\r
-\r
-<p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975048">Mode Selector Flags</a></p>\r
-\r
-<p class=TextFontCX>Mode selects flags set the\r
-mode checking flags to predefined values.  They provide a quick coarse-grain\r
-way of controlling what classes of errors are reported. Specific checking flags\r
-may be set after a mode flag to override the mode settings.  Mode flags may be\r
-used locally, however the mode settings will override specific command line\r
-flag settings.  A warning is produced if a mode flag is used after a mode\r
-checking flag has been set. </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>These are brief descriptions to give a general idea of what\r
-each mode does.  To see the complete flag settings in each mode, use <span\r
-class=Flag><span style='font-size:10.0pt'>splint -help modes</span></span>. A\r
-mode flag has the same effect when used with either <span class=Flag><span\r
-style='font-size:10.0pt'>+</span></span> or <span class=Flag><span\r
-style='font-size:10.0pt'>-</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>weak</span></span></p>\r
-\r
-<p class=IndentText>Weak checking, intended for typical unannotated C code.  No\r
-modifies checking, macro checking, rep exposure, or clean interface checking is\r
-done.  Return values of type <span class=CodeText><span style='font-size:10.0pt'>int</span></span>\r
-may be ignored.  The types <span class=CodeText><span style='font-size:10.0pt'>bool</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>int</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>char</span></span> and\r
-user-defined <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>\r
-types are all equivalent.  Old style declarations are unreported. </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>standard</span></span></p>\r
-\r
-<p class=IndentText>The default mode.  All checking done by <span class=Flag><span\r
-style='font-size:10.0pt'>weak</span></span>, plus modifies checking, global,\r
-alias checking, use all parameters, using released storage, ignored return\r
-values or any type, macro checking, unreachable code, infinite loops, and fall\r
-through cases.  The types <span class=CodeText><span style='font-size:10.0pt'>bool</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>int</span></span> and <span\r
-class=CodeText><span style='font-size:10.0pt'>char</span></span> are distinct. \r
-Old style declarations are reported.</p>\r
-\r
-<p class=TextFontCX> <span class=Flag><span\r
-style='font-size:10.0pt'>checks</span></span></p>\r
-\r
-<p class=IndentText>Moderately strict checking.  All checking done by <span\r
-class=Flag><span style='font-size:10.0pt'>standard</span></span>, plus must\r
-modification checking, rep exposure, return alias, memory management and\r
-complete interfaces.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>strict</span></span></p>\r
-\r
-<p class=IndentText>Absurdly strict checking.  All checking done by <span\r
-class=Flag><span style='font-size:10.0pt'>checks</span></span>, plus\r
-modifications and global variables used in unspecified functions, strict\r
-standard library, and strict typing of C operators. A special reward will be presented to the first person to produce a real program that produces no\r
-errors with <span class=Flag><span style='font-size:10.0pt'>strict </span></span>checking.</p>\r
-\r
-<p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a\r
-name="_Ref344798116"></a><a name="_Toc534975049">Checking Flags</a></p>\r
-\r
-<p class=TextFontCX>These flags control checking\r
-done by Splint.  They may be set locally using syntactic comments, from the\r
-command line, or in an options file.  Some flags directly control whether a\r
-certain class of message is reported.  Preceding the flag by <span class=Flag><span\r
-style='font-size:10.0pt'>+</span></span> turns reporting on, and preceding the\r
-flag by <span class=Flag><span style='font-size:10.0pt'>-</span></span> turns\r
-reporting off.  Other flags control checking less directly by determining\r
-default values (what annotations are implicit), making types equivalent (to\r
-prevent certain type errors), controlling representation access, etc.  For\r
-these flags, the effect of <span class=Flag><span style='font-size:10.0pt'>+</span></span>\r
-is described, and the effect of <span class=Flag><span style='font-size:10.0pt'>-</span></span>\r
-is the opposite (or explicitly explained if there is no clear opposite).  The\r
-organization of this section mirrors Sections 2-14.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975050">Key</a></p>\r
-\r
-<p class=beforelist>To the left of each flag name is a flag descriptor encoding\r
-what kind of flag it is and its default value.  The descriptions are:</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Flag><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX>A <i>plain</i> flag.  The\r
-value after the colon gives the default setting (e.g., this flag is off.)  </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Flag><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX>A <i>mode checking flag</i>. \r
-The value of the flag is set by the mode selector.  The four signs give the\r
-setting in the weak, standard, checks and strict modes. (e.g., this flag is off\r
-in the weak and standard modes, and on in the checks and strict modes.) </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX>A <i>shortcut</i> flag.  This\r
-flag sets other flags, so it has no default value.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975051"></a><a name="_Toc534975056">Null Dereferences </a><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 2)</span></span> </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>null</span></span></p>\r
-\r
-<p class=IndentText>A possibly null pointer may be dereferenced, or used\r
-somewhere a non-null pointer is expected.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975055">Use Before Definition </a><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 3)</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>use-def</span></span></p>\r
-\r
-<p class=IndentText>The value of a location that may not be initialized on some\r
-execution path is used.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-outs</span></span></p>\r
-\r
-<p class=IndentText>Allow unannotated pointer parameters to functions to be\r
-implicit out parameters.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>comp-def</span></span></p>\r
-\r
-<p class=IndentText>Storage derivable from a parameter, return value or global\r
-variable is not completely defined.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>union-def</span></span></p>\r
-\r
-<p class=IndentText>No field of a union is defined.  (No error is reported if\r
-at least one union field is defined.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>must-define</span></span></p>\r
-\r
-<p class=IndentText>Parameter declared with <span class=Keyword><span\r
-style='font-size:10.0pt'>out</span></span> is not defined before return or\r
-scope exit.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'>Types <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section </span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>4</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>)</span></span></p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>type</span></span></p>\r
-\r
-<p class=IndentText>Type mismatch.</p>\r
-\r
-<p class=Heading10>Boolean Types <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>4.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span></p>\r
-\r
-<p class=TextFontCX>These flags control the type\r
-name used to represent Booleans, and whether the Boolean type is abstract.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>bool</span></span></p>\r
-\r
-<p class=IndentText>Boolean type is an abstract type.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Flag><span style='font-size:10.0pt'>bool</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>booltype </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;name&gt;</i></span></span> </p>\r
-\r
-<p class=IndentText>Set name of Boolean type to <i>&lt;name&gt;</i>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:</span><span\r
-  class=Flag><span style='font-size:10.0pt'>FALSE</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>boolfalse </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;name&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set name of Boolean false to <i>&lt;name&gt;</i>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Flag><span style='font-size:10.0pt'>TRUE</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>booltrue </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;name&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set name of Boolean true to <i>&lt;name&gt;</i>.</p>\r
-\r
-<p class=Heading10><a name="_Ref344871224">Predicates</a></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>pred-bool-ptr</span></span></p>\r
-\r
-<p class=IndentText>Type of condition test is a pointer.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>pred-bool-int</span></span></p>\r
-\r
-<p class=IndentText>Type of condition test is an integral type.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>pred-bool-others</span></span></p>\r
-\r
-<p class=IndentText>Type of condition test is not a Boolean, pointer or integral\r
-type.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>pred-bool</span></span></p>\r
-\r
-<p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>predboolint</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>predboolptr</span></span> and <span class=Flag><span style='font-size:10.0pt'>preboolothers</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>pred-assign</span></span></p>\r
-\r
-<p class=IndentText>The condition test is an assignment expression. If an\r
-assignment is intended, add an extra parentheses nesting (e.g., <span\r
-class=CodeText><span style='font-size:10.0pt'>if ((a = b))</span></span> ...).</p>\r
-\r
-<p class=Heading10>Primitive Operations</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>ptr-arith</span></span></p>\r
-\r
-<p class=IndentText>Arithmetic involving pointer and integer.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++--</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ptr-negate</span></span></p>\r
-\r
-<p class=IndentText>Allow the operand of the <span class=CodeText><span\r
-style='font-size:10.0pt'>!</span></span> operator to be a pointer.<span\r
-class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>bitwise-signed</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=IndentText>An operand to a bitwise operator is not an unsigned value.\r
-This may have unexpected results depending on the signed representations.<span\r
-class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>shift-signed</span></span></p>\r
-\r
-<p class=IndentText>The left operand to a shift operator is not an unsigned\r
-value.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>strict-ops</span></span></p>\r
-\r
-<p class=IndentText>Primitive operation does not type check strictly.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sizeof-type</span></span></p>\r
-\r
-<p class=IndentText>Operand of <span\r
-class=CodeText><span style='font-size:10.0pt'>sizeof</span></span> operator is\r
-a type.  (Safer to use <span class=CodeText><span style='font-size:10.0pt'>int\r
-*x = sizeof (*x);</span></span> instead of <span class=CodeText><span\r
-style='font-size:10.0pt'>sizeof (int)</span></span>.)</p>\r
-\r
-<p class=Heading10>Array Formal Parameters</p>\r
-\r
-<p class=TextFontCX>These flags control reporting\r
-of common errors caused by confusion about the semantics of array formal\r
-parameters.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sizeof-formal-array</span></span></p>\r
-\r
-<p class=IndentText>The <span class=CodeText><span style='font-size:10.0pt'>sizeof</span></span>\r
-operator is used on a parameter declared as an array.  (In many instances this\r
-has unexpected behavior, since the result is the size of a pointer to the\r
-element type, not the number of elements in the array.) </p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>fixed-formal-array</span></span></p>\r
-\r
-<p class=IndentText>An array formal parameter is declared with a fixed size\r
-(e.g., <span class=CodeText><span style='font-size:10.0pt'>int x[20]</span></span>). \r
-This is likely to be confusing, since the size is ignored.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>formal-array</span></span></p>\r
-\r
-<p class=IndentText>A formal parameter is declared as an array.  This is\r
-probably not a problem, but can be confusing since it is treated as a pointer. \r
-</p>\r
-\r
-<p class=Heading10>Format Codes</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>format-code</span></span></p>\r
-\r
-<p class=IndentText>Invalid format code in format string for <span class=Annot><span\r
-style='font-size:10.0pt'>printflike</span></span> or <span class=Annot><span\r
-style='font-size:10.0pt'>scanflike</span></span> function.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>format-type</span></span></p>\r
-\r
-<p class=IndentText>Type-mismatch in parameter corresponding to format code in\r
-a <span class=Annot><span style='font-size:10.0pt'>printflike</span></span> or <span\r
-class=Annot><span style='font-size:10.0pt'>scanflike</span></span> function.</p>\r
-\r
-<p class=Heading10>Main</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>main-type</span></span></p>\r
-\r
-<p class=IndentText>Type of <span class=CodeText><span style='font-size:10.0pt'>main</span></span>\r
-does not match expected type (function returning an <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span>, taking no parameters or two\r
-parameters of type <span class=CodeText><span style='font-size:10.0pt'>int</span></span>\r
-and <span class=CodeText><span style='font-size:10.0pt'>char **</span></span>.)</p>\r
-\r
-<p class=Heading10>Comparisons</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><a name=boolcompare></a><a\r
-  name=boolprose><span style='font-size:10.0pt'>m:</span></a><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>bool-compare</span></span></p>\r
-\r
-<p class=IndentText>Comparison between Boolean values.  This is dangerous since\r
-there may be multiple true values as any non-zero value is interpreted as true.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>real-compare</span></span></p>\r
-\r
-<p class=IndentText>Comparison involving <span class=CodeText><span\r
-style='font-size:10.0pt'>float</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>double</span></span> values.  This is dangerous since\r
-it may produce unexpected results because floating point representations are\r
-inexact.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ptr-compare</span></span></p>\r
-\r
-<p class=IndentText>Comparison between pointer and number.</p>\r
-\r
-<p class=Heading10>Type Equivalence</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><a name=globs></a><span\r
-  style='font-size:10.0pt'>m:</span><span class=Keyword><span style='font-size:\r
-  10.0pt'>+---</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>void-abstract</span></span></p>\r
-\r
-<p class=IndentText>Allow <span class=CodeText><span style='font-size:10.0pt'>void\r
-*</span></span> to match pointers to abstract types.  (Casting a pointer to an abstract type to a pointer to <span class=CodeText><span\r
-style='font-size:10.0pt'>void</span></span> is okay if <span class=Flag><span\r
-style='font-size:10.0pt'>+void-abstract</span></span> is set.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  +</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>cast-fcn-ptr</span></span></p>\r
-\r
-<p class=IndentText> A pointer to a function is cast to (or used as) a pointer\r
-to void (or vice versa).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>forward-decl</span></span></p>\r
-\r
-<p class=IndentText>Forward declarations of pointers to abstract representation\r
-match abstract type.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-type </span></span></p>\r
-\r
-<p class=IndentText>A variable declaration has no explicit type.  The type is\r
-implicitly int.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>incomplete-type </span></span></p>\r
-\r
-<p class=IndentText>A formal parameter is declared with an incomplete type\r
-(e.g., <span class=Keyword><span style='font-size:10.0pt'>int[][]</span></span>).\r
-</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>char-index</span></span></p>\r
-\r
-<p class=IndentText>Allow <span class=CodeText><span style='font-size:10.0pt'>char</span></span>\r
-to index arrays.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>enum-index</span></span></p>\r
-\r
-<p class=IndentText>Allow members of <span class=CodeText><span\r
-style='font-size:10.0pt'>enum</span></span><span class=Keyword><span\r
-style='font-size:10.0pt'> </span></span>type to index arrays.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>bool-int</span></span></p>\r
-\r
-<p class=IndentText>Make <span class=CodeText><span style='font-size:10.0pt'>bool</span></span>\r
-and <span class=CodeText><span style='font-size:10.0pt'>int</span></span> are\r
-equivalent.  (No type errors are reported when a Boolean is used where an\r
-integral type is expected and vice versa.) </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>char-int</span></span></p>\r
-\r
-<p class=IndentText>Make <span class=CodeText><span style='font-size:10.0pt'>char</span></span>\r
-and <span class=CodeText><span style='font-size:10.0pt'>int</span></span> types\r
-equivalent</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++--</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>enum-int</span></span></p>\r
-\r
-<p class=IndentText>Make <span class=CodeText><span style='font-size:10.0pt'>enum</span></span>\r
-and <span class=CodeText><span style='font-size:10.0pt'>int</span></span> types\r
-equivalent </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>float-double </span></span></p>\r
-\r
-<p class=IndentText>Make <span class=CodeText><span style='font-size:10.0pt'>float</span></span>\r
-and <span class=CodeText><span style='font-size:10.0pt'>double</span></span>\r
-types equivalent</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ignore-quals</span></span></p>\r
-\r
-<p class=IndentText>Ignore type qualifiers (<span class=CodeText><span\r
-style='font-size:10.0pt'>long</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>short</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>unsigned</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++--</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>relax-quals</span></span></p>\r
-\r
-<p class=IndentText>Report qualifier mismatches only if dangerous (information\r
-may be lost since a larger type is assigned to (or passed as) a smaller one or\r
-a comparison uses <span class=CodeText><span style='font-size:10.0pt'>signed</span></span>\r
-and <span class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>\r
-values.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ignore-signs</span></span></p>\r
-\r
-<p class=IndentText>Ignore signs in type comparisons (<span class=CodeText><span\r
-style='font-size:10.0pt'>unsigned</span></span> matches <span class=CodeText><span\r
-style='font-size:10.0pt'>signed</span></span>).</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>long-integral</span></span></p>\r
-\r
-<p class=IndentText>Allow long type to match an arbitrary integral type (e.g., <span\r
-class=CodeText><span style='font-size:10.0pt'>dev_t</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>long-unsigned-integral</span></span></p>\r
-\r
-<p class=IndentText>Allow unsigned long type to match an arbitrary integral\r
-type (e.g., <span class=CodeText><span style='font-size:10.0pt'>dev_t</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>match-any-integral</span></span></p>\r
-\r
-<p class=IndentText>Allow any integral type to match an arbitrary </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>long-unsigned-unsigned-integral</span></span></p>\r
-\r
-<p class=IndentText>Allow unsigned long type to match an arbitrary unsigned\r
-integral type (e.g., <span class=CodeText><span style='font-size:10.0pt'>size_t</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>+---</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>long-signed-integral</span></span></p>\r
-\r
-<p class=IndentText>Allow long type to match an arbitrary signed integral type\r
-(e.g., <span class=CodeText><span style='font-size:10.0pt'>ssize_t</span></span>).</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>&nbsp;</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>num-literal</span></span></p>\r
-\r
-<p class=IndentText>Integer literals can be used as floats. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>char-int-literal</span></span></p>\r
-\r
-<p class=IndentText>A character constant may be used as an <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span>. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>zero-ptr</span></span></p>\r
-\r
-<p class=IndentText>Literal <span class=CodeText><span style='font-size:10.0pt'>0</span></span>\r
-may be used as a pointer.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>relax-types</span></span></p>\r
-\r
-<p class=IndentText>Allow all numeric types to match.</p>\r
-\r
-<p class=Heading10><a name="_Toc534975052">Abstract Types </a><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section </span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>4.3</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>abstract</span></span></p>\r
-\r
-<p class=IndentText>A data abstraction barrier is violated</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Flag><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>imp-abstract</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>abstract</span></span>\r
-annotation for type declarations that do not use <span class=Annot><span\r
-style='font-size:10.0pt'>concrete</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Flag><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mut-rep</span></span></p>\r
-\r
-<p class=IndentText>Representation of mutable type has sharing semantics.</p>\r
-\r
-<p class=Heading10>Access <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 4.3.1)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  +</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>access-module</span></span></p>\r
-\r
-<p class=IndentText>An abstract type defined in <span class=ProgramNameChar><i>M</i></span><span\r
-class=ProgramNameChar>.h</span> (or specified in <span class=ProgramNameChar><i>M</i></span><span\r
-class=ProgramNameChar>.lcl</span>) is accessible in <span\r
-class=ProgramNameChar><i>M</i></span><span class=ProgramNameChar>.c</span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>access-file</span></span></p>\r
-\r
-<p class=IndentText>An abstract type named <span class=CodeText><i><span\r
-style='font-size:10.0pt'>type</span></i></span> is accessible in files named <span\r
-class=ProgramNameChar><i>type</i></span><span class=ProgramNameChar>.*</span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>access-czech</span></span></p>\r
-\r
-<p class=IndentText>An abstract type named <span class=CodeText><i><span\r
-style='font-size:10.0pt'>type</span></i></span> may be accessible in a function\r
-named <span class=CodeText><i><span style='font-size:10.0pt'>type_name</span></i></span>.\r
-(Section 12.1.1)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>access-slovak</span></span></p>\r
-\r
-<p class=IndentText>An abstract type named <span class=CodeText><i><span\r
-style='font-size:10.0pt'>type</span></i></span> may be accessible in a function\r
-named <span class=CodeText><i><span style='font-size:10.0pt'>typeName</span></i></span>. \r
-(Section.12.1.2)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>access-czechoslovak</span></span></p>\r
-\r
-<p class=IndentText>An abstract type named <span class=CodeText><i><span\r
-style='font-size:10.0pt'>type</span></i></span> may be accessible in a function\r
-named <span class=CodeText><i><span style='font-size:10.0pt'>type_name</span></i></span>\r
-or <span class=CodeText><i><span style='font-size:10.0pt'>typeName</span></i></span>. \r
-(Section 12.1.3)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>access-all</span></span></p>\r
-\r
-<p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>access-module</span></span>,\r
-<span class=Flag><span style='font-size:10.0pt'>access-file</span></span> and <span\r
-class=Flag><span style='font-size:10.0pt'>access-czech</span></span>.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975053">Memory Management</a> <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section </span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>5</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>)</span></span></p>\r
-\r
-<p class=TextFontCX>Reporting of memory\r
-management errors is controlled by flags setting checking and implicit\r
-annotations and code annotations.  </p>\r
-\r
-<p class=Heading10>Deallocation Errors <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 5.2)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>use-released</span></span></p>\r
-\r
-<p class=IndentText>Storage used after it may have been released.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>strict-use-released</span></span></p>\r
-\r
-<p class=IndentText>An array element used after it may have been released.</p>\r
-\r
-<p class=Heading10>Inconsistent Branches</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>branch-state</span></span></p>\r
-\r
-<p class=IndentText>Storage has inconsistent states of alternate paths through\r
-a branch (e.g., it is released in the true branch of an if-statement, but there\r
-is no else branch.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>strict-branch-state</span></span></p>\r
-\r
-<p class=IndentText>Storage through array fetch has inconsistent states of\r
-alternate paths through a branch.  Since array elements are not checked\r
-accurately, this may lead to spurious errors.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>dep-arrays</span></span></p>\r
-\r
-<p class=IndentText>Treat array elements as <span class=Annot><span\r
-style='font-size:10.0pt'>dependent</span></span> storage.  Checking of array\r
-elements cannot be done accurately by Splint.  If <span class=Flag><span\r
-style='font-size:10.0pt'>dep-arrays</span></span> is not set, array elements\r
-are assumed to be independent, so code that releases the same element more than\r
-once will produce no error.  If <span class=Flag><span style='font-size:10.0pt'>dep-arrays</span></span>\r
-is set, array elements are assumed to be dependent, so code that releases the\r
-same element more that once will produce an error, but code that releases\r
-different elements correctly will produce a spurious error.</p>\r
-\r
-<p class=Heading10>Memory Leaks</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>must-free</span></span></p>\r
-\r
-<p class=IndentText>Allocated storage was not released before return or scope\r
-exit.  Errors are reported for <span class=Annot><span style='font-size:10.0pt'>only</span></span>, <span class=Annot><span style='font-size:10.0pt'>fresh</span></span> or <span\r
-class=Annot><span style='font-size:10.0pt'>owned</span></span> storage.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>comp-destroy</span></span></p>\r
-\r
-<p class=IndentText>All only references derivable from <span class=Annot><span\r
-style='font-size:10.0pt'>out only</span></span> parameter of type <span\r
-class=CodeText><span style='font-size:10.0pt'>void *</span></span> must be\r
-released.  (This is the type of the parameter to <span class=CodeText><span\r
-style='font-size:10.0pt'>free</span></span>, but may also be used for user-defined deallocation functions.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>strict-destroy</span></span></p>\r
-\r
-<p class=IndentText>Report complete destruction errors for array elements that\r
-may have been released.  (If <span class=Flag><span style='font-size:10.0pt'>strict-destroy</span></span>\r
-is not set, Splint will assume that if any array element was released, the\r
-entire array was correctly released.)</p>\r
-\r
-<p class=Heading10>Transfer Errors </p>\r
-\r
-<p class=beforelist>A transfer error is reported when storage is transferred\r
-(by an assignment, passing a parameter, or returning) in a way that is\r
-inconsistent. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mem-trans</span></span></p>\r
-\r
-<p class=IndentText>Sets all memory transfer errors flags.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>only-trans</span></span></p>\r
-\r
-<p class=IndentText>Only storage transferred to non-only reference (memory\r
-leak).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ownedtrans</span></span></p>\r
-\r
-<p class=IndentText>Owned storage transferred to non-owned reference (memory leak).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>fresh-trans</span></span></p>\r
-\r
-<p class=IndentText>Newly-allocated storage transferred to non-only reference\r
-(memory leak).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>shared-trans</span></span></p>\r
-\r
-<p class=IndentText>Shared storage transferred to non-shared reference</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>dependent-trans</span></span></p>\r
-\r
-<p class=IndentText>Inconsistent <span class=Annot><span style='font-size:10.0pt'>dependent</span></span> transfer. Dependent storage is transferred to a non-dependent reference.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>temp-trans</span></span></p>\r
-\r
-<p class=IndentText>Temporary storage (associated with a <span class=Annot><span\r
-style='font-size:10.0pt'>temp</span></span> formal parameter) is transferred to a non-temporary reference.  The storage may be released or new aliases\r
-created.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>kept-trans</span></span></p>\r
-\r
-<p class=IndentText>Kept storage (storage what was passed as <span class=Annot><span\r
-style='font-size:10.0pt'>keep</span></span>) transferred to non-temporary\r
-reference. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>keep-trans</span></span></p>\r
-\r
-<p class=IndentText>Keep storage is transferred in a way that may add a new\r
-alias to it, or release it.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>refcount-trans</span></span></p>\r
-\r
-<p class=IndentText>Reference counted storage is transferred in an inconsistent\r
-way.<span style='font-size:10.5pt'> </span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>newref-trans</span></span></p>\r
-\r
-<p class=IndentText>A new reference transferred to a reference counted\r
-reference (reference count is not set correctly).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>immediate-trans</span></span></p>\r
-\r
-<p class=IndentText>An immediate address (result of <span class=CodeText><span\r
-style='font-size:10.0pt'>&amp;</span></span>) is transferred inconsistently.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>static-trans</span></span></p>\r
-\r
-<p class=IndentText>Static storage is transferred in an inconsistent way.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>expose-trans</span></span></p>\r
-\r
-<p class=IndentText>Inconsistent exposure transfer. Exposed storage is\r
-transferred to a non-<span class=Annot><span style='font-size:10.0pt'>exposed</span></span>,\r
-non-<span class=Annot><span style='font-size:10.0pt'>observer</span></span>\r
-reference.<span style='font-size:10.5pt'> </span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>observer-trans</span></span></p>\r
-\r
-<p class=IndentText>Inconsistent <span class=Annot><span style='font-size:10.0pt'>observer</span></span>\r
-transfer. Observer storage is transferred to a non-observer reference.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unqualified-trans</span></span></p>\r
-\r
-<p class=IndentText>Unqualified storage is transferred in an inconsistent way.</p>\r
-\r
-<p class=Heading11>Initializers</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>only-unq-global-trans</span></span></p>\r
-\r
-<p class=IndentText>Only storage transferred to an unqualified global or static\r
-reference. This may lead to a memory leak, since the new reference is not\r
-necessarily released.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>static-init-trans</span></span></p>\r
-\r
-<p class=IndentText>Static storage is used as an initial value in an\r
-inconsistent way.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unqualified-init-trans</span></span></p>\r
-\r
-<p class=IndentText>Unqualified storage is used as an initial value in an\r
-inconsistent way.</p>\r
-\r
-<p class=Heading11>Derived Storage</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>comp-mem-pass</span></span></p>\r
-\r
-<p class=IndentText>Storage derivable from a parameter does not match the alias\r
-kind expected for the formal parameter.</p>\r
-\r
-<p class=Heading11>Stack References</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>stack-ref</span></span></p>\r
-\r
-<p class=IndentText>A stack reference is pointed to by an external reference\r
-when the function returns.  Since the call frame will be destroyed when the\r
-function returns the return value will point to dead storage. (Section 5.2.6)</p>\r
-\r
-<p class=Heading10>Implicit Memory Annotations <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>5.3</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>glob-imp-only</span></span></p>\r
-\r
-<p class=IndentText>Assume unannotated global storage is only.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>param-imp-temp</span></span></p>\r
-\r
-<p class=IndentText>Assume unannotated parameter is <span class=Annot><span\r
-style='font-size:10.0pt'>temp</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ret-imp-only</span></span></p>\r
-\r
-<p class=IndentText>Assume unannotated returned storage is <span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>struct-imp-only</span></span></p>\r
-\r
-<p class=IndentText>Assume unannotated structure or union field is <span\r
-class=Annot><span style='font-size:10.0pt'>only</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>code-imp-only</span></span></p>\r
-\r
-<p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>glob-imp-only</span></span>,\r
-<span class=Flag><span style='font-size:10.0pt'>ret-imp-only</span></span> and <span\r
-class=Flag><span style='font-size:10.0pt'>struct-imp-only</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mem-imp</span></span></p>\r
-\r
-<p class=IndentText>Report memory errors for unqualified storage.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>pass-unknown</span></span></p>\r
-\r
-<p class=IndentText>Passing a value as an unannotated parameter clears its\r
-annotation.  This will prevent many spurious errors from being report for\r
-unannotated programs, but eliminates the possibility of detecting many errors.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975054">Sharing</a> <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 6)</span></span></p>\r
-\r
-<p class=Heading10>Aliasing <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section </span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>6.1</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>) </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>alias-unique</span></span></p>\r
-\r
-<p class=IndentText>An actual parameter that is passed as a <span class=Annot><span\r
-style='font-size:10.0pt'>unique</span></span> formal parameter is aliased by\r
-another parameter or global variable.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>may-alias-unique</span></span></p>\r
-\r
-<p class=IndentText>An actual parameter that is passed as a <span class=Annot><span\r
-style='font-size:10.0pt'>unique</span></span> formal parameter may be aliased\r
-by another parameter or global variable.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>must-not-alias</span></span></p>\r
-\r
-<p class=IndentText>An alias has been added to a <span class=Annot><span\r
-style='font-size:10.0pt'>temp</span></span>-qualifier parameter or global that is visible externally when the function returns.  </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ret-alias</span></span></p>\r
-\r
-<p class=IndentText>A function returns an alias to parameter or global.</p>\r
-\r
-<p class=Heading10>Exposure <span class=HeadingNote><span style='font-size:\r
-10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>6.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span><span class=Flag><span\r
-style='font-size:10.5pt;font-family:"Times New Roman";font-weight:normal'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>rep-expose</span></span></p>\r
-\r
-<p class=IndentText>The internal representation of an abstract type is visible\r
-to the caller.  This means clients may have access to a pointer into the\r
-abstract representation.  (Sets <span class=Flag><span style='font-size:10.0pt'>assign-expose</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>ret-expose</span></span>, and <span\r
-class=Flag><span style='font-size:10.0pt'>cast-expose</span></span>.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>assign-expose</span></span></p>\r
-\r
-<p class=IndentText>Abstract representation is exposed by an assignment or\r
-passed parameter.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>cast-expose</span></span></p>\r
-\r
-<p class=IndentText>Abstract representation is exposed through a cast.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ret-expose</span></span></p>\r
-\r
-<p class=IndentText>Abstract representation is exposed by a return value.</p>\r
-\r
-<p class=Heading11>Observer Modifications</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>mod-observer</span></span></p>\r
-\r
-<p class=IndentText>Possible modification of observer storage.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-observer-uncon</span></span></p>\r
-\r
-<p class=IndentText>Storage declared with observer may be modified through a\r
-call to an unconstrained function.</p>\r
-\r
-<p class=Heading11>String Literals <span\r
-class=TextFontCXChar><span style='font-weight:\r
-normal;font-style:normal'>(Section  6.2.1) </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>read-only-trans</span></span></p>\r
-\r
-<p class=IndentText>Report memory transfer errors for initializations to\r
-read-only string literals </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>read-only-strings</span></span></p>\r
-\r
-<p class=IndentText>String literals are read-only (ISO semantics).  An error is\r
-reported if a string literal may be modified or released.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'>Function\r
-Interfaces <span class=TextFontCXChar><span\r
-style='font-size:11.0pt;font-weight:normal'>(Section </span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>7</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>)</span></span></p>\r
-\r
-<p class=Heading10>Modification <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 7.1)</span></span><span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>modifies</span></span></p>\r
-\r
-<p class=IndentText>Undocumented modification of caller-visible state.  Without\r
-<span class=Flag><span style='font-size:10.0pt'>+moduncon</span></span>, modification errors are only reported in the definitions of functions declared with a modifies clause (or specified).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>must-mod</span></span></p>\r
-\r
-<p class=IndentText>Documented modification is not detected.  An object listed\r
-in the modifies clause for a function, is not modified by the implementation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-uncon</span></span></p>\r
-\r
-<p class=IndentText>Report modification errors in functions declared without a\r
-modifies clause.(Sets <span class=Flag><span style='font-size:10.0pt'>mod-nomods</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>mod-globs-nomods</span></span> and <span class=Flag><span style='font-size:10.0pt'>mod-strict-globs-nomods</span></span>.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-nomods</span></span></p>\r
-\r
-<p class=IndentText>Report modification errors (not involving global variables)\r
-in functions declared without a modifies clause.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-uncon-nomods</span></span></p>\r
-\r
-<p class=IndentText>An unconstrained function is called in a function body\r
-where modifications are checked.  Since the unconstrained function may modify\r
-anything, there may be undetected modifications in the checked function.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-internal-strict</span></span></p>\r
-\r
-<p class=IndentText>A function that modifies <span class=Annot><span\r
-style='font-size:10.0pt'>internalState</span></span> is called from a function that does not list <span\r
-class=Annot><span style='font-size:10.0pt'>internalState</span></span> in its\r
-modifies clause.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-file-sys</span></span></p>\r
-\r
-<p class=IndentText>A function modifies the file system but does not list <span\r
-class=Annot><span style='font-size:10.0pt'>fileSystem</span></span> in its modifies clause.</p>\r
-\r
-<p class=Heading10>Global Variables<i> </i><span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>7.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span><span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=beforelist><a name=globflags></a>Errors involving the use and modification of global and file static variables are reported depending on flag settings, annotations where the global variable is declared, and whether or not the function where the global is used was declared with a globals\r
-clause.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>globs</span></span></p>\r
-\r
-<p class=IndentText>Undocumented use of a checked global variable in a function\r
-with a globals list.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>glob-use</span></span></p>\r
-\r
-<p class=IndentText>A global listed in the globals list is not used in the\r
-implementation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>glob-noglobs</span></span></p>\r
-\r
-<p class=IndentText>Use of a checked global in a function with no globals list.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>internal-globs</span></span></p>\r
-\r
-<p class=IndentText>Undocumented use of internal state (should have <span\r
-class=Annot><span style='font-size:10.0pt'>globals internalState</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>internal-globs-noglobs</span></span></p>\r
-\r
-<p class=TextFontCX>        Use of internal state\r
-in function with no globals list.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>glob-state</span></span></p>\r
-\r
-<p class=IndentText>A function returns with global in inconsistent state (null or undefined)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>all-globs</span></span></p>\r
-\r
-<p class=IndentText>Report use and modification errors for globals not\r
-annotated with <span class=Annot><span style='font-size:10.0pt'>unchecked</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>check-strict-globs</span></span></p>\r
-\r
-<p class=IndentText>Report use and modification errors for <span class=Annot><span\r
-style='font-size:10.0pt'>checkedstrict</span></span> globals.</p>\r
-\r
-<p class=Heading11>Modification of Global Variables</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>mod-globs</span></span></p>\r
-\r
-<p class=IndentText>Undocumented modification of a checked global variable. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-globs-unchecked</span></span></p>\r
-\r
-<p class=IndentText>Undocumented modification of an <span class=Annot><span\r
-style='font-size:10.0pt'>unchecked</span></span> global variable.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-globs-nomods</span></span></p>\r
-\r
-<p class=IndentText>Undocumented modification of a checked global variable in a\r
-function with no modifies clause. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mod-strict-globs-nomods</span></span></p>\r
-\r
-<p class=IndentText>Undocumented modification of a <span class=Annot><span\r
-style='font-size:10.0pt'>checkedstrict</span></span> global variable in a function declared with no modifies clause.</p>\r
-\r
-<p class=Heading11>Globals Lists and Modifies Clauses</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>warn-missing-globs</span></span></p>\r
-\r
-<p class=IndentText>Global variable used in modifies clause is not listed in\r
-globals list.  (The global is added to the globals list.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>warn-missing-globs-noglobs</span></span></p>\r
-\r
-<p class=IndentText>Global variable used in modifies clause of a function with\r
-no globals list.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>globs-imp-mods-nothing</span></span></p>\r
-\r
-<p class=IndentText>A function declared with a globals list but no modifies\r
-clause is assumed to modify nothing.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>mods-imp-noglobs</span></span></p>\r
-\r
-<p class=IndentText>A function declared with a modifies clause but no globals\r
-list is assumed to use no globals.</p>\r
-\r
-<p class=Heading11>Implicit Checking Annotations</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>imp-checked-globs</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span> annotation on global variables with no checking annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checked-statics</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span> qualifier file static scope variables with no checking annotation. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checkmod-globs</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checkmod</span></span>\r
-qualifier on global variables with no checking annotation.</p>\r
-\r
-<p class=IndentText><span class=Flag><span style='font-size:10.0pt'>&nbsp;</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checkmod-statics</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checkmod</span></span>\r
-qualifier file static scope variables with no checking annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checkedstrict-globs</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span>\r
-qualifier on global variables with no checking annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checkedstrict-statics</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span>\r
-qualifier file static scope variables with no checking annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checkmod-internals</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checkmod</span></span>\r
-qualifier on function scope static variables with no checking annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=IndentText style='margin-left:0in'><span class=Keyword><span\r
-style='font-size:10.0pt'>&nbsp;</span></span></p>\r
-\r
-<p class=Heading11>Global Aliasing</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>glob-alias</span></span></p>\r
-\r
-<p class=IndentText>Function returns with global aliasing external state (sets <span\r
-class=Flag><span style='font-size:10.0pt'>checkstrict-glob-alias</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>checked-glob-alias</span></span>, c<span\r
-class=Flag><span style='font-size:10.0pt'>heckmod-glob-alias</span></span> and <span\r
-class=Flag><span style='font-size:10.0pt'>unchecked-glob-alias</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>checkstrict-glob-alias</span></span></p>\r
-\r
-<p class=IndentText>Function returns with a <span class=Annot><span\r
-style='font-size:10.0pt'>checkedstrict</span></span> global aliasing external state.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>checked-glob-alias</span></span></p>\r
-\r
-<p class=IndentText>Function returns with a <span class=Annot><span\r
-style='font-size:10.0pt'>checked</span></span> global aliasing external state.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>checkmod-glob-alias</span></span></p>\r
-\r
-<p class=IndentText>Function returns with a <span class=Annot><span\r
-style='font-size:10.0pt'>checkmod</span></span> global aliasing external state.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unchecked-glob-alias</span></span></p>\r
-\r
-<p class=IndentText>Function returns with an <span class=Annot><span\r
-style='font-size:10.0pt'>unchecked</span></span> global aliasing external state.</p>\r
-\r
-<p class=Heading10>Declaration Consistency <span style='font-weight:normal'>(Section\r
-7.3)</span><span class=Flag><i><span style='font-size:10.5pt;font-family:"Times New Roman";\r
-letter-spacing:0pt;font-weight:normal'> </span></i></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>incon-defs</span></span></p>\r
-\r
-<p class=IndentText>Identifier redeclared or redefined with inconsistent type.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>incon-defs-lib</span></span></p>\r
-\r
-<p class=IndentText>Identifier defined in a library is redefined with\r
-inconsistent type.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>overload</span></span></p>\r
-\r
-<p class=IndentText>Standard library function overloaded.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>match-fields</span></span></p>\r
-\r
-<p class=IndentText>A <span class=CodeText><span style='font-size:10.0pt'>struct</span></span>\r
-or <span class=CodeText><span style='font-size:10.0pt'>enum</span></span> type\r
-is redefined with inconsistent fields or members.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975057">Macros </a><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section </span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>11</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>)</span></span> </p>\r
-\r
-<p class=TextFontCX>These flags control expansion and checking of macro definitions and invocations.</p>\r
-\r
-<p class=Heading10>Macro Expansion</p>\r
-\r
-<p class=beforelist>These flags control which macros are checked as functions\r
-or constants, and which are expanded in the pre-processing phase.  Macros\r
-preceded by <span class=Annot><span style='font-size:10.0pt'>/*@notfunction@*/</span></span> are never expanded regardless of these flag settings.  These flags may be used in\r
-source-file control comments.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>fcn-macros</span></span></p>\r
-\r
-<p class=IndentText>Macros defined with parameter lists are not expanded and\r
-are checked as functions.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>const-macros</span></span></p>\r
-\r
-<p class=IndentText>Macros defined without parameter lists are not expanded and\r
-are checked as constants.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>all-macros</span></span></p>\r
-\r
-<p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>fcn-macros</span></span>\r
-and <span class=Flag><span style='font-size:10.0pt'>const-macros</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>lib-macros</span></span></p>\r
-\r
-<p class=IndentText>Macros defining identifiers declared in a loaded library\r
-are not expanded and are checked according to the library information.<span\r
-class=Flag><span style='font-size:10.0pt'>  </span></span></p>\r
-\r
-<p class=Heading10>Macro Definitions</p>\r
-\r
-<p class=beforelist>These flags control what errors are reported in macro\r
-definitions.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-stmt</span></span></p>\r
-\r
-<p class=IndentText>Macro definition is not syntactically equivalent to\r
-function.  This means if the macro is used as a statement (e.g., <span\r
-class=CodeText><span style='font-size:10.0pt'>if (test) macro();</span></span>)\r
-unexpected behavior may result.  One fix is to surround the macro body with <span\r
-class=CodeText><span style='font-size:10.0pt'>do { \85 } while (FALSE)</span></span>.<span\r
-class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-params</span></span></p>\r
-\r
-<p class=IndentText>A macro parameter is not used exactly once in all possible\r
-invocations of the macro.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-assign</span></span></p>\r
-\r
-<p class=IndentText>A macro parameter is used as the left side of an assignment\r
-expression.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-parens</span></span></p>\r
-\r
-<p class=IndentText>A macro parameter is used without parentheses (in\r
-potentially dangerous context).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-empty</span></span></p>\r
-\r
-<p class=IndentText>Macro definition of a function is empty.   </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-redef</span></span></p>\r
-\r
-<p class=IndentText>Macro is redefined.  There is another macro defined with\r
-the same name.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-unrecog</span></span> </p>\r
-\r
-<p class=IndentText>An unrecognized identifier appears in a macro definition. \r
-Since the identifier may be defined where the macro is used, this could be\r
-okay, but Splint will not be able to check the unrecognized identifier\r
-appropriately.</p>\r
-\r
-<p class=Heading11>Corresponding Declarations</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-match-name</span></span></p>\r
-\r
-<p class=IndentText>An <span class=Annot><span style='font-size:10.0pt'>iter</span></span> or <span\r
-class=Annot><span style='font-size:10.0pt'>constant</span></span> macro is defined using a different name from the one used in the previous syntactic comment</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-decl</span></span></p>\r
-\r
-<p class=IndentText>A macro definition has no corresponding declaration.  (Sets\r
-<span class=Flag><span style='font-size:10.0pt'>macrofcndecl</span></span> and <span\r
-class=Flag><span style='font-size:10.0pt'>macroconstdecl</span></span>.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-fcn-decl</span></span></p>\r
-\r
-<p class=IndentText>Macro definition with parameter list has no corresponding\r
-function prototype. Without a prototype, the types of the macro result and\r
-parameters are unknown.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-const-decl</span></span></p>\r
-\r
-<p class=IndentText>A macro definition without parameter list has no\r
-corresponding constant declaration.<span class=Flag><span style='font-size:\r
-10.0pt'>    </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>next-line-macros</span></span></p>\r
-\r
-<p class=IndentText>A constant or iter declaration is not immediately followed\r
-by a macro definition.</p>\r
-\r
-<p class=Heading10>Side Effect Free Parameters <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>11.2.1</span></span><span class=HeadingNote><span style='font-size:\r
-10.5pt;font-weight:normal;font-style:normal'>)</span></span><span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=beforelist>These flags control error reporting for parameters with inconsistent side effects in invocations of checked function macros and function calls.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sef-params</span></span></p>\r
-\r
-<p class=IndentText>An actual parameter with side effects is passed as a formal\r
-parameter declared with <span class=Annot><span style='font-size:10.0pt'>sef</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sef-uncon</span></span></p>\r
-\r
-<p class=IndentText>An actual parameter involving a call to an unconstrained\r
-function (declared without modifies clause) that may modify anything is passed\r
-as a <span class=Annot><span style='font-size:10.0pt'>sef</span></span>\r
-parameter.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975058">Iterators</a></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>has-yield</span></span></p>\r
-\r
-<p class=IndentText>An iterator has been declared with no parameters annotated with <span\r
-class=Annot><span style='font-size:10.0pt'>yield</span></span>.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975059">Naming Conventions</a> <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 12)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>name-checks</span></span></p>\r
-\r
-<p class=IndentText>Turns all name checking on or off without changing other settings.</p>\r
-\r
-<p class=Heading10>Type-Based Naming Conventions <span style='font-size:10.5pt;\r
-font-weight:normal'>(Section 12.1)</span></p>\r
-\r
-<p class=Heading11>Czech Naming Convention</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech</span></span></p>\r
-\r
-<p class=IndentText>Selects complete Czech naming convention (sets <span\r
-class=Flag><span style='font-size:10.0pt'>access-czech</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czech-fcns</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czech-vars</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czech-consts</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czech-macros</span></span>, and <span\r
-class=Flag><span style='font-size:10.0pt'>czech-types</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>access-czech</span></span></p>\r
-\r
-<p class=IndentText>Allow access to abstract types following Czech naming convention.  The representation of an abstract type named <span\r
-class=CodeText><i><span style='font-size:10.0pt'>t</span></i></span> is\r
-accessible in the definition of a function or constant named <span\r
-class=CodeText><i><span style='font-size:10.0pt'>t_name</span></i></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-fcns</span></span></p>\r
-\r
-<p class=IndentText>Function or iterator name is not consistent with Czech\r
-naming convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-vars</span></span></p>\r
-\r
-<p class=IndentText> Variable name is not consistent with Czech naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-macros</span></span></p>\r
-\r
-<p class=IndentText> Expanded macro name is not consistent with Czech naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-consts</span></span></p>\r
-\r
-<p class=IndentText>Constant name is not consistent with Czech naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czech-types</span></span></p>\r
-\r
-<p class=IndentText>Type name is not consistent with Czech naming convention. \r
-Czech type names must not use the underscore character.</p>\r
-\r
-<p class=Heading11>Slovak Naming Convention</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>slovak</span></span></p>\r
-\r
-<p class=IndentText>Selects complete Slovak naming convention (sets <span\r
-class=Flag><span style='font-size:10.0pt'>access-slovak</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-fcns</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-vars</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-consts</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-macros</span></span>, and <span\r
-class=Flag><span style='font-size:10.0pt'>slovak-types</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>access-slovak</span></span></p>\r
-\r
-<p class=IndentText>Allow access to abstract types following Slovak naming convention. The representation of an abstract type named <span\r
-class=CodeText><i><span style='font-size:10.0pt'>t</span></i></span> is\r
-accessible in the definition of a function or constant named <span\r
-class=CodeText><i><span style='font-size:10.0pt'>tName</span></i></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>slovak-fcns</span></span></p>\r
-\r
-<p class=IndentText>Function or iterator name is not consistent with Slovak\r
-naming convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>slovak-macros</span></span></p>\r
-\r
-<p class=IndentText>Expanded macro name is not consistent with Slovak naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>slovak-vars</span></span></p>\r
-\r
-<p class=IndentText> Variable name is not consistent with Slovak naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>slovak-consts</span></span></p>\r
-\r
-<p class=IndentText> Constant name is not consistent with Slovak naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>slovak-types</span></span></p>\r
-\r
-<p class=IndentText>Type name is not consistent with Slovak naming convention. \r
-Slovak type names may not include uppercase letters.</p>\r
-\r
-<p class=Heading11>Czechoslovak Naming Convention</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czechoslovak</span></span></p>\r
-\r
-<p class=IndentText>Selects complete Czechoslovak naming convention (sets <span\r
-class=Flag><span style='font-size:10.0pt'>access-czechoslovak</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-fcns</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-vars</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-consts</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-macros</span></span>, and <span\r
-class=Flag><span style='font-size:10.0pt'>czechoslovak-types</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>access-czechoslovak</span></span></p>\r
-\r
-<p class=IndentText>Allow access to abstract types by Czechoslovak naming convention. The representation of an abstract type named <span\r
-class=CodeText><i><span style='font-size:10.0pt'>t</span></i></span> is\r
-accessible in the definition of a function or constant named <span\r
-class=CodeText><i><span style='font-size:10.0pt'>t_name</span></i></span> or <span\r
-class=CodeText><i><span style='font-size:10.0pt'>tName</span></i></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czechoslovak-fcns</span></span></p>\r
-\r
-<p class=IndentText> Function name is not consistent with Czechoslovak naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czechoslovak-macros</span></span></p>\r
-\r
-<p class=IndentText>Expanded macro name is not consistent with Czechoslovak\r
-naming convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czechoslovak-vars</span></span></p>\r
-\r
-<p class=IndentText>Variable name is not consistent with Czechoslovak naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czechoslovak-consts</span></span></p>\r
-\r
-<p class=IndentText>Constant name is not consistent with Czechoslovak naming\r
-convention.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>czechoslovak-types</span></span></p>\r
-\r
-<p class=IndentText>Type name is not consistent with Czechoslovak naming\r
-convention. Czechoslovak type names may not include uppercase letters or the\r
-underscore character.</p>\r
-\r
-<p class=Heading10>Namespace Prefixes  <span style='font-size:10.5pt;\r
-font-weight:normal'>(Section 12.2)</span><span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-var-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for variables declared in a macro\r
-body.  (Default is <span class=CodeText><span style='font-size:10.0pt'>m_</span></span>.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'>P: <span class=Keyword><span\r
-  style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>macro-var-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>A variable declared outside a macro body starts with the <span\r
-class=Flag><span style='font-size:10.0pt'>macro-var-prefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>tag-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix of <span class=CodeText><span\r
-style='font-size:10.0pt'>struct</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>union</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>enum</span></span> tag identifiers.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>tag-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not a tag starts with the <span\r
-class=Flag><span style='font-size:10.0pt'>tagprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>enum-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for <span class=CodeText><span\r
-style='font-size:10.0pt'>enum</span></span> members.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>enum-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not an <span class=CodeText><span\r
-style='font-size:10.0pt'>enum</span></span> member starts with the <span\r
-class=Flag><span style='font-size:10.0pt'>enumprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>file-static-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for file <span class=CodeText><span\r
-style='font-size:10.0pt'>static</span></span> declarations.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>file-static-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not file static starts with the <span\r
-class=Flag><span style='font-size:10.0pt'>filestaticprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>global-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for global variables.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>global-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not a global variable starts with the\r
-<span class=Flag><span style='font-size:10.0pt'>globalprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>type-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for user-defined types.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>type-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not a type name starts with the <span\r
-class=Flag><span style='font-size:10.0pt'>typeprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>external-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for external identifiers.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>external-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not external starts with the <span\r
-class=Flag><span style='font-size:10.0pt'>externalprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>local-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for local variables.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>local-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText> An identifier that is not a local variable starts with the\r
-<span class=Flag><span style='font-size:10.0pt'>localprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unchecked-macro-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for unchecked macros.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unchecked-macro-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not the name of an unchecked macro\r
-starts with the <span class=Flag><span style='font-size:10.0pt'>uncheckedmacroprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>const-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for constants.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>const-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not a constant starts with the <span\r
-class=Flag><span style='font-size:10.0pt'>constantprefix</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>iter-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for iterators.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>iter-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not an <span class=Flag><span\r
-style='font-size:10.0pt'>iter</span></span> starts with the <span\r
-class=Flag><span style='font-size:10.0pt'>iterprefix</span></span>. </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>proto-param-prefix</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;prefix string&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set namespace prefix for parameters in function prototypes.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>proto-param-prefix-exclude</span></span></p>\r
-\r
-<p class=IndentText>An identifier that is not a parameter in a function\r
-prototype starts with the <span class=Flag><span style='font-size:10.0pt'>protoprarmprefix</span></span>. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>proto-param-name</span></span></p>\r
-\r
-<p class=IndentText>A parameter in a function prototype has a name (can\r
-interfere with macro definitions). </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>proto-param-match</span></span></p>\r
-\r
-<p class=IndentText>The name of a parameter in a function definition does not\r
-match the corresponding name of the parameter in a function prototype (after\r
-removing the <span class=Flag><span style='font-size:10.0pt'>protoparamprefix</span></span>).</p>\r
-\r
-<p class=Heading10>Naming Restrictions  <span style='font-size:10.5pt;\r
-font-weight:normal'>(Section 12.3)</span><span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>shadow</span></span></p>\r
-\r
-<p class=IndentText>Declaration reuses name visible in outer scope.</p>\r
-\r
-<p class=Heading11>Reserved Names</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ansi-reserved</span></span></p>\r
-\r
-<p class=IndentText>External name conflicts with name reserved for the compiler\r
-or standard library.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ansi-reserved-internal</span></span></p>\r
-\r
-<p class=IndentText> Internal name conflicts with name reserved for the\r
-compiler or standard library.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>cpp-names</span></span></p>\r
-\r
-<p class=IndentText>Internal or external name conflicts with a C++ reserved\r
-word.  (Will cause problems if program is compiled with a C++ compiler.)</p>\r
-\r
-<p class=Heading11>Distinct External Names</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>distinct-external-names</span></span></p>\r
-\r
-<p class=IndentText>An external name is not distinguishable from another\r
-external name using<i> </i><span class=Flag><span style='font-size:10.0pt'>externalnamelen</span></span><i> </i>significant characters.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  6</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>external-name-len</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Sets the number of significant characters in an external\r
-name (ANSI default minimum is 6).  Sets <span class=Flag><span\r
-style='font-size:10.0pt'>+distinct-external-names</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>external-name-case-insensitive</span></span></p>\r
-\r
-<p class=IndentText>Make alphabetic case insignificant in external names. \r
-According to ANSI standard, case need not be significant in an external name. \r
-If <span class=Flag><span style='font-size:10.0pt'>+distinct-external-names</span></span> is not set, sets <span\r
-class=Flag><span style='font-size:10.0pt'>+distinct-external-names</span></span>\r
-with unlimited external name length.</p>\r
-\r
-<p class=Heading11>Distinct Internal Names</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>distinct-internal-names</span></span></p>\r
-\r
-<p class=IndentText>An internal name is not distinguishable from another\r
-internal name using <span class=Flag><span style='font-size:10.0pt'>internalnamelen</span></span> significant characters.   (Also effected by <span\r
-class=Flag><span style='font-size:10.0pt'>internal-name-case-insensitive</span></span> and <span\r
-class=Flag><span style='font-size:10.0pt'>internal-name-lookalike</span></span>.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Flag><span style='font-size:10.0pt'>31</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>internal-name-len</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set the number of significant characters in an internal\r
-name. Sets <span class=Flag><span style='font-size:10.0pt'>+distinct-internal-names</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>internal-name-case-insensitive</span></span></p>\r
-\r
-<p class=IndentText>Set whether case is significant an internal names (<span\r
-class=Flag><span style='font-size:10.0pt'>-internal-name-case-insensitive</span></span> means case is significant).  If <span\r
-class=Flag><span style='font-size:10.0pt'>+distinct-internal-names</span></span> is not set, sets <span\r
-class=Flag><span style='font-size:10.0pt'>+distinct-internal-names</span></span>\r
-with unlimited internal name length.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>internal-name-lookalike</span></span></p>\r
-\r
-<p class=IndentText> Set whether similar looking characters (e.g., \93<span\r
-class=Keyword><span style='font-size:10.0pt'>1</span></span>\94 and \93<span\r
-class=Keyword><span style='font-size:10.0pt'>l</span></span>\94) match in\r
-internal names.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'>Control Flow <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 8)</span></span></p>\r
-\r
-<p class=Heading10>Undefined Evaluation Order <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>8.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span><span class=Flag><i><span\r
-style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;\r
-font-weight:normal'> </span></i></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=Heading10 style='margin:0in;margin-bottom:.0001pt'><span class=Flag><span\r
-style='font-size:10.0pt;font-weight:normal'>eval-order</span></span></p>\r
-\r
-<p class=IndentText>Behavior of an expression is unspecified or implementation-dependent because sub-expressions contain interfering side effects that may be evaluated in any order.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>eval-order-uncon</span></span></p>\r
-\r
-<p class=IndentText>An expression may be undefined because a sub-expression\r
-contains a call to an unconstrained function (no modifies clause) that may\r
-modify something that may be modified or used by another sub-expression.</p>\r
-\r
-<p class=Heading10>Problematic Control Structures <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>8.3</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span><span class=Flag><span\r
-style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;\r
-font-weight:normal'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>inf-loops</span></span></p>\r
-\r
-<p class=IndentText>Likely infinite loop is detected (Section 8.3.1).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>inf-loops-uncon</span></span></p>\r
-\r
-<p class=IndentText>Likely infinite loop is detected.  Loop test or body calls\r
-an unconstrained function that may produce an undetected modification.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>elseif-complete</span></span></p>\r
-\r
-<p class=IndentText>There is no finals else following an else if construct\r
-(Section 8.3.5). </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>case-break</span></span></p>\r
-\r
-<p class=IndentText>There is a non-empty case in a switch not followed by a <span\r
-class=CodeText><span style='font-size:10.0pt'>break</span></span><span\r
-class=Keyword><span style='font-size:10.0pt'> </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-style:normal'>8.3.2</span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-style:normal'>).</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>miss-case</span></span></p>\r
-\r
-<p class=IndentText>A switch on an <span class=CodeText><span style='font-size:\r
-10.0pt'>enum</span></span> type is missing a case for a member of the\r
-enumerator.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>loop-exec</span></span></p>\r
-\r
-<p class=IndentText>Assume all loops execute at least once.  This effects\r
-use-before-definition and memory checking.  It should probably not be used\r
-globally, but may be used surrounding a particular loop that is known to always\r
-execute to prevent spurious messages.</p>\r
-\r
-<p class=Heading10>Deep Break <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section </span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>8.3.3</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>deep-break</span></span></p>\r
-\r
-<p class=IndentText>Report errors for <span class=CodeText><span\r
-style='font-size:10.0pt'>break</span></span> statements inside a nested <span\r
-class=CodeText><span style='font-size:10.0pt'>while</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>for</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>switch</span></span>.  (Sets all\r
-nested break and continue flags.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>loop-loop-break</span></span></p>\r
-\r
-<p class=IndentText><span class=TextFontCXChar>There\r
-is a </span><span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-inside a <span class=CodeText><span style='font-size:10.0pt'>while</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>for</span></span> or\r
-iterator loop that is inside a <span class=CodeText><span style='font-size:\r
-10.0pt'>while</span></span>, <span class=CodeText><span style='font-size:10.0pt'>for</span></span>\r
-or iterator loop. Mark with <span class=Annot><span style='font-size:10.0pt'>/*@innerbreak@*/</span></span> to suppress the message.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>switch-loop-break</span></span></p>\r
-\r
-<p class=IndentText><span class=TextFontCXChar>There\r
-is a</span><span class=Keyword><span style='font-size:10.5pt;font-family:"Times New Roman"'>\r
-</span></span><span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-inside a <span class=CodeText><span style='font-size:10.0pt'>while</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>for</span></span> or\r
-iterator loop that is inside a <span class=CodeText><span style='font-size:\r
-10.0pt'>switch</span></span> statement.  Mark with <span class=Annot><span\r
-style='font-size:10.0pt'>/*@loopbreak@*/</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=MsoListBullet><span class=Flag><span style='font-size:10.0pt'>loop-switch-break</span></span></p>\r
-\r
-<p class=IndentText><span class=TextFontCXChar>There\r
-is a</span><span class=Keyword><span style='font-size:10.5pt;font-family:"Times New Roman"'>\r
-</span></span><span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-inside a <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>\r
-statement that is inside a <span class=CodeText><span style='font-size:10.0pt'>while</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>for</span></span> or\r
-iterator loop.  Mark with /<span class=Annot><span style='font-size:10.0pt'>*@switchbreak@*/</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=MsoListBullet style='margin-left:0in;text-indent:0in'><span\r
-class=Flag><span style='font-size:10.0pt'>switch-switch-break</span></span></p>\r
-\r
-<p class=IndentText><span class=TextFontCXChar>There\r
-is a</span><span class=Keyword><span style='font-size:10.5pt;font-family:"Times New Roman"'>\r
-</span></span><span class=CodeText><span style='font-size:10.0pt'>break</span></span>\r
-inside a <span class=CodeText><span style='font-size:10.0pt'>switch</span></span>\r
-statement that is inside another <span class=CodeText><span style='font-size:\r
-10.0pt'>switch</span></span> statement.  Mark with <span class=Annot><span\r
-style='font-size:10.0pt'>/*@innerbreak@*/</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>loop-loop-continue</span></span></p>\r
-\r
-<p class=IndentText>There is a <span class=CodeText><span style='font-size:\r
-10.0pt'>continue</span></span> inside a while, for or iterator loop that is\r
-inside a while, for or iterator loop.  Mark with <span class=Annot><span\r
-style='font-size:10.0pt'>/*@innercontinue@*/</span></span>.</p>\r
-\r
-<p class=Heading10>Loop and if Bodies  <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 8.3.4)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>all-empty</span></span></p>\r
-\r
-<p class=IndentText>An if, while or for statement has no body (sets <span\r
-class=Flag><span style='font-size:10.0pt'>if-empty</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>while-empty</span></span> and <span\r
-class=Flag><span style='font-size:10.0pt'>for-empty</span></span>.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>all-block</span></span></p>\r
-\r
-<p class=IndentText>The body of an <span class=CodeText><span style='font-size:\r
-10.0pt'>if</span></span>, <span class=CodeText><span style='font-size:10.0pt'>while</span></span>\r
-or <span class=CodeText><span style='font-size:10.0pt'>for</span></span>\r
-statement is not a block (sets <span class=Flag><span style='font-size:10.0pt'>if-block</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>while-block</span></span> and <span\r
-class=Flag><span style='font-size:10.0pt'>for-block</span></span>.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>while-empty</span></span></p>\r
-\r
-<p class=IndentText>A while statement has no body.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>while-block</span></span></p>\r
-\r
-<p class=IndentText> The body of a <span class=CodeText><span style='font-size:\r
-10.0pt'>while</span></span> statement is not a block</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>for-empty</span></span></p>\r
-\r
-<p class=IndentText>A <span class=CodeText><span style='font-size:10.0pt'>for</span></span>\r
-statement has no body.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>for-block</span></span></p>\r
-\r
-<p class=IndentText>The body of a <span class=CodeText><span style='font-size:\r
-10.0pt'>for</span></span> statement is not a block.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>if-empty</span></span></p>\r
-\r
-<p class=IndentText>An <span class=CodeText><span style='font-size:10.0pt'>if</span></span>\r
-statement has no body.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ifblock</span></span></p>\r
-\r
-<p class=IndentText>The body of an <span class=CodeText><span style='font-size:\r
-10.0pt'>if</span></span> statement is not a block.</p>\r
-\r
-<p class=Heading10>Suspicious Statements <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 8.4)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unreachable</span></span></p>\r
-\r
-<p class=IndentText>Code is not reached on any possible execution.<span\r
-class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>noeffect</span></span></p>\r
-\r
-<p class=IndentText>Statement has no effect.<span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>noeffect-uncon</span></span></p>\r
-\r
-<p class=IndentText>Statement involving call to unconstrained function may have\r
-no effect.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>noret</span></span></p>\r
-\r
-<p class=IndentText>There is a path with no <span class=Keyword><span\r
-style='font-size:10.0pt'>return</span></span> in a function declared to return\r
-a non-<span class=Keyword><span style='font-size:10.0pt'>void</span></span>\r
-value.</p>\r
-\r
-<p class=Heading10>Ignored Return Values <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section </span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>8.4.2</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>)</span></span></p>\r
-\r
-<p class=beforelist>These flags control when errors are reported for function\r
-calls that do not use the return value.  Casting the function call to <span\r
-class=CodeText><span style='font-size:10.0pt'>void</span></span> or declaring\r
-the called function to return <span class=Annot><span style='font-size:10.0pt'>/*@alt\r
-void@*/</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ret-val-bool</span></span></p>\r
-\r
-<p class=IndentText>Return value of type <span class=CodeText><span\r
-style='font-size:10.0pt'>bool</span></span> ignored. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ret-val-int</span></span></p>\r
-\r
-<p class=IndentText>Return value of type <span class=CodeText><span\r
-style='font-size:10.0pt'>int</span></span> ignored. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ret-val-other</span></span></p>\r
-\r
-<p class=IndentText>Return value of type other than <span class=CodeText><span\r
-style='font-size:10.0pt'>bool</span></span> or <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span> ignored.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ret-val</span></span></p>\r
-\r
-<p class=IndentText>Return value ignored (Sets <span class=Flag><span\r
-style='font-size:10.0pt'>retvalbool</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>retvalint</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>retvalother</span></span>.)</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'>Completeness <span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>13</span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>)</span></span></p>\r
-\r
-<p class=Heading10>Unused Declarations <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>13.1</span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>)</span></span></p>\r
-\r
-<p class=beforelist>These flags control when errors are reported for\r
-declarations that are never used.  The <span class=Annot><span\r
-style='font-size:10.0pt'>unused</span></span> annotation can be used to prevent\r
-unused errors from being report for a particular declaration.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>top-use</span></span></p>\r
-\r
-<p class=IndentText>An external declaration is not used in any file.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>const-use</span></span></p>\r
-\r
-<p class=IndentText>Constant never used. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>enum-mem-use</span></span></p>\r
-\r
-<p class=IndentText>Member of enumerator never used. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>var-use</span></span></p>\r
-\r
-<p class=IndentText>Variable never used.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>param-use</span></span></p>\r
-\r
-<p class=IndentText>Function parameter never used.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>fcn-use</span></span></p>\r
-\r
-<p class=IndentText>Function is never used.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>++++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>type-use</span></span></p>\r
-\r
-<p class=IndentText>Defined type never used. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>field-use</span></span></p>\r
-\r
-<p class=IndentText>Field of structure or union type is never used.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unused-special</span></span></p>\r
-\r
-<p class=IndentText>Declaration in a special file (corresponding to <span\r
-class=ProgramNameChar>.l</span> or <span class=ProgramNameChar>.y</span> file)\r
-is unused.</p>\r
-\r
-<p class=Heading10>Complete Programs  <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 13.2)</span></span><span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>decl-undef</span></span></p>\r
-\r
-<p class=IndentText>Function, variable, iterator or constant declared but never\r
-defined.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>partial</span></span></p>\r
-\r
-<p class=IndentText>Check as partial system (sets <span class=Flag><span\r
-style='font-size:10.0pt'>-decl-undef</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>-export-local</span></span> and prevents checking of macros in headers without corresponding <span\r
-class=ProgramNameChar>.c</span> files.)</p>\r
-\r
-<p class=Heading10>Exports</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>export-local</span></span></p>\r
-\r
-<p class=IndentText>A declaration is exported but not used outside this\r
-module.  (Declaration can use the <span class=CodeText><span style='font-size:\r
-10.0pt'>static</span></span> qualifier.)</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-header</span></span></p>\r
-\r
-<p class=IndentText>A declaration (other than a variable) is exported but does\r
-not appear in a header file.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-header-var</span></span></p>\r
-\r
-<p class=IndentText>A variable declaration is exported but does not appear in a\r
-header file.</p>\r
-\r
-<p class=Heading10>Unrecognized Identifiers</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>unrecog</span></span></p>\r
-\r
-<p class=IndentText>An unrecognized identifier is used.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sys-unrecog</span></span></p>\r
-\r
-<p class=IndentText>Report unrecognized identifiers that start with the system\r
-prefix, <span class=Keyword><span style='font-size:10.0pt'>__</span></span>\r
-(two underscores).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>repeat-unrecog</span></span></p>\r
-\r
-<p class=IndentText>Report multiple messages for unrecognized identifiers.  If <span\r
-class=Flag><span style='font-size:10.0pt'>repeatunrecog</span></span> is not\r
-set, an error is reported only the first time a particular unrecognized\r
-identifier appears in the file.</p>\r
-\r
-<p class=Heading10>Multiple Definition and Declarations</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span\r
-class=Flag><span style='font-size:10.0pt'>redef</span></span></p>\r
-\r
-<p class=IndentText>A function or variable is defined more than once.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>redecl</span></span></p>\r
-\r
-<p class=IndentText>An identifier is declared more than once.<span class=Flag><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>nested-extern</span></span></p>\r
-\r
-<p class=IndentText>An <span class=Keyword><span style='font-size:10.0pt'>extern</span></span>\r
-declaration is used inside a function body.</p>\r
-\r
-<p class=Heading10>ISO Conformance</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>noparams</span></span></p>\r
-\r
-<p class=IndentText>A function is declared without a parameter list prototype. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>old-style</span></span></p>\r
-\r
-<p class=IndentText>Function definition is in old style syntax.  Standard\r
-prototype syntax is preferred.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>exit-arg</span></span></p>\r
-\r
-<p class=IndentText>Argument to <span class=CodeText><span style='font-size:\r
-10.0pt'>exit</span></span> has implementation defined behavior.  The only valid arguments to <span\r
-class=CodeText><span style='font-size:10.0pt'>exit</span></span> are <span\r
-class=CodeText><span style='font-size:10.0pt'>EXIT_SUCCESS</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>EXIT_FAILURE</span></span> and <span\r
-class=CodeText><span style='font-size:10.0pt'>0</span></span>.  An error is\r
-reported if Splint can determine statically that the argument to <span\r
-class=CodeText><span style='font-size:10.0pt'>exit</span></span> is not one of these.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>use-var-args</span></span></p>\r
-\r
-<p class=IndentText>Report if <span class=CodeText><span style='font-size:10.0pt'>&lt;varargs.h&gt;</span></span>\r
-is used (should use <span class=ProgramNameChar><span style='font-size:10.0pt'>stdarg.h</span></span>).<span\r
-class=Flag><span style='font-size:10.5pt;font-family:"Times New Roman"'> </span></span></p>\r
-\r
-<p class=Heading10>Limits</p>\r
-\r
-<p class=beforelist>The ANSI Standard includes limits on minimum numbers that a\r
-conforming compiler must support.  Whether of not a particular compiler exceeds\r
-these limits, it is worth checking that a program does not exceed them so that\r
-other compilers may safely compile it.  In addition, exceeding a limit may\r
-indicate a problem in the code (e.g., it is too complex if the control nest\r
-depth limit is exceeded) that should be fixed regardless of the compiler. \r
-Splint checks the following limits.  For each limit, the maximum value may be\r
-set from the command line (or locally using a stylized comment).  The minimum\r
-limits were increased for the ISO C99 specification.  If the <span class=Flag><span\r
-style='font-size:10.0pt'>iso99-limits</span></span> flag is used, all limits are checked with the minimum values of an ISO C99 conforming\r
-compiler.  If the <span class=Flag><span style='font-size:10.0pt'>ansi89-limits</span></span>\r
-flag is used, all limits are checked with the minimum values of an ANSI C89\r
-conforming compiler.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ansi89-imits</span></span></p>\r
-\r
-<p class=IndentText>Check for violations of minimum limits prescribed by ANSI\r
-C89 standard (sets <span class=Flag><span style='font-size:10.0pt'>control-nest-depth</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>string-literal-len</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>include-nest</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>num-struct-fields</span></span>, and <span\r
-class=Flag><span style='font-size:10.0pt'>num-enum-members</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>control-nest-depth</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set maximum nesting depth of compound statements, iteration\r
-control structures, and selection control structures (ISO C99 minimum is 63; ANSI\r
-C89 minimum is 15).<span class=Flag><span style='font-size:10.5pt;font-family:\r
-"Times New Roman"'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>string-literal-len</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set maximum length of string literals (ISO C99 minimum is\r
-4095; ANSI C89 minimum is 509).<span class=Flag><span style='font-size:10.5pt;\r
-font-family:"Times New Roman"'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>num-struct-fields</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set maximum number of fields in a <span class=CodeText><span\r
-style='font-size:10.0pt'>struct</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>union</span></span> (ISO C99 minimum is 1023; ANSI\r
-minimum is 127).<span class=Flag><span style='font-size:10.5pt;font-family:\r
-"Times New Roman"'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>num-enum-members</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set maximum number of members of an <span class=CodeText><span\r
-style='font-size:10.0pt'>enum</span></span> type (ISO C99 minimum is 1023; ANSI\r
-minimum is 127).<span class=Flag><span style='font-size:10.5pt;font-family:\r
-"Times New Roman"'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>--++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>include-nest</span></span><span\r
-class=Flag><span style='font-size:10.0pt'> <i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Set maximum number of nested <span class=CodeText><span\r
-style='font-size:10.0pt'>#include</span></span> files (ISO C99 minimum is 63; ANSI\r
-minimum is 8).<span class=Flag><span style='font-size:10.5pt;font-family:"Times New Roman"'>\r
-</span></span></p>\r
-\r
-<p class=Heading10>Header Inclusion <a name="_Ref344793948"><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section </span></span></a><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>14.3</span></span><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>)</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>skip-iso-headers</span></span></p>\r
-\r
-<p class=IndentText>Prevent inclusion of header files in a system directory with names that match standard ISO C99 headers. The symbolic information in the standard library is used instead.  In effect only if a library that includes the standard library is used.  The ISO C99 headers are: <span class=CodeText><span\r
-style='font-size:10.0pt'>assert</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>complex</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>ctype</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>errno</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>fenv</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>float</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>inttypes</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>iso646</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>limits</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>locale</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>math</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>setjmp</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>signal</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>stdarg</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>stdbool</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>stddef</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>stdio</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>stdlib</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>string</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>tgmath</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>time</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>wchar</span></span>, and <span class=CodeText><span\r
-style='font-size:10.0pt'>wctype</span></span>.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>skip-posix-headers</span></span></p>\r
-\r
-<p class=IndentText>Prevent inclusion of header files in a system directory\r
-with names that match standard POSIX headers. The symbolic information in the\r
-standard library is used instead.  In effect only if a library that includes\r
-the POSIX library is used.  The skipped POSIX headers are: <span\r
-class=CodeText><span style='font-size:10.0pt'>dirent</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>fcntl</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>grp</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>pwd</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>termios</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>sys/stat</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>sys/times</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>sys/types</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>sys/utsname</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>sys/wait</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>unistd</span></span>, and <span\r
-class=CodeText><span style='font-size:10.0pt'>utime</span></span>. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>warn-posix-headers</span></span></p>\r
-\r
-<p class=IndentText>Report use of a POSIX header when checking a program with a\r
-non-POSIX library.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>skip-sys-headers</span></span></p>\r
-\r
-<p class=IndentText>Prevent inclusion of all header files in system\r
-directories. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sys-dir-expand-macros</span></span></p>\r
-\r
-<p class=IndentText>Expand macros in system directories regardless of other\r
-settings, except for macros corresponding to names defined in a load library. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sys-dir-errors</span></span></p>\r
-\r
-<p class=IndentText>Report errors in files in system directories (set by <span\r
-class=Flag><span style='font-size:10.0pt'>-sys-dirs</span></span>).   </p>\r
-\r
-<p class=IndentText><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-style:normal'>&nbsp;</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>global:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>single-include</span></span></p>\r
-\r
-<p class=IndentText>Optimize header inclusion to only include each header file\r
-once.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>global:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>never-include</span></span></p>\r
-\r
-<p class=IndentText>Use library information instead of including header files. </p>\r
-\r
-<p class=Heading10>Comments</p>\r
-\r
-<p class=beforelist>These flags control how syntactic comments are interpreted.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Flag><span style='font-size:10.0pt'>@</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>comment-char </span></span><span\r
-class=Flag><i><span style='font-size:10.0pt'>&lt;char&gt;</span></i></span></p>\r
-\r
-<p class=IndentText>Set the marker character for syntactic comments.  Comments\r
-beginning with <span class=CodeText><span style='font-size:10.0pt'>/*</span></span><span\r
-class=Flag><i><span style='font-size:10.0pt'>&lt;char&gt;</span></i></span> are\r
-interpreted by Splint.<span class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>noaccess</span></span></p>\r
-\r
-<p class=IndentText>Ignore access comments.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>nocomments</span></span></p>\r
-\r
-<p class=IndentText>Ignore all stylized comments. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>sup-counts</span></span></p>\r
-\r
-<p class=IndentText>Actual number of errors does not match number in <span\r
-class=Annot><span style='font-size:10.0pt'>/*@i</span></span><span\r
-class=Annot><span style='font-size:10.0pt'>&lt;n&gt;@*/</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>lint-comments</span></span></p>\r
-\r
-<p class=IndentText>Interpret traditional lint comments (<span class=CodeText><span\r
-style='font-size:10.0pt'>/*FALLTHROUGH*/</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>/*NOTREACHED*/</span></span>, <span class=CodeText><span\r
-style='font-size:10.0pt'>/*PRINTFLIKE*/</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>warn-lint-comments</span></span></p>\r
-\r
-<p class=IndentText>Print a warning and suggest an alternative when a\r
-traditional lint comment is used.   </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  +</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>unrecog-comments</span></span></p>\r
-\r
-<p class=IndentText>Stylized comment is unrecognized.</p>\r
-\r
-<p class=Heading10>Parsing</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>continue-comment</span></span></p>\r
-\r
-<p class=IndentText>A line continuation marker (<span class=CodeText><span\r
-style='font-size:10.0pt'>\</span></span>) appears inside a comment on the same\r
-line as the comment close. Preprocessors should handle this correctly, but it\r
-causes problems for some preprocessors.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>nest-comment</span></span></p>\r
-\r
-<p class=IndentText>A comment open sequence (<span class=CodeText><span\r
-style='font-size:10.0pt'>/*</span></span>) appears inside a comment.  This\r
-usually indicates that an earlier comment was not closed.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  +</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>duplicate-quals</span></span></p>\r
-\r
-<p class=IndentText>Report duplicate type qualifiers (e.g., <span\r
-class=CodeText><span style='font-size:10.0pt'>unsigned unsigned</span></span>).</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>gnu-extensions</span></span></p>\r
-\r
-<p class=IndentText>Support some GNU and Microsoft language extensions.<span\r
-class=Flag><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=Heading10>Parsing</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>syntax</span></span></p>\r
-\r
-<p class=IndentText>Parse error.<span class=Flag><span style='font-size:10.0pt'>\r
-</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>try-to-recover</span></span></p>\r
-\r
-<p class=IndentText>Try to recover from a parse error.  If <span class=Flag><span\r
-style='font-size:10.0pt'>trytorecover</span></span> is not set, Splint will\r
-abort checking after a parse error is detected.  If it is set, Splint will\r
-attempt to recover, but Splint does performs only minimal error recovery.  It\r
-is likely that trying to recover after a parse error will lead to an internal\r
-assertion failing.</p>\r
-\r
-<p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975061">Flag Name Abbreviations</a></p>\r
-\r
-<p class=beforelist>Within a flag name, abbreviations may be used.  Figure 25 shows the flag name abbreviations.  The expanded and short forms are interchangeable in flag names.</p>\r
-\r
-<p>\r
-<center>\r
-\r
-<table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 \r
- style='margin-left:99.9pt;border-collapse:collapse;margin-left:-2.25pt;\r
- margin-right:-2.25pt'>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;border:none;border-bottom:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'>Expanded Form</p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;border:none;border-bottom:solid black 1.5pt;\r
-  padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center'>Short Form</p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>constant</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>const</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>declaration</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>decl</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>function</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>fcn</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>global</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>glob</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>implicit</span></span><span class=Flag><span\r
-  style='font-size:10.0pt;font-family:"Times New Roman"'>, </span></span><span\r
-  class=Flag><span style='font-size:10.0pt'>implied</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>imp</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>iterator</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>iter</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>length</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>len</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>modifies</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>mods</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>modify</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>mod</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>memory</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>mem</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>parameter</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>param</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>pointer</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX style='page-break-after:\r
-  avoid'><span class=Flag><span style='font-size:10.0pt'>ptr</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>return</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>ret</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>variable</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>var</span></span></p>\r
-  </td>\r
- </tr>\r
- <tr>\r
-  <td  valign=top style='width:171.0pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX><span class=Flag><span\r
-  style='font-size:10.0pt'>unconstrained, unconst</span></span></p>\r
-  </td>\r
-  <td  valign=top style='width:67.5pt;padding:0in 5.4pt 0in 5.4pt'>\r
-  <p class=TextFontCX style='page-break-after:\r
-  avoid'><span class=Flag><span style='font-size:10.0pt'>uncon</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0>\r
- <tr>\r
-  <td valign=top style='padding-top:.1in;padding-right:\r
-  9.35pt;padding-bottom:.1in;padding-left:9.35pt'>\r
-  <p class=MsoCaption><a name="_Toc534824627"></a><a name="_Ref534824456">Figure\r
-  25</a>.  Flag Name Abbreviations</p>\r
-  </td>\r
- </tr>\r
-</table>\r
-</center>\r
-\r
-<p class=beforelist>For example, <span class=Flag><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>\r
-and <span class=Flag><span style='font-size:10.0pt'>globalsimpliesmodifiesnothing</span></span>\r
-denote the same flag.  Abbreviations in flag names allow pronounceable,\r
-descriptive names to be used without making flag names excessively long\r
-(although one must admit even <span class=Flag><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>\r
-is a bit of a mouthful.)</p>\r
-\r
-<p class=TextFontCX>To make flag names more\r
-readable, the space, dash (<span class=Flag><span style='font-size:10.0pt'>-</span></span>),\r
-and underscore (<span class=Flag><span style='font-size:10.0pt'>_</span></span>)\r
-characters may be used inside a flag name.  Hence, <span class=Flag><span\r
-style='font-size:10.0pt'>globals-implies-modifies-nothing</span></span>, <span\r
-class=Flag><span style='font-size:10.0pt'>glob_imps_­mods­nothing</span></span>\r
-and <span class=Flag><span style='font-size:10.0pt'>globsimpmodsnothing</span></span>\r
-are equivalent.</p>\r
-\r
-<p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975062"></a><a name="_Ref348845752">Appendix C<span\r
-style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Annotations</a></p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975063"></a><a name="_Ref348010146">Suppressin</a>g Warnings</p>\r
-\r
-<p class=beforelist>Several annotations are provided for suppressing messages. \r
-In general, it is usually better to use specific flags to suppress a particular\r
-error permanently, but the general error suppression flags may be more\r
-convenient for quickly suppressing messages for code that will be corrected or\r
-documented later.<b><span style='font-size:10.5pt'> </span></b></p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>ignore</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>end</span></span></p>\r
-\r
-<p class=IndentText>No errors will be reported in code regions between <span\r
-class=Annot><span style='font-size:10.0pt'>/*@ignore@*/</span></span> and <span\r
-class=Annot><span style='font-size:10.0pt'>/*@end@*/</span></span>.  These\r
-comments can be used to easily suppress an unlimited number of messages, but\r
-are dangerous since if real errors are introduced in the <span class=Flag><span\r
-style='font-size:10.0pt'>ignore</span></span>\85<span class=Flag><span\r
-style='font-size:10.0pt'>end</span></span> region they will not be reported.\r
-The <span class=Annot><span style='font-size:10.0pt'>ignore</span></span> and <span\r
-class=Annot><span style='font-size:10.0pt'>end</span></span> comments must be\r
-matched \97 a warning is printed if the file ends in an ignore region or if <span\r
-class=Flag><span style='font-size:10.0pt'>ignore</span></span> is used inside\r
-ignore region.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>i</span></span></p>\r
-\r
-<p class=IndentText>No errors will be reported from an <span class=Annot><span\r
-style='font-size:10.0pt'>/*@i@*/</span></span> comment to the end of the line.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>i</span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;n&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>No errors will be reported from an <span class=Annot><span\r
-style='font-size:10.0pt'>/*@i<i>&lt;n&gt;</i>@*/</span></span> (e.g., <span\r
-class=Annot><span style='font-size:10.0pt'>/*@i3@*/</span></span>) comment to\r
-the end of the line.  If there are not exactly <i>n </i>errors suppressed from\r
-the comment point to the end of the line, Splint will report an error.  This is\r
-more robust than <span class=Annot><span style='font-size:10.0pt'>i</span></span>\r
-or <span class=Annot><span style='font-size:10.0pt'>ignore</span></span> since\r
-a message is generated if the expected number errors is not present.  Since\r
-errors are not necessarily detected until after this file is processed (for\r
-example, and unused variable error), suppress count errors are reported after\r
-all files have been processed.  The <span class=Flag><span style='font-size:\r
-10.0pt'>&#8209;supcounts</span></span> flag may be used to suppress these\r
-errors.  This is useful when a system if being rechecked with different flag\r
-settings.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>t</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>t<i>&lt;n&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Like <span class=Annot><span style='font-size:10.0pt'>i</span></span>\r
-and <span class=Annot><span style='font-size:10.0pt'>i<i>&lt;n&gt;</i></span></span>,\r
-except controlled by <span class=Flag><span style='font-size:10.0pt'>+tmpcomments</span></span>\r
-flag.  These can be used to temporarily suppress certain errors.  Then, <span\r
-class=Flag><span style='font-size:10.0pt'>-tmpcomments</span></span> can be set\r
-to find them again.</p>\r
-\r
-<p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975064">Syntactic Annotations</a></p>\r
-\r
-<p class=TextFontCX>The grammar below is the C\r
-syntax from [K&amp;R,A13] modified to show the syntax of syntactic comments. \r
-Only productions effected by Splint annotations are shown.  In the annotations,\r
-the <span class=Annot><span style='font-size:10.0pt'>@</span></span> represents\r
-the comment marker char, set by <span class=Flag><span style='font-size:10.0pt'>-commentchar</span></span> (default is <span\r
-class=Annot><span style='font-size:10.0pt'>@</span></span>).</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975065">Functions</a></p>\r
-\r
-<p class=TextFontCX><i>direct-declarator </i><span\r
-style='font-family:Symbol'>Þ</span><i> </i></p>\r
-\r
-<p class=TextFontCX style='text-indent:.5in'><i>  \r
-direct-declarator </i><span class=Annot><span style='font-size:10.0pt'>(</span></span><i>\r
-parameter-type-list<sub>opt</sub> </i><span class=Annot><span style='font-size:\r
-10.0pt'>)</span></span><i> stateClause*<sub>opt</sub> globals<sub>opt</sub>\r
-modifies<sub>opt</sub></i></p>\r
-\r
-<p class=TextFontCX style='text-indent:.5in'><i>| \r
-direct-declarator </i><span class=Annot><span style='font-size:10.0pt'>(</span></span><i>\r
-identifier-list<sub>opt</sub> </i><span class=Annot><span style='font-size:\r
-10.0pt'>)</span></span><i> stateClause*<sub>opt</sub> globals<sub>opt</sub>\r
-modifies<sub>opt</sub></i></p>\r
-\r
-<p class=TextFontCX><i>&nbsp;</i></p>\r
-\r
-<p class=TextFontCX><i>stateClause </i><span\r
-style='font-family:Symbol'>Þ</span><i> </i><span class=Annot><span\r
-style='font-size:10.0pt'>/*@ </span></span>( <span class=Annot><span\r
-style='font-size:10.0pt'>uses</span></span><i> | </i><span class=Annot><span\r
-style='font-size:10.0pt'>sets</span></span><i> | </i><span class=Annot><span\r
-style='font-size:10.0pt'>defines</span></span><i> | </i><span class=Annot><span\r
-style='font-size:10.0pt'>allocates</span></span><i> | </i><span class=Annot><span\r
-style='font-size:10.0pt'>releases</span></span>) <i>reference,<sup>+</sup> </i><span\r
-class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub> </i><span\r
-class=Annot><span style='font-size:10.0pt'>@*/</span></span></p>\r
-\r
-<p class=TextFontCX align=right style='text-align:\r
-right'><i>               | </i><span class=Annot><span style='font-size:10.0pt'>/*@\r
-</span></span>( <span class=Annot><span style='font-size:10.0pt'>ensures</span></span>\r
-| <span class=Annot><span style='font-size:10.0pt'>requires</span></span> ) <i>stateTag</i>\r
-<i>reference,<sup>+</sup> </i><span class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub>\r
-</i><span class=Annot><span style='font-size:10.0pt'>@*/                    </span></span>(Section\r
-7.4)</p>\r
-\r
-<p class=TextFontCX><i>&nbsp;</i></p>\r
-\r
-<p class=TextFontCX><i>stateTag </i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>only</span></span><i> | </i><span class=Annot><span style='font-size:\r
-10.0pt'>shared</span></span><i> | </i><span class=Annot><span style='font-size:\r
-10.0pt'>owned </span></span><i>| </i><span class=Annot><span style='font-size:\r
-10.0pt'>dependent</span></span><i> | </i><span class=Annot><span\r
-style='font-size:10.0pt'>observer</span></span><i> | </i><span class=Annot><span\r
-style='font-size:10.0pt'>exposed</span></span><i> | </i><span class=Annot><span\r
-style='font-size:10.0pt'>isnull</span></span><i> | </i><span class=Annot><span\r
-style='font-size:10.0pt'>notnull</span></span></p>\r
-\r
-<p class=TextFontCX align=right style='text-align:\r
-right;text-indent:.5in'><i>     | identifier                           </i>(Annotation\r
-defined by metastate definition, Section 10)</p>\r
-\r
-<p class=TextFontCX style='text-indent:.5in'><i>            </i></p>\r
-\r
-<p class=TextFontCX><i>globals </i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>/*@globals</span></span><i> globitem,<sup>+</sup> </i><span\r
-class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub> </i><span\r
-class=Annot><span style='font-size:10.0pt'>@*/ </span></span><i>| </i><span\r
-class=Annot><span style='font-size:10.0pt'>/*@globals</span></span><i>\r
-declaration-list<sub>opt  </sub></i><span class=Annot><span style='font-size:\r
-10.0pt'>;</span></span><i><sub> opt</sub></i><span class=Keyword><i><sub><span\r
-style='font-size:10.5pt;font-family:"Times New Roman"'> </span></sub></i></span><span\r
-class=Annot><span style='font-size:10.0pt'>@*/</span></span><span\r
-class=Keyword><span style='font-size:10.0pt'>  </span></span></p>\r
-\r
-<p class=TextFontCX><i>globitem </i><span\r
-style='font-family:Symbol'>Þ</span> [ ( <span class=Annot><span\r
-style='font-size:10.0pt'>undef</span></span> | <span class=Annot><span\r
-style='font-size:10.0pt'>killed </span></span>)* ] <span class=Keyword><i><sub><span\r
-style='font-size:10.5pt;font-family:"Times New Roman"'> </span></sub></i></span><i> identifier\r
-|  </i><span class=Annot><span style='font-size:10.0pt'>internalState</span></span><span\r
-class=Keyword><span style='font-size:10.0pt'> </span></span><i>|  </i><span\r
-class=Annot><span style='font-size:10.0pt'>fileSystem</span></span></p>\r
-\r
-<p class=TextFontCX><i>&nbsp;</i></p>\r
-\r
-<p class=TextFontCX><i>modifies </i><span\r
-style='font-family:Symbol'>Þ</span><i> </i><span class=Annot><span\r
-style='font-size:10.0pt'>/*@modifies</span></span><i> </i>(<span class=Annot><span\r
-style='font-size:10.0pt'>nothing</span></span><i> | </i>(<i>expression </i>| <span\r
-class=Annot><span style='font-size:10.0pt'>internalState</span></span> | <span\r
-class=Annot><span style='font-size:10.0pt'>fileSystem</span></span>)<i><sup>+</sup></i><span\r
-class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub> opt</sub></i>)\r
-<span class=Annot><span style='font-size:10.0pt'>@*/</span></span><span\r
-class=Keyword><span style='font-size:10.0pt'>         </span></span></p>\r
-\r
-<p class=TextFontCX align=right style='text-align:\r
-right'><span class=Keyword><span style='font-size:10.0pt'>     </span></span><i>|\r
-</i><span class=Annot><span style='font-size:10.0pt'>/*@*/</span></span><span\r
-class=Keyword><span style='font-size:10.0pt'>                   </span></span>(Abbreviation\r
-for no globals and modifies nothing.)</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975066">Iterators </a><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 11.4)</span></span></p>\r
-\r
-<p class=beforelist>The globals and modifies clauses for an iterator are the\r
-same as those for a function, except they are not enclosed by a comment, since\r
-the iterator is already a comment.</p>\r
-\r
-<p class=TextFontCX><i>direct-declarator </i></p>\r
-\r
-<p class=TextFontCX style='text-indent:.5in'><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>/*@iter</span></span><i> identifier </i><span class=Annot><span\r
-style='font-size:10.0pt'>(</span></span><span class=Keyword><span\r
-style='font-size:10.0pt'> </span></span><i>parameter-type-list<sub>opt</sub> </i><span\r
-class=Annot><span style='font-size:10.0pt'>)</span></span><i> iterGlobals<sub>opt</sub>\r
-iterModifies<sub>opt</sub> </i><span class=Annot><span style='font-size:10.0pt'>@*/</span></span></p>\r
-\r
-<p class=TextFontCX><i>&nbsp;</i></p>\r
-\r
-<p class=TextFontCX><i>iter-globals </i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>globals</span></span><i> declaration-list<sub>opt </sub></i><span\r
-class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>\r
-\r
-<p class=TextFontCX><i>iter-modifies </i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>modifies</span></span><i>  moditem,+</i><span class=Keyword><span\r
-style='font-size:10.0pt'> </span></span><span class=Annot><span\r
-style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><span\r
-class=Keyword><i><sub><span style='font-size:10.5pt;font-family:"Times New Roman"'>\r
-</span></sub></i></span><i>| </i><span class=Annot><span style='font-size:10.0pt'> modifies\r
-nothing</span></span><span class=Keyword><span style='font-size:10.0pt'> </span></span><span\r
-class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i></p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975067">Constants </a><span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 11.1)</span></span></p>\r
-\r
-<p class=TextFontCX><i>external-declaration </i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>/*@constant</span></span><i> declaration <sub> </sub></i><span\r
-class=Annot><span style='font-size:10.0pt'>;</span></span><i><sub>opt</sub></i><span\r
-class=Keyword><span style='font-size:10.0pt'> </span></span><span class=Annot><span\r
-style='font-size:10.0pt'>@*/</span></span></p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975068"></a><a name="_Ref344807420">Alternate Types</a> <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 4.4)</span></span></p>\r
-\r
-<p class=beforelist>Alternate types may be used in the type specification of\r
-parameters and return values.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'><i>extended-type</i><span style='font-family:Symbol'>Þ</span> <i>type-specifier\r
-alt-type<sub> opt</sub></i><span class=Keyword><i><sub><span style='font-size:\r
-10.5pt;font-family:"Times New Roman"'> </span></sub></i></span></p>\r
-\r
-<p class=TextFontCX><i>alt-type </i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>/*@alt</span></span><i> basic-type,<sup>+ </sup></i><span class=Annot><span\r
-style='font-size:10.0pt'>@*/</span></span></p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975069">Declarator Annotations</a></p>\r
-\r
-<p class=TextFontCX>General annotations appear\r
-after <i>storage-class-specifier</i>s and before <i>type-specifier</i>s. \r
-Multiple annotations may be used in any order.  Here, annotations are without\r
-the surrounding comment.  In a declaration, the annotation would be surrounded\r
-by <span class=Annot><span style='font-size:10.0pt'>/*@</span></span> and <span\r
-class=Annot><span style='font-size:10.0pt'>@*/</span></span>.  In a globals or modifies clause or iterator or constant declaration, no surrounding comments\r
-would be used since they are within a comment.</p>\r
-\r
-<p class=Heading10 align=left style='text-align:left'>Type Definitions <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 4.3)</span></span></p>\r
-\r
-<p class=beforelist>A type definition may use any either <span class=Annot><span\r
-style='font-size:10.0pt'>abstract</span></span> or <span class=Annot><span style='font-size:10.0pt'>concrete</span></span>, either <span class=Annot><span style='font-size:10.0pt'>mutable</span></span> or <span class=Annot><span style='font-size:10.0pt'>immutable</span></span>, and <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>.  Only a pointer to a <span class=Annot><span style='font-size:10.0pt'>struct</span></span>\r
-may be declared with <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>. \r
-Mutability annotations may not be used with concrete types since concrete types\r
-inherit their mutability from the actual type.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>abstract</span></span></p>\r
-\r
-<p class=MsoNormal style='margin-left:13.5pt'>Type is abstraction\r
-(representation is hidden from clients.)</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>concrete</span></span></p>\r
-\r
-<p class=MsoNormal style='margin-left:13.5pt'>Type is concrete (representation\r
-is visible to clients.)</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>immutable</span></span></p>\r
-\r
-<p class=MsoNormal style='margin-left:13.5pt'>Instances of the type cannot\r
-change value.<span class=Annot><span style='font-family:"Times New Roman"'> </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>mutable</span></span></p>\r
-\r
-<p class=MsoNormal style='margin-left:13.5pt'>Instances of the type can change\r
-value.<span class=Annot><span style='font-family:"Times New Roman"'> </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>refcounted</span></span></p>\r
-\r
-<p class=IndentText>Reference counted (Section 5.4).</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975070">Type Access</a></p>\r
-\r
-<p class=TextFontCX>Control comments may also be\r
-used to override type access settings.<b><span style='font-size:10.5pt'> </span></b></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>&nbsp;</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@access <i>&lt;type&gt;</i>,<sup>+</sup>@*/</span></span><span\r
-class=Annot><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=IndentText>Allows the following code to access the representation of <span\r
-class=Annot><i><span style='font-size:10.0pt'>&lt;type&gt;</span></i></span>. \r
-Type access applies from the point of the comment to the end of the file or the\r
-next access control comment for this type.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@noaccess </span></span><span\r
-class=Annot><span style='font-size:10.0pt'><i>&lt;type&gt;</i>,<sup>+</sup>@*/ </span></span></p>\r
-\r
-<p class=IndentText>Restricts access to the representation of <span\r
-class=Annot><i><span style='font-size:10.0pt'>&lt;type&gt;</span></i></span>. \r
-The type in a <span class=Annot><span style='font-size:10.0pt'>noaccess</span></span>\r
-comment must have been declared as an abstract type.  </p>\r
-\r
-<p class=Heading10>Global Variables  <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>7.2</span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>)</span></span></p>\r
-\r
-<p class=beforelist>One check annotation may be used on a global or file-static variable declaration.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>unchecked</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Weakest checking for global use.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>checkmod</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Check modification by not use of global. </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>checked</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Check use and modification of global. </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>checkedstrict</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Check use of global, even in functions with no global list. </span></span></p>\r
-\r
-<p class=Heading10>Memory Management  <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>3</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>dependent</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>A reference to externally-owned storage.  (Section </span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>keep</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>A parameter that is kept by the called function.  The caller\r
-may use the storage after the call, but the called function is responsible for\r
-making sure it is deallocated.  (Section </span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2.4</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>killref</span></span></p>\r
-\r
-<p class=IndentText>A <span class=Annot><span style='font-size:10.0pt'>refcounted</span></span>\r
-parameter.  This reference is killed by the call. (Section 5.4)</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>only</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>An unshared reference.  Associated memory must be released\r
-before reference is lost.  (Section&nbsp;</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span><span\r
-class=Annot><span style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>owned</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Storage may be shared by dependent references, but\r
-associated memory must be released before this reference is lost.  (Section </span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2.2</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>shared</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Shared reference that is never deallocated.  (Section </span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>5.2.5</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>temp</span></span></p>\r
-\r
-<p class=IndentText>A temporary parameter.  May not be released, and new\r
-aliases to it may not be created.  (Section 5.2.2)</p>\r
-\r
-<p class=Heading10>Aliasing  <span class=HeadingNote><span style='font-size:\r
-10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>6</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span><span class=Annot><span\r
-style='font-size:10.0pt'> </span></span></p>\r
-\r
-<p class=beforelist>Both alias annotations may be used on a parameter\r
-declaration.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>unique</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Parameter that may not be aliased by any other reference\r
-visible to the function. (Section&nbsp;</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>6.1.1</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>returned</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Parameter that may be aliased by the return value.  (Section\r
-</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>6.1.2</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=Heading10>Exposure  <span class=HeadingNote><span style='font-size:\r
-10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>6.2</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span><span class=Annot><span\r
-style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;\r
-font-weight:normal'> </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>observer</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Reference that cannot be modified.  (Section </span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>6.2.1</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>exposed</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Exposed reference to storage in another object. (Section </span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>6.2</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=Heading10>Definition State <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>3</span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>)</span></span><span class=Annot><span style='font-size:10.5pt;\r
-font-family:"Times New Roman";letter-spacing:0pt;font-weight:normal'> </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>out</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Storage reachable from reference need not be defined.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>in</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>All storage reachable from reference must be defined.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>partial</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Partially defined.  A structure may have undefined fields. \r
-No errors reported when fields are used.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>reldef</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Relax definition checking.  No errors when reference is not\r
-defined, or when it is used.</span></span></p>\r
-\r
-<p class=Heading10>Global State  <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 7.2.2)</span></span></p>\r
-\r
-<p class=TextFontCX>These annotations may only be\r
-used in globals lists.  Both annotations may be used for the same variable, to\r
-mean the variable is undefined before and after the call.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>undef</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Variable is undefined before the call.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>killed</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Variable is undefined after the call.</span></span></p>\r
-\r
-<p class=Heading10>Null State  <span class=HeadingNote><span style='font-size:\r
-10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>2</span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>)</span></span><span class=Annot><span style='font-size:10.5pt;\r
-font-family:"Times New Roman";letter-spacing:0pt;font-weight:normal'> </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>null</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Possibly null pointer.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>notnull</span></span><span\r
-class=Annot><span style='font-size:10.0pt'>   </span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Non-null pointer.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>relnull</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Relax null checking.  No errors when </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>NULL</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'> is\r
-assigned to it, or when it is used as a non-null pointer.</span></span></p>\r
-\r
-<p class=Heading10>Null Predicates <span class=HeadingNote><span\r
-style='font-size:10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>2.1.1</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span><span class=Annot><span\r
-style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;\r
-font-weight:normal'> </span></span></p>\r
-\r
-<p class=beforelist>A null predicate annotation may be used of the return value\r
-of a function returning a Boolean type, taking a possibly-null pointer for its\r
-first argument.<span class=Annot><b><span style='font-size:10.5pt;font-family:\r
-"Times New Roman"'> </span></b></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>nullwhentrue</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>If result is true, first parameter is </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>NULL</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>falsewhennull</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>If result is </span></span><span class=CodeText><span\r
-style='font-size:10.0pt'>TRUE</span></span><span class=Annot><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>, first parameter is not\r
-</span></span><span class=CodeText><span style='font-size:10.0pt'>NULL</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>\r
-\r
-<p class=Heading10>Execution  <span class=HeadingNote><span style='font-size:\r
-10.5pt;font-weight:normal;font-style:normal'>(Section </span></span><span\r
-class=HeadingNote><span style='font-size:10.5pt;font-weight:normal;font-style:\r
-normal'>8.1</span></span><span class=HeadingNote><span style='font-size:10.5pt;\r
-font-weight:normal;font-style:normal'>)</span></span><span class=Annot><span\r
-style='font-size:10.5pt;font-family:"Times New Roman";letter-spacing:0pt;\r
-font-weight:normal'> </span></span></p>\r
-\r
-<p class=beforelist>The <span class=Annot><span style='font-size:10.0pt'>noreturn</span></span>,\r
-<span class=Annot><span style='font-size:10.0pt'>maynotreturn</span></span> and\r
-<span class=Annot><span style='font-size:10.0pt'>alwaysreturn</span></span>\r
-annotations may be used on any function.  The <span class=Annot><span\r
-style='font-size:10.0pt'>noreturnwhentrue</span></span> and <span class=Annot><span\r
-style='font-size:10.0pt'>noreturnwhenfalse</span></span> annotations may only\r
-be used on functions whose first argument is a Boolean.   </p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>noreturn</span></span><span\r
-class=Annot><span style='font-size:10.0pt'>                        </span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Function never returns.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>maynotreturn</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Function may or may not return.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>noreturnwhentrue </span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Function does not return if first parameter is </span></span><span\r
-class=Keyword><span style='font-size:10.0pt'>TRUE</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>noreturnwhenfalse </span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Function does not return if first parameter if </span></span><span\r
-class=Keyword><span style='font-size:10.0pt'>FALSE</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>alwaysreturn</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Function always returns.</span></span></p>\r
-\r
-<p class=Heading10>Side effects  <span style='font-size:10.5pt;font-weight:\r
-normal'>(Section 11.2.1)</span><span class=Annot><span style='font-size:10.5pt;\r
-font-family:"Times New Roman";letter-spacing:0pt;font-weight:normal'> </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>sef</span></span></p>\r
-\r
-<p class=IndentText><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>Corresponding\r
-actual parameter has no side effects.</span></span></p>\r
-\r
-<p class=Heading10>Declarations</p>\r
-\r
-<p class=beforelist>These annotations can be used on a declaration to control unused or undefined error reporting.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>unused</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Identifier need not be used (no unused errors reported.) \r
-(Section </span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>13.1</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>)</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>external</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Identifier is defined externally (no undefined error\r
-reported.) (Section </span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>13.2</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>) </span></span></p>\r
-\r
-<p class=Heading10>Switch Statements</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>fallthrough</span></span></p>\r
-\r
-<p class=IndentText><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>Fall\r
-through case.  No message is reported if the previous case may fall through\r
-into the one immediately after the </span></span><span class=Annot><span\r
-style='font-size:10.0pt'>fallthrough</span></span><span class=Annot><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>.</span></span></p>\r
-\r
-<p class=Heading10>Break and Continue Statements <span\r
-class=TextFontCXChar><span style='font-size:11.0pt;\r
-font-weight:normal'>(Section 8.3.3)</span></span><span\r
-class=Annot><span style='font-size:10.5pt;font-family:"Times New Roman";\r
-letter-spacing:0pt;font-weight:normal'> </span></span></p>\r
-\r
-<p class=beforelist>These annotations are used before a <span class=CodeText><span\r
-style='font-size:10.0pt'>break</span></span> or <span class=CodeText><span\r
-style='font-size:10.0pt'>continue</span></span> statement.<span class=Annot><b><span\r
-style='font-size:10.5pt;font-family:"Times New Roman"'> </span></b></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>innerbreak</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Break is breaking an inner loop or switch.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>loopbreak</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Break is breaking a loop.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>switchbreak</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Break is breaking a switch.</span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>innercontinue</span></span><span\r
-class=Annot><span style='font-size:10.0pt'><i> </i></span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Continue is continuing an inner loop.</span></span></p>\r
-\r
-<p class=Heading10>Unreachable Code</p>\r
-\r
-<p class=beforelist>This annotation is used before a statement to prevent\r
-unreachable code errors.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>notreached</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Statement may be unreachable.</span></span></p>\r
-\r
-<p class=Heading10>Format String Arguments </p>\r
-\r
-<p class=beforelist>These annotations are used immediately before a function\r
-declaration.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>printflike</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Check variable arguments like </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>printf</span></span><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>\r
-library function.   </span></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>scanflike</span></span></p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt;font-family:\r
-"Times New Roman"'>Check variable arguments like </span></span><span\r
-class=CodeText><span style='font-size:10.0pt'>scanf</span></span><a\r
-name="_Toc344355453"></a><a name="_Ref343091002"></a><a name="_Ref343065628"><span\r
-class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>\r
-library function.</span></span></a></p>\r
-\r
-<p class=Heading10><a name="_Ref348789839">Use Warnings</a></p>\r
-\r
-<p class=beforelist>These annotations are used immediately before a function,\r
-variable or type declaration.<span class=Annot><b><span style='font-size:10.5pt;\r
-font-family:"Times New Roman"'> </span></b></span></p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>warn <i>&lt;flag-specifier&gt;</i> <i>&lt;message&gt;</i>\r
-</span></span></p>\r
-\r
-<p class=IndentText>Issue a warning (controlled by <span class=Flag><span\r
-style='font-size:10.0pt'>flag-specifier</span></span>) where this declarator is\r
-used.<span class=Annot><span style='font-size:10.0pt;font-family:"Times New Roman"'>\r
-</span></span></p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975071">Macro Expansion</a></p>\r
-\r
-<p class=TextFontCX><a\r
-href="mailto:/*@notfunction@*/"><span class=Annot><span style='font-size:10.0pt'>/*@notfunction@*/</span></span></a></p>\r
-\r
-<p class=IndentText>The next macro definition is not intended to be a function,\r
-and should be expanded in line instead of checked as a macro function\r
-definition.</p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975072">Arbitrary Integral Types</a></p>\r
-\r
-<p class=TextFontCX>These annotations are used to represent arbitrary integral types.  Syntactically, they replace the implicit <span\r
-class=Flag><span style='font-size:10.0pt'>int</span></span> type.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@integraltype@*/</span></span></p>\r
-\r
-<p class=IndentText>An arbitrary integral type.  The actual type may be any one\r
-of <span class=CodeText><span style='font-size:10.0pt'>short</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>int</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>long</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>unsigned short</span></span>, <span\r
-class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>, or <span\r
-class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>. </p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@unsignedintegraltype@*/</span></span></p>\r
-\r
-<p class=IndentText>An arbitrary unsigned integral type.  The actual type may\r
-be any one of <span class=CodeText><span style='font-size:10.0pt'>unsigned\r
-short</span></span>, <span class=CodeText><span style='font-size:10.0pt'>unsigned</span></span>,\r
-or <span class=CodeText><span style='font-size:10.0pt'>unsigned long</span></span>.</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*@signedintegraltype@*/</span></span></p>\r
-\r
-<p class=IndentText>An arbitrary signed integral type.  The actual type may be\r
-any one of <span class=CodeText><span style='font-size:10.0pt'>short</span></span>,\r
-<span class=CodeText><span style='font-size:10.0pt'>int</span></span>, or <span\r
-class=CodeText><span style='font-size:10.0pt'>long</span></span>. </p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975073"></a><a name="_Ref347471625">Traditional Lint Comments</a></p>\r
-\r
-<p class=TextFontCX>Some of the control comments supported by most standard UNIX lints are supported by Splint so legacy systems can be\r
-checked more easily.  These comments are not lexically consistent with Splint\r
-comments, and their meanings are less precise (and may vary between different\r
-lint programs), so we recommend that Splint comments are used instead except\r
-for checking legacy systems already containing standard lint comments.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=beforelist>These standard lint comments supported by Splint:</p>\r
-\r
-<p class=TextFontCX><span class=Annot><span\r
-style='font-size:10.0pt'>/*FALLTHROUGH*/ </span></span>(alternate misspelling, <span\r
-class=Annot><span style='font-size:10.0pt'>/*FALLTHRU*/</span></span>)</p>\r
-\r
-<p class=IndentText>Prevents errors for fall through cases.  Same meaning as <span class=Annot><span style='font-size:10.0pt'>/*@fallthrough@*/</span></span>.</p>\r
-\r
-<p class=MsoListBullet><span class=Annot><span style='font-size:10.0pt'>/*NOTREACHED*/</span></span></p>\r
-\r
-<p class=IndentText>Prevents errors about unreachable code (until the end of the function).  Same meaning as <span class=Annot><span style='font-size:10.0pt'>/*@notreached@*/</span></span>.  \r
-</p>\r
-\r
-<p class=MsoListBullet><span class=Annot><span style='font-size:10.0pt'>/*PRINTFLIKE*/</span></span></p>\r
-\r
-<p class=indentbefore>Arguments similar to the <span class=CodeText><span\r
-style='font-size:10.0pt'>printf</span></span> library function (there didn\92t\r
-seem to be much of a consensus among standard lints as to exactly what this\r
-means).  Splint supports:</p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt'>/*@printflike@*/</span></span></p>\r
-\r
-<p class=IndentText style='margin-left:.5in'>Function takes zero or more\r
-arguments of any type, an unmodified <span class=CodeText><span\r
-style='font-size:10.0pt'>char *</span></span> format string argument and zero\r
-of more arguments of type and number dictated by the format string.  Format\r
-codes are interpreted identically to the <span class=CodeText><span\r
-style='font-size:10.0pt'>printf</span></span> standard library function.  May\r
-return a result of any type.  (Splint interprets <span class=Annot><span\r
-style='font-size:10.0pt'>/*PRINTFLIKE*/</span></span> as <span class=Annot><span\r
-style='font-size:10.0pt'>/*@printflike@*/</span></span>.)</p>\r
-\r
-<p class=IndentText><span class=Annot><span style='font-size:10.0pt'>/*@scanflike@*/</span></span></p>\r
-\r
-<p class=IndentText style='margin-left:.5in'>Like <span class=Annot><span\r
-style='font-size:10.0pt'>printflike</span></span>, except format codes are interpreted\r
-as in the <span class=CodeText><span style='font-size:10.0pt'>scanf</span></span>\r
-library function.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=MsoListBullet style='margin-left:0in;text-indent:0in'><span\r
-class=Annot><span style='font-size:10.0pt'>/*ARGSUSED*/</span></span></p>\r
-\r
-<p class=IndentText>Turns off unused parameter messages for this function.  The\r
-control comment, <span class=Annot><span style='font-size:10.0pt'>/*@&#8209;paramuse</span></span><span class=Annot><span style='font-size:10.0pt'>@*/</span></span> can be used to the\r
-same effect, or <span class=Annot><span style='font-size:10.0pt'>/*@unused@*/</span></span> can be used in individual parameter declarations.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=TextFontCX>Splint will ignore standard\r
-lint comments if <span class=Flag><span style='font-size:10.0pt'>-lint-comments</span></span>\r
-is used.  If <span class=Flag><span style='font-size:10.0pt'>+warn-lint-comments</span></span>\r
-is used, Splint generates a message for standard lint comments and suggest\r
-replacements<a name="_Ref348801565">.</a></p>\r
-\r
-<p class=MsoHeading8 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975074">Metastate Definitions</a></p>\r
-\r
-<p class=TextFontCX>The grammar for <span\r
-class=ProgramNameChar>.mts</span> files is shown below.</p>\r
-\r
-<p class=MsoNormal>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>metastate</span></i><span lang=FR>    </span><span\r
-style='font-family:Symbol'>Þ</span> <span lang=FR>[ </span><span class=Annot><span\r
-style='font-size:10.0pt'>global </span></span><span lang=FR>] </span><span\r
-class=Annot><span style='font-size:10.0pt'>attribute</span></span> <i><span\r
-lang=FR>identifier clause* </span></i><span class=Annot><span style='font-size:\r
-10.0pt'>end</span></span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>clause</span></i><span lang=FR>        </span><span\r
-style='font-family:Symbol'>Þ</span> <i><span lang=FR>contextClause </span></i><span\r
-lang=FR>| <i>valuesClause</i> | <i>defaultClause | defaultsClause</i></span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.75in;text-align:left;text-indent:.25in'><i><span lang=FR>      </span></i><span\r
-lang=FR>| <i>annotationsClause </i>| <i>mergeClause | transfersClause |\r
-loserefClause</i></span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-1.25in;text-align:left'><i><span lang=FR>| preconditionsClause |\r
-postconditionsClause </span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>contextClause</span></i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>context</span></span> <i><span lang=FR>contextSelector</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>contextSelector </span></i><span\r
-style='font-family:Symbol'>Þ</span> <span lang=FR>( </span><span class=Annot><span\r
-style='font-size:10.0pt'>parameter</span></span><span lang=FR> | </span><span\r
-class=Annot><span style='font-size:10.0pt'>reference</span></span><span\r
-lang=FR> | </span><span class=Annot><span style='font-size:10.0pt'>result</span></span><span\r
-lang=FR> | </span><span class=Annot><span style='font-size:10.0pt'>clause</span></span><span\r
-lang=FR> | </span><span class=Annot><span style='font-size:10.0pt'>literal</span></span><span\r
-lang=FR> | </span><span class=Annot><span style='font-size:10.0pt'>null</span></span><span\r
-lang=FR> ) [ <i>type</i> ]</span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>valuesClause</span></i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>oneof</span></span> <i>valueChoice</i>,*</p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>defaultClause </span></i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>default</span></span> <i>valueChoide</i> </p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>defaultsClause</span></i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>defaults </span></span><span lang=FR>( <i>contextSelector</i> </span><span\r
-class=Annot><span style='font-size:10.0pt'>==&gt; </span></span><i>valueChoice</i><span\r
-lang=FR> )*</span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>&nbsp;</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>annotationsClause</span></i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>annotations </span></span> ( <i>identifier </i>[ <i><span lang=FR>contextSelector\r
-</span></i><span lang=FR>] </span><span class=Annot><span style='font-size:\r
-10.0pt'>==&gt; </span></span><i>valueChoice </i>)<i><span lang=FR>* </span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>&nbsp;</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>mergeClause</span></i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>merge </span></span>( <i>mergeItem </i><span class=Annot><span\r
-style='font-size:10.0pt'>+ </span></span><i>mergeItem </i><span class=Annot><span\r
-style='font-size:10.0pt'>==&gt; </span></span><i>transferAction </i>)<i><span\r
-lang=FR>*</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>mergeItem</span></i><span\r
-style='font-family:Symbol'>Þ</span> <i>valueChoice | </i><span class=Annot><span\r
-style='font-size:10.0pt'>*</span></span></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>&nbsp;</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>transfersClause</span></i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>transfers </span></span>( <i>valueChoice </i><span class=Annot><span\r
-style='font-size:10.0pt'>as </span></span><i>valueChoice</i><span class=Annot><span\r
-style='font-size:10.0pt'> ==&gt; </span></span><i>transferAction </i>)<i><span\r
-lang=FR>*</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>loserefClause</span></i><span\r
-style='font-family:Symbol'>Þ</span> <span class=Annot><span style='font-size:\r
-10.0pt'>losereference </span></span>( <i>valueChoice </i><span class=Annot><span\r
-style='font-size:10.0pt'>==&gt; </span></span><i>errorAction </i>)<i><span\r
-lang=FR>*</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>&nbsp;</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>transferAction</span></i><span\r
-style='font-family:Symbol'>Þ</span> <i>valueChoice | errorAction </i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i>errorAction</i><span style='font-family:Symbol'>Þ</span>\r
-<span class=Annot><span style='font-size:10.0pt'>error</span></span> [ <i>stringLiteral</i>\r
-]<i> </i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>&nbsp;</span></i></p>\r
-\r
-<p class=TextFontCX align=left style='margin-left:\r
-.25in;text-align:left'><i><span lang=FR>valueChoice</span></i><span\r
-style='font-family:Symbol'>Þ</span> <i>identifier</i>                </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975075"></a><a name="_Ref397875216"></a><a name="_Ref350066976"></a><a\r
-name="_Ref348788300">Appendix D<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Specifications</a></p>\r
-\r
-<p class=TextFontCX>Another way of providing more\r
-information about programs is to use formal specifications.  Although this\r
-document has largely ignored specifications, Splint was originally designed to\r
-use the information in LCL specifications instead of source-code annotations. \r
-This document focuses on annotations since it takes less effort to add\r
-annotations to source code than to maintain an additional specification file. \r
-Annotations can express everything that can be expressed in LCL specifications\r
-that is relevant to Splint checking.  However, LCL specifications can provide\r
-more precise documentation on program interfaces than is possible with Splint\r
-annotations.  This appendix (extracted from [Evans94]) is a very brief introduction\r
-to LCL Specifications.  For more information, consult [GH93].      </p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The Larch family of languages\r
-is a two-tiered approach to formal specification. A specification is built\r
-using two languages \97 the <i>Larch Shared Language</i> (LSL), which is\r
-independent of the implementation language, and a <i>Larch Interface Language</i>\r
-designed for the specific implementation language.  An LSL specification\r
-defines <i>sorts</i>, analogous to abstract types in a programming language,\r
-and <i>operators</i>, analogous to procedures.  It expresses the underlying\r
-semantics of an abstraction.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>The interface language\r
-specifies an interface to an abstraction in a particular programming language. \r
-It captures the details of the interface needed by a client using the\r
-abstraction and places constraints on both correct implementations and uses of\r
-the module.  The semantics of the interface are described using primitives and\r
-sorts and operators defined in LSL specifications.  Interface languages have\r
-been designed for several programming languages.</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX>LCL [GH93, Tan95] is a Larch\r
-interface language for Standard C.  LCL uses a C-like syntax.  Traditionally, a\r
-C module <span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>M</span></i></span> consists of a source file, <span\r
-class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.c</span></span>,\r
-and a header file, <span class=Keyword><i><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>M</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>. \r
-The header file contains prototype declarations for functions, variables and\r
-constants exported by <span class=Keyword><i><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>M</span></i></span>, as well as those macro\r
-definitions that implement exported functions or constants, and definitions of\r
-exported types. When using LCL, a module includes two additional files \97 <span\r
-class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>,\r
-a formal specification of <span class=Keyword><i><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>M</span></i></span>, and <span\r
-class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>, which is derived by Splint (if the <span\r
-class=Flag><span style='font-size:10.0pt'>lh</span></span> flag is on) from <span\r
-class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>. \r
-Clients use <span class=Keyword><i><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>M</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>\r
-for documentation, and should not need to look at any implementation file.  The\r
-derived file, <span class=Keyword><i><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>M</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>,\r
-contains include directives (if <span class=Keyword><i><span style='font-size:\r
-10.0pt;font-family:Arial;color:windowtext'>M</span></i></span> depends on other\r
-specified modules), prototypes of functions and declarations of variables as\r
-specified in <span class=Keyword><i><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>M</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>. \r
-The file <span class=Keyword><i><span style='font-size:10.0pt;font-family:Arial;\r
-color:windowtext'>M</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>\r
-should include <span class=Keyword><i><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>M</span></i></span><span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>\r
-and retain the implementation aspects of the old <span class=Keyword><i><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>M</span></i></span><span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.h</span></span>,\r
-but is no longer used for c<a name="_Ref348845779">lient documentation.</a></p>\r
-\r
-<p class=MsoHeading9 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975076">Specification Flags</a></p>\r
-\r
-<p class=TextFontCX>These flags are relevant only\r
-when Splint is used with LCL specifications. </p>\r
-\r
-<p class=Heading10>Global Flags</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>lcs</span></span></p>\r
-\r
-<p class=IndentText>Generate <span class=Keyword><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>.lcs</span></span> files containing symbolic state of <span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span>\r
-files (used for imports).  By default <span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lcs</span></span>\r
-files are generated for each <span class=Keyword><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>.lcl</span></span> file processed.  Use <span\r
-class=Flag><span style='font-size:10.0pt'>-lcs</span></span> to prevent\r
-generation of <span class=Keyword><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>.lcs</span></span> files.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>lh</span></span></p>\r
-\r
-<p class=IndentText>Generate <span class=Keyword><span style='font-size:10.0pt;\r
-font-family:Arial;color:windowtext'>.lh</span></span> files.  By default, <span\r
-class=Flag><span style='font-size:10.0pt'>-lh</span></span> is set and no <span\r
-class=Keyword><span style='font-size:10.0pt;font-family:Arial;color:windowtext'>.lh</span></span>\r
-files are generated.  Use <span class=Flag><span style='font-size:10.0pt'>+lh</span></span>\r
-to enable <span class=Flag><span style='font-size:10.0pt'>.lh</span></span>\r
-file generation.  </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>i </span></span><span\r
-class=Flag><span style='font-size:10.0pt'>&lt;file&gt;</span></span></p>\r
-\r
-<p class=IndentText>Set LCL initialization file to <span class=Flag><i><span\r
-style='font-size:10.0pt'>&lt;file&gt;</span></i></span>.  The LCL\r
-initialization file is read if any <span class=Keyword><span style='font-size:\r
-10.0pt;font-family:Arial;color:windowtext'>.lcl</span></span> files are listed\r
-on the command line.  The default file is <span class=Keyword><span\r
-style='font-size:10.0pt;font-family:Arial;color:windowtext'>lclinit.lci</span></span>, found on the <span class=Keyword><span style='font-size:10.0pt;font-family:\r
-Arial;color:windowtext'>LARCH_PATH</span></span>. </p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>lclexpect </span></span><span\r
-class=Flag><span style='font-size:10.0pt'><i>&lt;number&gt;</i></span></span></p>\r
-\r
-<p class=IndentText>Exactly <span class=Flag><i><span style='font-size:10.0pt'>&lt;number&gt;</span></i></span>\r
-specification errors are expected.  Specification errors are errors detected\r
-when checking the specifications.  They do not depend on the source code.</p>\r
-\r
-<p class=Heading10>Implicit Globals Checking Qualifiers</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-++-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checked-spec-globs</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span>\r
-qualifier on global variables specified in an LCL file with no checking\r
-annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>----</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checkmod-spec-globs</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checkmod</span></span>\r
-qualifier on global variables specified in an LCL file with no checking\r
-annotation.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>imp-checkedstrict-spec-globs</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>checked</span></span>\r
-qualifier on global variables specified in an LCL file with no checking\r
-annotation. </p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=Heading10>Implicit Annotations</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>spec-glob-imp-only</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-annotation on global variable declaration in an LCL file with no allocation\r
-annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>spec-ret-imp-only</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-annotation on return value declaration in an LCL file with no allocation\r
-annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>spec-struct-imp-only</span></span></p>\r
-\r
-<p class=IndentText>Implicit <span class=Annot><span style='font-size:10.0pt'>only</span></span>\r
-annotation on structure field declarations in an LCL file with no allocation\r
-annotation.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>spec-imp-only</span></span></p>\r
-\r
-<p class=IndentText>Sets <span class=Flag><span style='font-size:10.0pt'>spec-glob-imp-only</span></span>,\r
-<span class=Flag><span style='font-size:10.0pt'>spec-ret-imp-only</span></span>\r
-and <span class=Flag><span style='font-size:10.0pt'>spec-struct-imp-only</span></span>.</p>\r
-\r
-<p class=Heading10>Macro Expansion</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>spec-macros</span></span></p>\r
-\r
-<p class=IndentText>Macros defining specified identifiers are not expanded and\r
-are checked according to the specification.<span class=Flag><span\r
-style='font-size:10.0pt'>  </span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>-+++</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=Heading10>Complete Programs and Specifications</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>spec-undef</span></span></p>\r
-\r
-<p class=IndentText>Function, variable, iterator or constant specified but\r
-never defined.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>spec-undecl</span></span></p>\r
-\r
-<p class=IndentText>Function, variable, iterator or constant specified but\r
-never declared.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>P:\r
-  </span><span class=Keyword><span style='font-size:10.0pt'>-</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>need-spec</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>shortcut</span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=IndentText>There is information in the specification that is not\r
-duplicated in syntactic comments.  Normally, this is not an error, but it may\r
-be useful to detect it to make sure checking incomplete systems without the\r
-specifications will still use this information.</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-any</span></span></p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=IndentText>An error is reported for any identifier that is exported\r
-but not specified.  (Sets all export flags below.)</p>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-const</span></span></p>\r
-\r
-<p class=IndentText>Constant exported but not specified.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-var</span></span></p>\r
-\r
-<p class=IndentText>Variable exported but not specified.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-fcn</span></span></p>\r
-\r
-<p class=IndentText>Function exported but not specified.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-iter</span></span></p>\r
-\r
-<p class=IndentText>Iterator exported but not specified.</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-macro</span></span></p>\r
-\r
-<p class=IndentText>An expanded macro exported but not specified</p>\r
-\r
-<div>\r
-\r
-<table cellspacing=0 cellpadding=0 hspace=0 vspace=0  height=14\r
- align=left>\r
- <tr>\r
-  <td valign=top align=left height=14 style='padding-top:0in;padding-right:\r
-  9.35pt;padding-bottom:0in;padding-left:9.35pt'>\r
-  <p class=TextFontCX align=center\r
-  style='text-align:center;background:#CCCCCC'><span style='font-size:10.0pt'>m:</span><span\r
-  class=Keyword><span style='font-size:10.0pt'>---+</span></span></p>\r
-  </td>\r
- </tr>\r
-</table>\r
-\r
-</div>\r
-\r
-<p class=TextFontCX><span class=Flag><span\r
-style='font-size:10.0pt'>export-type</span></span></p>\r
-\r
-<p class=IndentText>Type definition exported but not specified </p>\r
-\r
-<p class=MsoHeading7 style='margin-left:0in;text-indent:0in'><a\r
-name="_Toc534975077"></a><a name="_Ref534642451"></a><a name="_Toc344355450">Appendix\r
-E<span style='font:7.0pt "Times New Roman"'>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\r
-</span>Annotated Bibliography</a></p>\r
-\r
-<h4 style='margin-left:0in;text-indent:0in'>Splint</h4>\r
-\r
-<p class=TextFontCX>All of these papers are\r
-available at <span style='font-size:10.0pt;font-family:Arial'><a\r
-href="http://www.splint.org/publications/">http://www.splint.org/publications/</a></span>.    \r
-</p>\r
-\r
-<p class=TextFontCX>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[Barker01] Chris Barker. <i>Static Error Checking of C Applications\r
-Ported from UNIX to WIN32 Systems Using LCLint</i>. Senior Thesis, University\r
- of Virginia Deptartment of Computer Science.  May 2001.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=IndentText>Describes annotations and checks useful for porting\r
-applications.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[Evans94] David Evans. <i>Using specifications to check source code</i>. \r
-MIT/LCS/TR 628, Laboratory for Computer Science, MIT, June 1994.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=IndentText>MIT SM Thesis.  Describes research behind Splint, focusing\r
-on how specifications can be exploited to do lightweight checking.  Includes\r
-case studies using LCLint.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[EGHT94] David Evans, John Guttag, Jim Horning and Yang Meng Tan.  <i>LCL</i><i>int:\r
-A tool for using specifications to check code</i>.  SIGSOFT Symposium on the\r
-Foundations of Software Engineering, December 1994.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=IndentText>Somewhat obsolete introduction to LCLint.  Shows how LCLint\r
-is used to find errors in a sample program.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[Evans96] David Evans.  <i>Static Detection of Dynamic Memory Errors</i>. \r
-SIGPLAN Conference on Programming Language Design and Implementation (PLDI\r
-\9296), Philadelphia, PA., May 1996.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=IndentText>Describes approach for exploiting annotations added to code\r
-to detect a wide class of errors.  Focuses on memory management checks\r
-described in Section 5 of this manual.  </p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[Evans00] David Evans.  <i>Annotation-Assisted Lightweight Static\r
-Checking.  </i>First International Workshop on Automated Program Analysis,\r
-Testing and Verification.  February, 2000. </p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=IndentText>Short position paper describing research agenda behind\r
-Splint. </p>\r
-\r
-<p class=IndentText style='margin-left:0in'>&nbsp;</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>[Evans02] David Evans and David\r
-Larochelle.  <i>Improving Security Using Extensible Lightweight Static Analysis</i>. \r
-IEEE Software, Jan/Feb 2002.</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>&nbsp;</p>\r
-\r
-<p class=IndentText>Most security attacks exploit instances of well-known\r
-classes of implementations flaws.  This article describes how Splint can be\r
-used to detect common security vulnerabilities (including buffer overflows and\r
-format string vulnerabilities).</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>[Larochelle01] David Larochelle and\r
-David Evans.  Statically Detecting Likely Buffer Overflow Vulnerabilities. \r
-2001 USENIX Security Symposium, Washington, D. C., August 13-17, 2001.  </p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=IndentText>Buffer overflow attacks may be today's single most\r
-important security threat. This paper describes how Splint can be used to\r
-detect likely vulnerabilities through an analysis of the program source code\r
-and presents experience using our approach to detect buffer overflow\r
-vulnerabilities in two security-sensitive programs.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<h4 style='margin-left:0in;text-indent:0in'>C</h4>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[ISO99] International Standard ISO/IEC 9899.  <i>Programming languages \96\r
-C.</i>  Second edition.  December 1999.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=IndentText>International standard specification for C programming\r
-language.  Approved by ANSI May 2000.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[KR88] Brian W. Kernighan and Dennis M. Ritchie.  <i>The C Programming\r
-Language</i>, second edition.  Prentice Hall, New Jersey, 1988.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=IndentText>Standard reference for ANSI C.  If you haven\92t heard of\r
-this one, you probably didn\92t get this far (unless you started at the back).</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[vdL94] Peter van der Linden.  <i>Expert C Programming:  Deep C Secrets</i>. \r
-SunSoft Press, Prentice Hall, New Jersey, 1994.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=IndentText>Filled with useful information on the darker corners of C,\r
-as well as lots of industry anecdotes and humor.  Splint\92s reserved name\r
-checking is loosely based on the list of reserved names in this book.</p>\r
-\r
-<h4 style='margin-left:0in;text-indent:0in'>Methodology</h4>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[GH93] John Guttag and James Horning with Stephen J. Garland, Kevin D.\r
-Jones, Andrés Modet, and Jeannette M. Wing.  <i>Larch: Languages and Tools for\r
-Formal Specification</i>. Springer-Verlag, Texts and Monographs in Computer\r
-Science, 1993.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=IndentText>Overview of the Larch family of specification languages and\r
-related tools.  Includes a chapter on LCL, the Larch C interface language, on\r
-which Splint is based.</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[LG86] Barbara Liskov and John Guttag.  <i>Abstraction and Specification\r
-in Program Development</i>, MIT Press, Cambridge, MA, 1986.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=IndentText>Describes a programming methodology using abstract types and specified interfaces.  Much of the methodology upon which Splint is based comes\r
-from this book.  Uses the CLU programming language.  </p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[Liskov01] Barbara Liskov with John Guttag.  <i>Program Development in\r
-Java</i>, Addison Wesley, 2001.</p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=IndentText>An updated version of [LG86] for the Java programming\r
-language.  </p>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[Tan95] Yang Meng Tan.  <i>Formal Specification Techniques for\r
-Engineering Modular C</i>.  Kluwer International Series in Software\r
-Engineering, Volume 1, Kluwer Academic Publishers, Boston, 1995.</p>\r
-\r
-<p class=MsoNormal align=left style='text-align:left'>&nbsp;</p>\r
-\r
-<p class=IndentText>Modified and updated version of MIT Ph D thesis, previously\r
-published as MIT/LCS/TR-619, 1994.  Includes presentation of the semantics of\r
-LCL and a case study using LCL.</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>&nbsp;</p>\r
-\r
-<h4 style='margin-left:0in;text-indent:0in'>Secure Programming</h4>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>[Hat95] Les Hatton.  <i>Safer C: Developing Software for High-integrity\r
-and Safety-critical Systems</i>.  McGraw-Hill International Series in Software\r
-Engineering, 1995.</p>\r
-\r
-<p class=TextFontCX align=left style='text-align:\r
-left'>&nbsp;</p>\r
-\r
-<p class=IndentText>A broad work on all aspects of developing safety-critical\r
-software, focusing on the C language.  Provides good justification for the use\r
-of C in safety-critical systems, and the necessity of tool-supported programming\r
-standards.  Splint users will be interested to see how many of the errors\r
-listed as only being dynamically detectable can be detected statically by\r
-Splint.</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>&nbsp;</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>[VM02] John Viega and Gary McGraw. \r
-<i>Building Secure Software: How to Avoid Security Problems the </i><i>Right\r
-  Way</i><i>.</i>  Addison-Wesley, 2002.</p>\r
-\r
-<p class=IndentText>A comprehensive survey of techniques and principles for\r
-building secure programs.</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>&nbsp;</p>\r
-\r
-<p class=IndentText style='margin-left:0in'>See also [Evans02] and\r
-[Larochelle01].</p>\r
-\r
-</div>\r
-\r
-<span style='font-size:11.0pt;font-family:"Times New Roman"'><br clear=all\r
-style='page-break-before:right'>\r
-</span>\r
-\r
-<div class=Section6>\r
-\r
-<p class=Appendix><a name="_Toc534975078">Index</a></p>\r
-\r
-<p class=IndentText></p>\r
-\r
-</div>\r
-\r
-<span style='font-size:11.0pt;font-family:"Times New Roman"'><br clear=all\r
-style='page-break-before:auto'>\r
-</span>\r
-\r
-<div class=Section7>\r
-\r
-<p class=MsoIndex1>.splintrc, 73</p>\r
-\r
-<p class=MsoIndex1>/*@*/, 36</p>\r
-\r
-<p class=MsoIndex1>@, 12, 95, 97</p>\r
-\r
-<p class=MsoIndex1>abstract types, 15, <b>21</b>, 22, 24, 31, 32, 33, 39, 58,\r
-60, 61, 66, 78, 80, 87, 88, 99, 104, 108</p>\r
-\r
-<p class=MsoIndex1>access control, 22</p>\r
-\r
-<p class=MsoIndex1>aliasing, 9, 27, 31, 82, 85, 99</p>\r
-\r
-<p class=MsoIndex1>alternate types, 48, 75, 98</p>\r
-\r
-<p class=MsoIndex1>annotations, 9, 10, <b>13</b>, 26, 27, 42, 97, 98</p>\r
-\r
-<p class=MsoIndex2>abstract, 21, 30, 80, 98</p>\r
-\r
-<p class=MsoIndex2>access, 23, 99</p>\r
-\r
-<p class=MsoIndex2>allocates, 39</p>\r
-\r
-<p class=MsoIndex2>alt, 57, 92</p>\r
-\r
-<p class=MsoIndex2>checked, 37, 67, 85, 99</p>\r
-\r
-<p class=MsoIndex2>checkedstrict, 37, 67, 84, 85, 99</p>\r
-\r
-<p class=MsoIndex2>checkmod, 37, 85, 99</p>\r
-\r
-<p class=MsoIndex2>concrete, 80, 98</p>\r
-\r
-<p class=MsoIndex2>constant, 86</p>\r
-\r
-<p class=MsoIndex2>defines, 39</p>\r
-\r
-<p class=MsoIndex2>dependent, <b>27</b>, 42, 81, 99</p>\r
-\r
-<p class=MsoIndex2>end, 97</p>\r
-\r
-<p class=MsoIndex2>exits, 43, 100</p>\r
-\r
-<p class=MsoIndex2>exposed, <b>33</b>, 81, 100</p>\r
-\r
-<p class=MsoIndex2>external, 65, 101</p>\r
-\r
-<p class=MsoIndex2>fallthrough, 46, 101, 102</p>\r
-\r
-<p class=MsoIndex2>falseexit, 43</p>\r
-\r
-<p class=MsoIndex2>falsenull, 14, 100</p>\r
-\r
-<p class=MsoIndex2>falsewhennull, 14</p>\r
-\r
-<p class=MsoIndex2>fileSystem, 36</p>\r
-\r
-<p class=MsoIndex2>i, 97</p>\r
-\r
-<p class=MsoIndex2>i&lt;n&gt;, 95, 97</p>\r
-\r
-<p class=MsoIndex2>ignore, 97</p>\r
-\r
-<p class=MsoIndex2>immutable, 23, 98</p>\r
-\r
-<p class=MsoIndex2>implicit, 29</p>\r
-\r
-<p class=MsoIndex2>in, <b>17</b>, 100</p>\r
-\r
-<p class=MsoIndex2>innerbreak, 46, 91, 101</p>\r
-\r
-<p class=MsoIndex2>innercontinue, 47, 91, 101</p>\r
-\r
-<p class=MsoIndex2>integraltype, 20, 102</p>\r
-\r
-<p class=MsoIndex2>internalState, 36, 57</p>\r
-\r
-<p class=MsoIndex2>iter, 58, 59, 86, 89</p>\r
-\r
-<p class=MsoIndex2>keep, <b>28</b>, 81, 99</p>\r
-\r
-<p class=MsoIndex2>killed, 38, 100</p>\r
-\r
-<p class=MsoIndex2>killref, 99</p>\r
-\r
-<p class=MsoIndex2>loopbreak, 46, 47, 91, 101</p>\r
-\r
-<p class=MsoIndex2>misscase, 46</p>\r
-\r
-<p class=MsoIndex2>mutable, 23, 98</p>\r
-\r
-<p class=MsoIndex2>neverexit, 101</p>\r
-\r
-<p class=MsoIndex2>noaccess, 23, 99</p>\r
-\r
-<p class=MsoIndex2>notfunction, 58, 68, 86, 102</p>\r
-\r
-<p class=MsoIndex2>nothing, 36</p>\r
-\r
-<p class=MsoIndex2>notnull, 15, 100</p>\r
-\r
-<p class=MsoIndex2>notreached, 101, 102</p>\r
-\r
-<p class=MsoIndex2>null, 14, 27, 55, 100</p>\r
-\r
-<p class=MsoIndex2>nullwhentrue, 14</p>\r
-\r
-<p class=MsoIndex2>observer, 33, 81, 83, 99</p>\r
-\r
-<p class=MsoIndex2>only, <b>26</b>, 31, 38, 40, 42, 81, 82, 99</p>\r
-\r
-<p class=MsoIndex2>out, <b>17</b>, 100</p>\r
-\r
-<p class=MsoIndex2>owned, <b>27</b>, 42, 81, 99</p>\r
-\r
-<p class=MsoIndex2>partial, <b>18</b>, 100</p>\r
-\r
-<p class=MsoIndex2>printflike, 101, 102</p>\r
-\r
-<p class=MsoIndex2>refcounted, <b>30</b>, 98</p>\r
-\r
-<p class=MsoIndex2>refs, <b>30</b></p>\r
-\r
-<p class=MsoIndex2>reldef, <b>18</b>, 100</p>\r
-\r
-<p class=MsoIndex2>releases, 40</p>\r
-\r
-<p class=MsoIndex2>relnull, 15, 100</p>\r
-\r
-<p class=MsoIndex2>returned, 31, 99</p>\r
-\r
-<p class=MsoIndex2>scanflike, 101, 102</p>\r
-\r
-<p class=MsoIndex2>sef, 56, 87, 101</p>\r
-\r
-<p class=MsoIndex2>sets, 39</p>\r
-\r
-<p class=MsoIndex2>shared, <b>28</b>, 42, 81, 99</p>\r
-\r
-<p class=MsoIndex2>signedintegraltype, 20, 102</p>\r
-\r
-<p class=MsoIndex2>switchbreak, 46, 91, 101</p>\r
-\r
-<p class=MsoIndex2>t, 97</p>\r
-\r
-<p class=MsoIndex2>t&lt;n&gt;, 97</p>\r
-\r
-<p class=MsoIndex2>temp, <b>27</b>, 81, 82, 83, 99</p>\r
-\r
-<p class=MsoIndex2>trueexit, 43</p>\r
-\r
-<p class=MsoIndex2>truenull, 14, 100</p>\r
-\r
-<p class=MsoIndex2>unchecked, 37, 67, 84, 85, 99</p>\r
-\r
-<p class=MsoIndex2>undef, 38, 100</p>\r
-\r
-<p class=MsoIndex2>unique, 31, 99</p>\r
-\r
-<p class=MsoIndex2>unsignedintegraltype, 20, 102</p>\r
-\r
-<p class=MsoIndex2>unused, 65, 101, 102</p>\r
-\r
-<p class=MsoIndex2>uses, 39</p>\r
-\r
-<p class=MsoIndex2>warnuse, 101</p>\r
-\r
-<p class=MsoIndex2>yield, 58</p>\r
-\r
-<p class=MsoIndex1>ARGSUSED, 102</p>\r
-\r
-<p class=MsoIndex1>assert, 43, 67</p>\r
-\r
-<p class=MsoIndex1>bool, <b>20</b>, 43, 67, 77, 79, 92, 100</p>\r
-\r
-<p class=MsoIndex1>break statements, 46, 91, 101</p>\r
-\r
-<p class=MsoIndex1>char, 79</p>\r
-\r
-<p class=MsoIndex1>characters, 19</p>\r
-\r
-<p class=MsoIndex1>CLU, 25</p>\r
-\r
-<p class=MsoIndex1>comparisons, 78</p>\r
-\r
-<p class=MsoIndex1>complete logic, 47</p>\r
-\r
-<p class=MsoIndex1>complete programs, <b>65</b>, 92, 105</p>\r
-\r
-<p class=MsoIndex1>continue statements, 46, 101</p>\r
-\r
-<p class=MsoIndex1>control comments, 13</p>\r
-\r
-<p class=MsoIndex1>control flow, <b>43</b>, 100</p>\r
-\r
-<p class=MsoIndex1>control nesting depth, 94</p>\r
-\r
-<p class=MsoIndex1>control structures, 90</p>\r
-\r
-<p class=MsoIndex1>czechmacros, 61</p>\r
-\r
-<p class=MsoIndex1>declarations, 38, 85, 101</p>\r
-\r
-<p class=MsoIndex1>distinct names, 63, 90</p>\r
-\r
-<p class=MsoIndex1>enumerators, 19, 94</p>\r
-\r
-<p class=MsoIndex1>environment variables</p>\r
-\r
-<p class=MsoIndex2>LARCH_PATH, 73</p>\r
-\r
-<p class=MsoIndex2>LCLIMPORTDIR, 73</p>\r
-\r
-<p class=MsoIndex1>errno, 67</p>\r
-\r
-<p class=MsoIndex1>evaluation order, 90</p>\r
-\r
-<p class=MsoIndex1>exit, 93</p>\r
-\r
-<p class=MsoIndex1>exit status, 75</p>\r
-\r
-<p class=MsoIndex1>expected errors, 75</p>\r
-\r
-<p class=MsoIndex1>exported declarations, 65</p>\r
-\r
-<p class=MsoIndex1>exports, 93</p>\r
-\r
-<p class=MsoIndex1>exposure, 83, 99</p>\r
-\r
-<p class=MsoIndex1>external names, 65, 90</p>\r
-\r
-<p class=MsoIndex1>fall through cases, 9, 46, 101, 102</p>\r
-\r
-<p class=MsoIndex1>FALLTHROUGH, 95, 102</p>\r
-\r
-<p class=MsoIndex1>fileSystem, 36, 84</p>\r
-\r
-<p class=MsoIndex1>flag name abbreviations, 95</p>\r
-\r
-<p class=MsoIndex1>flags, 10, 11, <b>12</b></p>\r
-\r
-<p class=MsoIndex2>abstract, 79</p>\r
-\r
-<p class=MsoIndex2>accessczech, 60, 61, 80, 87</p>\r
-\r
-<p class=MsoIndex2>accessczechoslovak, 80, 88</p>\r
-\r
-<p class=MsoIndex2>accessfile, 23, 80</p>\r
-\r
-<p class=MsoIndex2>accessfunction, 23</p>\r
-\r
-<p class=MsoIndex2>accessmodule, 23, 80</p>\r
-\r
-<p class=MsoIndex2>accesssall, 80</p>\r
-\r
-<p class=MsoIndex2>accessslovak, 61, 80, 87</p>\r
-\r
-<p class=MsoIndex2>aliasunique, 82</p>\r
-\r
-<p class=MsoIndex2>allblock, 91</p>\r
-\r
-<p class=MsoIndex2>allempty, 91</p>\r
-\r
-<p class=MsoIndex2>allglobs, 84</p>\r
-\r
-<p class=MsoIndex2>allimponly, 29</p>\r
-\r
-<p class=MsoIndex2>allmacros, 57, 68, 86</p>\r
-\r
-<p class=MsoIndex2>ansilib, 74</p>\r
-\r
-<p class=MsoIndex2>ansilimits, 94</p>\r
-\r
-<p class=MsoIndex2>ansireserved, 63, 89</p>\r
-\r
-<p class=MsoIndex2>ansireservedinternal, 63, 89</p>\r
-\r
-<p class=MsoIndex2>ansistrict, 66</p>\r
-\r
-<p class=MsoIndex2>array parameters, 78</p>\r
-\r
-<p class=MsoIndex2>assignexpose, 32, 83</p>\r
-\r
-<p class=MsoIndex2>bitwisesigned, 77</p>\r
-\r
-<p class=MsoIndex2>bool, 77</p>\r
-\r
-<p class=MsoIndex2>boolcompare, 78</p>\r
-\r
-<p class=MsoIndex2>boolfalse, 21, 77</p>\r
-\r
-<p class=MsoIndex2>boolint, 13, 79</p>\r
-\r
-<p class=MsoIndex2>booltrue, 21, 77</p>\r
-\r
-<p class=MsoIndex2>booltype, 20, 77</p>\r
-\r
-<p class=MsoIndex2>branchstate, 80</p>\r
-\r
-<p class=MsoIndex2>casebreak, 46, 91</p>\r
-\r
-<p class=MsoIndex2>castexpose, 32, 83</p>\r
-\r
-<p class=MsoIndex2>castfcnptr, 78</p>\r
-\r
-<p class=MsoIndex2>charindex, 19, 79</p>\r
-\r
-<p class=MsoIndex2>charint, 13, 19, 79</p>\r
-\r
-<p class=MsoIndex2>charintliteral, 79</p>\r
-\r
-<p class=MsoIndex2>checkedglobalias, 85</p>\r
-\r
-<p class=MsoIndex2>checkmodglobalias, 85</p>\r
-\r
-<p class=MsoIndex2><i>checks</i>, 36, 76</p>\r
-\r
-<p class=MsoIndex2>checkstrictglobalias, 85</p>\r
-\r
-<p class=MsoIndex2>checkstrictglobs, 37, 84</p>\r
-\r
-<p class=MsoIndex2>codeimponly, 82</p>\r
-\r
-<p class=MsoIndex2>commentchar, 12, 95, 97</p>\r
-\r
-<p class=MsoIndex2>compdef, 65, 77</p>\r
-\r
-<p class=MsoIndex2>compdestroy, 81</p>\r
-\r
-<p class=MsoIndex2>compmempass, 82</p>\r
-\r
-<p class=MsoIndex2>constmacros, 57, 58, 86</p>\r
-\r
-<p class=MsoIndex2>constprefix, 62, 89</p>\r
-\r
-<p class=MsoIndex2>constprefixexclude, 89</p>\r
-\r
-<p class=MsoIndex2>constuse, 65, 92</p>\r
-\r
-<p class=MsoIndex2>continuecomment, 95</p>\r
-\r
-<p class=MsoIndex2>controlnestdepth, 94</p>\r
-\r
-<p class=MsoIndex2>cppnames, 90</p>\r
-\r
-<p class=MsoIndex2>czech, 60, 87</p>\r
-\r
-<p class=MsoIndex2>czechconstants, 60</p>\r
-\r
-<p class=MsoIndex2>czechconsts, 87</p>\r
-\r
-<p class=MsoIndex2>czechfcns, 60, 87</p>\r
-\r
-<p class=MsoIndex2>czechmacros, 87</p>\r
-\r
-<p class=MsoIndex2>czechoslovak, 88</p>\r
-\r
-<p class=MsoIndex2>czechoslovakconstants, 61</p>\r
-\r
-<p class=MsoIndex2>czechoslovakconsts, 88</p>\r
-\r
-<p class=MsoIndex2>czechoslovakfcns, 61, 88</p>\r
-\r
-<p class=MsoIndex2>czechoslovakmacros, 61, 88</p>\r
-\r
-<p class=MsoIndex2>czechoslovaktype, 61</p>\r
-\r
-<p class=MsoIndex2>czechoslovaktypes, 88</p>\r
-\r
-<p class=MsoIndex2>czechoslovakvars, 61, 88</p>\r
-\r
-<p class=MsoIndex2>czechtypes, 61, 87</p>\r
-\r
-<p class=MsoIndex2>czechvars, 60, 87</p>\r
-\r
-<p class=MsoIndex2>D&lt;initializer&gt;, 73</p>\r
-\r
-<p class=MsoIndex2>declundef, 92, 93</p>\r
-\r
-<p class=MsoIndex2>deepbreak, 47, 91</p>\r
-\r
-<p class=MsoIndex2>deparrays, 80</p>\r
-\r
-<p class=MsoIndex2>dependenttrans, 81</p>\r
-\r
-<p class=MsoIndex2>distinctexternalnames, 63, 90</p>\r
-\r
-<p class=MsoIndex2>distinctinternalnames, 90</p>\r
-\r
-<p class=MsoIndex2>dump, 67, 73</p>\r
-\r
-<p class=MsoIndex2>duplicatequals, 95</p>\r
-\r
-<p class=MsoIndex2>elseifcomplete, 47, 90</p>\r
-\r
-<p class=MsoIndex2>empty, 86</p>\r
-\r
-<p class=MsoIndex2>enumindex, 19, 79</p>\r
-\r
-<p class=MsoIndex2>enumint, 19, 79</p>\r
-\r
-<p class=MsoIndex2>enummemuse, 65, 92</p>\r
-\r
-<p class=MsoIndex2>enumprefix, 62, 88</p>\r
-\r
-<p class=MsoIndex2>enumprefixexclude, 88</p>\r
-\r
-<p class=MsoIndex2>evalorder, 44, 90</p>\r
-\r
-<p class=MsoIndex2>evalorderuncon, 44, 45, 90</p>\r
-\r
-<p class=MsoIndex2>exitarg, 93</p>\r
-\r
-<p class=MsoIndex2>expect, 75</p>\r
-\r
-<p class=MsoIndex2>exportany, 105</p>\r
-\r
-<p class=MsoIndex2>exportconst, 105</p>\r
-\r
-<p class=MsoIndex2>exportfcn, 105, 106</p>\r
-\r
-<p class=MsoIndex2>exportheader, 65, 93</p>\r
-\r
-<p class=MsoIndex2>exportheadervar, 93</p>\r
-\r
-<p class=MsoIndex2>exportiter, 106</p>\r
-\r
-<p class=MsoIndex2>exportlocal, 93</p>\r
-\r
-<p class=MsoIndex2>exportmacro, 105, 106</p>\r
-\r
-<p class=MsoIndex2>exporttype, 106</p>\r
-\r
-<p class=MsoIndex2>exportvar, 105, 106</p>\r
-\r
-<p class=MsoIndex2>exposetrans, 81</p>\r
-\r
-<p class=MsoIndex2>externalnamecaseinsensitive, 63, 90</p>\r
-\r
-<p class=MsoIndex2>externalnamelen, 90</p>\r
-\r
-<p class=MsoIndex2>externalprefix, 62, 89</p>\r
-\r
-<p class=MsoIndex2>externalprefixexclude, 89</p>\r
-\r
-<p class=MsoIndex2>f &lt;file&gt;, 12, 73</p>\r
-\r
-<p class=MsoIndex2>fcnmacros, 57, 58, 86</p>\r
-\r
-<p class=MsoIndex2>fcnuse, 65, 92</p>\r
-\r
-<p class=MsoIndex2>fielduse, 65, 92</p>\r
-\r
-<p class=MsoIndex2>filestaticprefix, 62, 88, 89</p>\r
-\r
-<p class=MsoIndex2>filestaticprefixexclude, 89</p>\r
-\r
-<p class=MsoIndex2>fixedformalarray, 78</p>\r
-\r
-<p class=MsoIndex2>floatdouble, 79</p>\r
-\r
-<p class=MsoIndex2>forblock, 91</p>\r
-\r
-<p class=MsoIndex2>forcehints, 12, 75</p>\r
-\r
-<p class=MsoIndex2>forempty, 91</p>\r
-\r
-<p class=MsoIndex2>formalarray, 78</p>\r
-\r
-<p class=MsoIndex2>formatcode, 78</p>\r
-\r
-<p class=MsoIndex2>formattype, 78</p>\r
-\r
-<p class=MsoIndex2>forwarddecl, 79</p>\r
-\r
-<p class=MsoIndex2>freshtrans, 81</p>\r
-\r
-<p class=MsoIndex2>globalias, 85</p>\r
-\r
-<p class=MsoIndex2>globalprefix, 89</p>\r
-\r
-<p class=MsoIndex2>globalprefixexclude, 89</p>\r
-\r
-<p class=MsoIndex2>globimponly, 29, 82</p>\r
-\r
-<p class=MsoIndex2>globnoglobs, 37, 84</p>\r
-\r
-<p class=MsoIndex2>globs, 84</p>\r
-\r
-<p class=MsoIndex2>globsimpmodsnothing, 85, 96</p>\r
-\r
-<p class=MsoIndex2>globstate, 84</p>\r
-\r
-<p class=MsoIndex2>globuse, 84</p>\r
-\r
-<p class=MsoIndex2>globvarprefix, 62</p>\r
-\r
-<p class=MsoIndex2>globvarprefixexclude, 62</p>\r
-\r
-<p class=MsoIndex2>gnuextensions, 95</p>\r
-\r
-<p class=MsoIndex2>hasyield, 87</p>\r
-\r
-<p class=MsoIndex2>help, 72</p>\r
-\r
-<p class=MsoIndex2>hints, 75</p>\r
-\r
-<p class=MsoIndex2>i &lt;file&gt;, 104</p>\r
-\r
-<p class=MsoIndex2>I&lt;directory&gt;, 73</p>\r
-\r
-<p class=MsoIndex2>ifblock, 47, 91</p>\r
-\r
-<p class=MsoIndex2>ifempty, 91</p>\r
-\r
-<p class=MsoIndex2>ignorequals, 79</p>\r
-\r
-<p class=MsoIndex2>ignoresigns, 19, 79</p>\r
-\r
-<p class=MsoIndex2>immediatetrans, 81</p>\r
-\r
-<p class=MsoIndex2>impabstract, 22, 80</p>\r
-\r
-<p class=MsoIndex2>impcheckedglobs, 85</p>\r
-\r
-<p class=MsoIndex2>impcheckedspecglobs, 105</p>\r
-\r
-<p class=MsoIndex2>impcheckedstatics, 85</p>\r
-\r
-<p class=MsoIndex2>impcheckedstrictglobs, 85</p>\r
-\r
-<p class=MsoIndex2>impcheckedstrictspecglobs, 105</p>\r
-\r
-<p class=MsoIndex2>impcheckedstrictstatics, 38, 85</p>\r
-\r
-<p class=MsoIndex2>impcheckmodglobs, 85</p>\r
-\r
-<p class=MsoIndex2>impcheckmodinternals, 85</p>\r
-\r
-<p class=MsoIndex2>impcheckmodspecglobs, 105</p>\r
-\r
-<p class=MsoIndex2>impcheckmodstatics, 85</p>\r
-\r
-<p class=MsoIndex2>impouts, 17, 18, 76</p>\r
-\r
-<p class=MsoIndex2>imptype, 79</p>\r
-\r
-<p class=MsoIndex2>includenest, 94</p>\r
-\r
-<p class=MsoIndex2>incompletetype, 79</p>\r
-\r
-<p class=MsoIndex2>incondefs, 85</p>\r
-\r
-<p class=MsoIndex2>incondefslib, 85</p>\r
-\r
-<p class=MsoIndex2>infloops, 90</p>\r
-\r
-<p class=MsoIndex2>infloopsuncon, 45, 90</p>\r
-\r
-<p class=MsoIndex2>internalglobs, 84</p>\r
-\r
-<p class=MsoIndex2>internalglobsnoglobs, 84</p>\r
-\r
-<p class=MsoIndex2>internalnamecaseinsensitive, 64, 90</p>\r
-\r
-<p class=MsoIndex2>internalnamelen, 90</p>\r
-\r
-<p class=MsoIndex2>internalnamelength, 64</p>\r
-\r
-<p class=MsoIndex2>internalnamelookalike, 64, 90</p>\r
-\r
-<p class=MsoIndex2>iterprefix, 62, 89</p>\r
-\r
-<p class=MsoIndex2>iterprefixexclude, 89</p>\r
-\r
-<p class=MsoIndex2>keeptrans, 81</p>\r
-\r
-<p class=MsoIndex2>kepttrans, 81</p>\r
-\r
-<p class=MsoIndex2>larchpath, 73</p>\r
-\r
-<p class=MsoIndex2>lclexpect, 105</p>\r
-\r
-<p class=MsoIndex2>lclimportdir, 73</p>\r
-\r
-<p class=MsoIndex2>lcs, 104</p>\r
-\r
-<p class=MsoIndex2>lh, 104</p>\r
-\r
-<p class=MsoIndex2>libmacros, 86</p>\r
-\r
-<p class=MsoIndex2>limit, 74, 75</p>\r
-\r
-<p class=MsoIndex2>linelen, 12, 75</p>\r
-\r
-<p class=MsoIndex2>lintcomments, 95, 103</p>\r
-\r
-<p class=MsoIndex2>load, 67, 73</p>\r
-\r
-<p class=MsoIndex2>localprefix, 89</p>\r
-\r
-<p class=MsoIndex2>localprefixexclude, 89</p>\r
-\r
-<p class=MsoIndex2>longintegral, 20, 79</p>\r
-\r
-<p class=MsoIndex2>longsignedintegral, 20, 79</p>\r
-\r
-<p class=MsoIndex2>longunsignedintegral, 20, 79</p>\r
-\r
-<p class=MsoIndex2>longunsignedunsignedintegral, 20, 79</p>\r
-\r
-<p class=MsoIndex2>looploopbreak, 46, 91</p>\r
-\r
-<p class=MsoIndex2>looploopcontinue, 47, 91</p>\r
-\r
-<p class=MsoIndex2>loopswitchbreak, 46, 91</p>\r
-\r
-<p class=MsoIndex2>macroassign, 56, 86</p>\r
-\r
-<p class=MsoIndex2>macroconstdecl, 57, 86</p>\r
-\r
-<p class=MsoIndex2>macrodecl, 86</p>\r
-\r
-<p class=MsoIndex2>macrofcndecl, 57, 86</p>\r
-\r
-<p class=MsoIndex2>macromatchname, 86</p>\r
-\r
-<p class=MsoIndex2>macroparams, 56, 86</p>\r
-\r
-<p class=MsoIndex2>macroparens, 56, 86</p>\r
-\r
-<p class=MsoIndex2>macroredef, 86</p>\r
-\r
-<p class=MsoIndex2>macrostmt, 56, 86</p>\r
-\r
-<p class=MsoIndex2>macrounrecog, 86</p>\r
-\r
-<p class=MsoIndex2>macrovarprefix, 61, 62, 88</p>\r
-\r
-<p class=MsoIndex2>macrovarprefixexclude, 62, 88</p>\r
-\r
-<p class=MsoIndex2>maintype, 78</p>\r
-\r
-<p class=MsoIndex2>matchanyintegral, 20, 79</p>\r
-\r
-<p class=MsoIndex2>matchfields, 85</p>\r
-\r
-<p class=MsoIndex2>mayaliasunique, 82</p>\r
-\r
-<p class=MsoIndex2>memimp, 82</p>\r
-\r
-<p class=MsoIndex2>memtrans, 81</p>\r
-\r
-<p class=MsoIndex2>misscase, 91</p>\r
-\r
-<p class=MsoIndex2>modfilesys, 84</p>\r
-\r
-<p class=MsoIndex2>modfilesystem, 36</p>\r
-\r
-<p class=MsoIndex2>modglobs, 84</p>\r
-\r
-<p class=MsoIndex2>modglobsnomods, 37, 83, 84</p>\r
-\r
-<p class=MsoIndex2>modglobsunchecked, 84</p>\r
-\r
-<p class=MsoIndex2>modifies, 13, 83</p>\r
-\r
-<p class=MsoIndex2>modinternalstrict, 84</p>\r
-\r
-<p class=MsoIndex2>modnomods, 36, 83</p>\r
-\r
-<p class=MsoIndex2>modobserver, 83</p>\r
-\r
-<p class=MsoIndex2>modobserverstrict, 83</p>\r
-\r
-<p class=MsoIndex2>modsimpnoglobs, 85</p>\r
-\r
-<p class=MsoIndex2>modstrictglobsnomods, 83, 84</p>\r
-\r
-<p class=MsoIndex2>moduncon, 36, 83</p>\r
-\r
-<p class=MsoIndex2>modunconnomods, 84</p>\r
-\r
-<p class=MsoIndex2>mustdefine, 17, 77</p>\r
-\r
-<p class=MsoIndex2>mustfree, 81</p>\r
-\r
-<p class=MsoIndex2>mustfreefresh, 11</p>\r
-\r
-<p class=MsoIndex2><i>mustmod</i>, 36, 83</p>\r
-\r
-<p class=MsoIndex2>mustnotalias, 83</p>\r
-\r
-<p class=MsoIndex2>mutrep, 24, 80</p>\r
-\r
-<p class=MsoIndex2>namechecks, 87</p>\r
-\r
-<p class=MsoIndex2>needspec, 105</p>\r
-\r
-<p class=MsoIndex2>nestcomment, 95</p>\r
-\r
-<p class=MsoIndex2>neverinclude, 68, 94</p>\r
-\r
-<p class=MsoIndex2>newreftrans, 81</p>\r
-\r
-<p class=MsoIndex2>nextlinemacros, 87</p>\r
-\r
-<p class=MsoIndex2>noaccess, 95</p>\r
-\r
-<p class=MsoIndex2>nocomments, 95</p>\r
-\r
-<p class=MsoIndex2>noeffect, 47, 48, 92</p>\r
-\r
-<p class=MsoIndex2>noeffectuncon, 47, 48, 92</p>\r
-\r
-<p class=MsoIndex2>nof, 12, 73</p>\r
-\r
-<p class=MsoIndex2>nolib, 67, 74</p>\r
-\r
-<p class=MsoIndex2>noparams, 93</p>\r
-\r
-<p class=MsoIndex2>noret, 92</p>\r
-\r
-<p class=MsoIndex2>null, 76</p>\r
-\r
-<p class=MsoIndex2>numenummembers, 94</p>\r
-\r
-<p class=MsoIndex2>numliteral, 79</p>\r
-\r
-<p class=MsoIndex2>numstructfields, 94</p>\r
-\r
-<p class=MsoIndex2>observertrans, 81</p>\r
-\r
-<p class=MsoIndex2>oldstyle, 93</p>\r
-\r
-<p class=MsoIndex2>onlytrans, 81</p>\r
-\r
-<p class=MsoIndex2>onlyunqglobaltrans, 82</p>\r
-\r
-<p class=MsoIndex2>overload, 85</p>\r
-\r
-<p class=MsoIndex2>ownedtrans, 81</p>\r
-\r
-<p class=MsoIndex2>paramimptemp, 29, 82</p>\r
-\r
-<p class=MsoIndex2>paramuse, 65, 92, 102</p>\r
-\r
-<p class=MsoIndex2>parenfileformat, 12, 75</p>\r
-\r
-<p class=MsoIndex2>partial, 65, 93</p>\r
-\r
-<p class=MsoIndex2>passunknown, 82</p>\r
-\r
-<p class=MsoIndex2>posixlib, 66, 74</p>\r
-\r
-<p class=MsoIndex2>posixstrictlib, 66, 74</p>\r
-\r
-<p class=MsoIndex2>predassign, 20, 77</p>\r
-\r
-<p class=MsoIndex2>predbool, 77</p>\r
-\r
-<p class=MsoIndex2>predboolint, 77</p>\r
-\r
-<p class=MsoIndex2>predboolothers, 20, 77</p>\r
-\r
-<p class=MsoIndex2>predboolptr, 20, 21, 77</p>\r
-\r
-<p class=MsoIndex2>protoparammatch, 63, 89</p>\r
-\r
-<p class=MsoIndex2>protoparamname, 62, 89</p>\r
-\r
-<p class=MsoIndex2>protoparamprefix, 62, 89</p>\r
-\r
-<p class=MsoIndex2>protoparamprefixexclude, 89</p>\r
-\r
-<p class=MsoIndex2>ptrarith, 77</p>\r
-\r
-<p class=MsoIndex2>ptrcompare, 78</p>\r
-\r
-<p class=MsoIndex2>ptrnegate, 77</p>\r
-\r
-<p class=MsoIndex2>quiet, 74</p>\r
-\r
-<p class=MsoIndex2>readonlystrings, 33, 83</p>\r
-\r
-<p class=MsoIndex2>readonlytrans, 83</p>\r
-\r
-<p class=MsoIndex2>realcompare, 78</p>\r
-\r
-<p class=MsoIndex2>redecl, 38, 93</p>\r
-\r
-<p class=MsoIndex2>redef, 93</p>\r
-\r
-<p class=MsoIndex2>refcounttrans, 81</p>\r
-\r
-<p class=MsoIndex2>relaxquals, 19, 79</p>\r
-\r
-<p class=MsoIndex2>relaxtypes, 79</p>\r
-\r
-<p class=MsoIndex2>repeatunrecog, 93</p>\r
-\r
-<p class=MsoIndex2>repexpose, 83</p>\r
-\r
-<p class=MsoIndex2>retalias, 31, 83</p>\r
-\r
-<p class=MsoIndex2>retexpose, 32, 83</p>\r
-\r
-<p class=MsoIndex2>retimponly, 29, 82</p>\r
-\r
-<p class=MsoIndex2>retval, 92</p>\r
-\r
-<p class=MsoIndex2>retvalbool, 48, 92</p>\r
-\r
-<p class=MsoIndex2>retvalint, 48, 92</p>\r
-\r
-<p class=MsoIndex2>retvalother, 92</p>\r
-\r
-<p class=MsoIndex2>retvalothers, 48</p>\r
-\r
-<p class=MsoIndex2>S&lt;directory&gt;, 73</p>\r
-\r
-<p class=MsoIndex2>sefparams, 87</p>\r
-\r
-<p class=MsoIndex2>sefuncon, 57, 87</p>\r
-\r
-<p class=MsoIndex2>shadow, 89</p>\r
-\r
-<p class=MsoIndex2>sharedtrans, 81</p>\r
-\r
-<p class=MsoIndex2>shiftsigned, 77</p>\r
-\r
-<p class=MsoIndex2>showallconjs, 75</p>\r
-\r
-<p class=MsoIndex2>showalluses, 74</p>\r
-\r
-<p class=MsoIndex2>showcol, 12</p>\r
-\r
-<p class=MsoIndex2>showcolumn, 75</p>\r
-\r
-<p class=MsoIndex2>showfunc, 12, 13, 75</p>\r
-\r
-<p class=MsoIndex2>showscan, 74</p>\r
-\r
-<p class=MsoIndex2>showsummary, 74</p>\r
-\r
-<p class=MsoIndex2>singleinclude, 68, 94</p>\r
-\r
-<p class=MsoIndex2>sizeofformalarray, 78</p>\r
-\r
-<p class=MsoIndex2>sizeoftype, 78</p>\r
-\r
-<p class=MsoIndex2>skipansiheaders, 68, 94</p>\r
-\r
-<p class=MsoIndex2>skipposixheaders, 68, 94</p>\r
-\r
-<p class=MsoIndex2>skipsysheaders, 68, 94</p>\r
-\r
-<p class=MsoIndex2>slovak, 61, 87</p>\r
-\r
-<p class=MsoIndex2>slovakconstants, 61</p>\r
-\r
-<p class=MsoIndex2>slovakconsts, 87, 88</p>\r
-\r
-<p class=MsoIndex2>slovakfcns, 61, 87, 88</p>\r
-\r
-<p class=MsoIndex2>slovakmacros, 61, 87, 88</p>\r
-\r
-<p class=MsoIndex2>slovaktypes, 87, 88</p>\r
-\r
-<p class=MsoIndex2>slovakvars, 61, 87, 88</p>\r
-\r
-<p class=MsoIndex2>specglobimponly, 105</p>\r
-\r
-<p class=MsoIndex2>specimponly, 105</p>\r
-\r
-<p class=MsoIndex2>specmacros, 105</p>\r
-\r
-<p class=MsoIndex2>specretimponly, 105</p>\r
-\r
-<p class=MsoIndex2>specstructimponly, 105</p>\r
-\r
-<p class=MsoIndex2>specundecl, 105</p>\r
-\r
-<p class=MsoIndex2>specundef, 105</p>\r
-\r
-<p class=MsoIndex2>stackref, 82</p>\r
-\r
-<p class=MsoIndex2>standard, 76</p>\r
-\r
-<p class=MsoIndex2>staticinittranc, 82</p>\r
-\r
-<p class=MsoIndex2>statictrans, 81</p>\r
-\r
-<p class=MsoIndex2>stats, 74</p>\r
-\r
-<p class=MsoIndex2>strict, 76</p>\r
-\r
-<p class=MsoIndex2>strictbranchstate, 80</p>\r
-\r
-<p class=MsoIndex2>strictdestroy, 81</p>\r
-\r
-<p class=MsoIndex2>strictlib, 74</p>\r
-\r
-<p class=MsoIndex2>strictops, 78</p>\r
-\r
-<p class=MsoIndex2>strictusereleased, 80</p>\r
-\r
-<p class=MsoIndex2>stringliterallen, 94</p>\r
-\r
-<p class=MsoIndex2>structimponly, 29, 82</p>\r
-\r
-<p class=MsoIndex2>supcounts, 95, 97</p>\r
-\r
-<p class=MsoIndex2>switchloopbreak, 46, 91</p>\r
-\r
-<p class=MsoIndex2>switchswitchbreak, 46, 91</p>\r
-\r
-<p class=MsoIndex2>syntax, 95</p>\r
-\r
-<p class=MsoIndex2>sysdirerrors, 73, 94</p>\r
-\r
-<p class=MsoIndex2>sysdirexpandmacros, 94</p>\r
-\r
-<p class=MsoIndex2>sysdirs, 68, 73, 94</p>\r
-\r
-<p class=MsoIndex2>systemunrecog, 93</p>\r
-\r
-<p class=MsoIndex2>tagprefix, 62, 88</p>\r
-\r
-<p class=MsoIndex2>tagprefixexclude, 88</p>\r
-\r
-<p class=MsoIndex2>temptrans, 81</p>\r
-\r
-<p class=MsoIndex2>timedist, 74</p>\r
-\r
-<p class=MsoIndex2>tmpcomments, 97</p>\r
-\r
-<p class=MsoIndex2>tmpdir, 73</p>\r
-\r
-<p class=MsoIndex2>topuse, 65, 92</p>\r
-\r
-<p class=MsoIndex2>trytorecover, 95</p>\r
-\r
-<p class=MsoIndex2>type, 77</p>\r
-\r
-<p class=MsoIndex2>typeprefix, 62, 89</p>\r
-\r
-<p class=MsoIndex2>typeprefixexclude, 62, 89</p>\r
-\r
-<p class=MsoIndex2>typeuse, 65, 92</p>\r
-\r
-<p class=MsoIndex2>U&lt;initializer&gt;, 73</p>\r
-\r
-<p class=MsoIndex2>uncheckedglobalias, 85</p>\r
-\r
-<p class=MsoIndex2>uncheckedmacroprefix, 62, 89</p>\r
-\r
-<p class=MsoIndex2>uncheckedmacroprefixexclude, 89</p>\r
-\r
-<p class=MsoIndex2>uniondef, 77</p>\r
-\r
-<p class=MsoIndex2>unixlib, 66, 74</p>\r
-\r
-<p class=MsoIndex2>unixstrictlib, 66, 74</p>\r
-\r
-<p class=MsoIndex2>unqualifiedinititrans, 82</p>\r
-\r
-<p class=MsoIndex2>unqualifiedtrans, 82</p>\r
-\r
-<p class=MsoIndex2>unreachable, 92</p>\r
-\r
-<p class=MsoIndex2>unrecog, 93</p>\r
-\r
-<p class=MsoIndex2>unrecogcomments, 95</p>\r
-\r
-<p class=MsoIndex2>unusedspecial, 92</p>\r
-\r
-<p class=MsoIndex2>usedef, 17, 76</p>\r
-\r
-<p class=MsoIndex2>usereleased, 80</p>\r
-\r
-<p class=MsoIndex2>usestderr, 74</p>\r
-\r
-<p class=MsoIndex2>usevarargs, 93</p>\r
-\r
-<p class=MsoIndex2>varuse, 65, 92</p>\r
-\r
-<p class=MsoIndex2>voidabstract, 78</p>\r
-\r
-<p class=MsoIndex2>warnflags, 12, 72</p>\r
-\r
-<p class=MsoIndex2>warnlintcomments, 95, 103</p>\r
-\r
-<p class=MsoIndex2>warnmissingglobs, 84</p>\r
-\r
-<p class=MsoIndex2>warnmissingglobsnoglobs, 84</p>\r
-\r
-<p class=MsoIndex2>warnposixheaders, 94</p>\r
-\r
-<p class=MsoIndex2>weak, 11, 76</p>\r
-\r
-<p class=MsoIndex2>whichlib, 74</p>\r
-\r
-<p class=MsoIndex2>whileblock, 91</p>\r
-\r
-<p class=MsoIndex2>whileempty, 91</p>\r
-\r
-<p class=MsoIndex2>zeroptr, 79</p>\r
-\r
-<p class=MsoIndex1>format codes, 78</p>\r
-\r
-<p class=MsoIndex1>free, 26, 27, 66, 81</p>\r
-\r
-<p class=MsoIndex1>function interfaces, <b>35</b>, 83</p>\r
-\r
-<p class=MsoIndex1>gcc extensions, 95</p>\r
-\r
-<p class=MsoIndex1>global variables, 17, 32, 37, 44, 62, 84, 85, 98, 99, 105</p>\r
-\r
-<p class=MsoIndex1>globals list, <b>37</b>, 44, 45</p>\r
-\r
-<p class=MsoIndex1>GNU extensions, 95</p>\r
-\r
-<p class=MsoIndex1>header file inclusion, 94</p>\r
-\r
-<p class=MsoIndex1>header files, 65, <b>68</b></p>\r
-\r
-<p class=MsoIndex1>help, 72</p>\r
-\r
-<p class=MsoIndex1>hints, 12, 75</p>\r
-\r
-<p class=MsoIndex1>if bodies, 47</p>\r
-\r
-<p class=MsoIndex1>ignored return values, 9, 48, 92</p>\r
-\r
-<p class=MsoIndex1>immutable type, <b>23</b></p>\r
-\r
-<p class=MsoIndex1>implicit annotations, 37, 82, 85, 105</p>\r
-\r
-<p class=MsoIndex1>include file nesting, 94</p>\r
-\r
-<p class=MsoIndex1>infinite loops, 9, 37, 45</p>\r
-\r
-<p class=MsoIndex1>information hiding, 9, 19, 21, 99</p>\r
-\r
-<p class=MsoIndex1>initialization files, <b>12</b>, 73</p>\r
-\r
-<p class=MsoIndex2>.splintrc, 12, 73</p>\r
-\r
-<p class=MsoIndex2>lclinit.lci, 105</p>\r
-\r
-<p class=MsoIndex1>initializers, 82</p>\r
-\r
-<p class=MsoIndex1>internalState, 36, 57, 84</p>\r
-\r
-<p class=MsoIndex1>isalpha, 67</p>\r
-\r
-<p class=MsoIndex1>iscntrl, 67</p>\r
-\r
-<p class=MsoIndex1>isdigit, 67</p>\r
-\r
-<p class=MsoIndex1>isgraph, 67</p>\r
-\r
-<p class=MsoIndex1>islower, 67</p>\r
-\r
-<p class=MsoIndex1>isprint, 67</p>\r
-\r
-<p class=MsoIndex1>ispunct, 67</p>\r
-\r
-<p class=MsoIndex1>isspace, 67</p>\r
-\r
-<p class=MsoIndex1>isupper, 67</p>\r
-\r
-<p class=MsoIndex1>isxdigit, 67</p>\r
-\r
-<p class=MsoIndex1>iterators, <b>58</b>, 86, 87, 98</p>\r
-\r
-<p class=MsoIndex1>Larch, 104</p>\r
-\r
-<p class=MsoIndex1>LARCH_PATH, 73, 105</p>\r
-\r
-<p class=MsoIndex1>LCL, 104</p>\r
-\r
-<p class=MsoIndex1>LCLIMPORTDIR, 73</p>\r
-\r
-<p class=MsoIndex1>lcs files, 104</p>\r
-\r
-<p class=MsoIndex1>lh files, 104</p>\r
-\r
-<p class=MsoIndex1>libraries, <b>66</b>, 73, 85</p>\r
-\r
-<p class=MsoIndex1>line splitting, 12</p>\r
-\r
-<p class=MsoIndex1>lint comments, 102</p>\r
-\r
-<p class=MsoIndex1>loop bodies, 47</p>\r
-\r
-<p class=MsoIndex1>loopexec, 91</p>\r
-\r
-<p class=MsoIndex1>LSL, 104</p>\r
-\r
-<p class=MsoIndex1>macros, <b>55</b>, 62, 86, 102, 105</p>\r
-\r
-<p class=MsoIndex1>main, 78</p>\r
-\r
-<p class=MsoIndex1>malloc, 26</p>\r
-\r
-<p class=MsoIndex1>McConnell, Steve, 21</p>\r
-\r
-<p class=MsoIndex1>memory leaks, 25, 81, 99</p>\r
-\r
-<p class=MsoIndex1>memory management, 9, <b>25</b>, 30, 80</p>\r
-\r
-<p class=MsoIndex1>message format, 75</p>\r
-\r
-<p class=MsoIndex1>Microsoft VisualStudio, 12, 75</p>\r
-\r
-<p class=MsoIndex1>modes, 75</p>\r
-\r
-<p class=MsoIndex2><i>checks</i>, 36, 76</p>\r
-\r
-<p class=MsoIndex2>standard, 76</p>\r
-\r
-<p class=MsoIndex2>strict, 76</p>\r
-\r
-<p class=MsoIndex2>weak, 11, 76</p>\r
-\r
-<p class=MsoIndex1>modification, 31, 32, 33, <b>35</b>, 44, 56, 57, 83</p>\r
-\r
-<p class=MsoIndex1>modifies clause, <b>35</b>, 39, 44, 45, 47, 57, 83, 84, 98</p>\r
-\r
-<p class=MsoIndex1>multiple definitions, 93</p>\r
-\r
-<p class=MsoIndex1>mutability, <b>23</b>, 32</p>\r
-\r
-<p class=MsoIndex1>mutable type, 23</p>\r
-\r
-<p class=MsoIndex1>namespaces, 61, 88</p>\r
-\r
-<p class=MsoIndex1>naming convention, 23, <b>60</b>, 87</p>\r
-\r
-<p class=MsoIndex2>Czech, 60, 63, 80, 87</p>\r
-\r
-<p class=MsoIndex2>Czechoslovak, 61, 80, 88</p>\r
-\r
-<p class=MsoIndex2>Slovak, 61, 63, 80, 87</p>\r
-\r
-<p class=MsoIndex1>naming restrictions, 63, 89</p>\r
-\r
-<p class=MsoIndex1>no effects, 47, 92</p>\r
-\r
-<p class=MsoIndex1>NOTREACHED, 95, 102</p>\r
-\r
-<p class=MsoIndex1>null, 66, 84</p>\r
-\r
-<p class=MsoIndex1>null dereferences, <b>14</b>, 76, 100</p>\r
-\r
-<p class=MsoIndex1>null predicates, 100</p>\r
-\r
-<p class=MsoIndex1>numeric types, 19</p>\r
-\r
-<p class=MsoIndex1>output, 74</p>\r
-\r
-<p class=MsoIndex1>parse errors, 95</p>\r
-\r
-<p class=MsoIndex1>parsing, 95</p>\r
-\r
-<p class=MsoIndex1>partial programs, 65</p>\r
-\r
-<p class=MsoIndex1>path with no return, 92</p>\r
-\r
-<p class=MsoIndex1>pointers, 78</p>\r
-\r
-<p class=MsoIndex1>polymorphism, 57, 98</p>\r
-\r
-<p class=MsoIndex1>POSIX, 66, 94</p>\r
-\r
-<p class=MsoIndex1>predicates, 77</p>\r
-\r
-<p class=MsoIndex1>preprocessor, 73</p>\r
-\r
-<p class=MsoIndex1>primitive operations, 77</p>\r
-\r
-<p class=MsoIndex1>printf, 66, 78, 101</p>\r
-\r
-<p class=MsoIndex1>PRINTFLIKE, 95, 102</p>\r
-\r
-<p class=MsoIndex1>problematic control structures, <b>45</b></p>\r
-\r
-<p class=MsoIndex1>read-only storage, <b>32</b></p>\r
-\r
-<p class=MsoIndex1>reference counting, <b>30</b>, 81</p>\r
-\r
-<p class=MsoIndex1>reserved names, <b>63</b>, 89</p>\r
-\r
-<p class=MsoIndex1>return values, 48</p>\r
-\r
-<p class=MsoIndex1>security vulnerabilities, 9</p>\r
-\r
-<p class=MsoIndex1>sequence points, 44</p>\r
-\r
-<p class=MsoIndex1>Shakespeare, William, 25, 26</p>\r
-\r
-<p class=MsoIndex1>shared storage, 27</p>\r
-\r
-<p class=MsoIndex1>sharing, <b>31</b>, 82</p>\r
-\r
-<p class=MsoIndex1>sharing semantics, 24</p>\r
-\r
-<p class=MsoIndex1>side effect free, 87</p>\r
-\r
-<p class=MsoIndex1>side effect free parameters, 56</p>\r
-\r
-<p class=MsoIndex1>side effects, 101</p>\r
-\r
-<p class=MsoIndex1>sizeof, 22, 78</p>\r
-\r
-<p class=MsoIndex1>special reward, 76</p>\r
-\r
-<p class=MsoIndex1>stack pointers, 25, 28</p>\r
-\r
-<p class=MsoIndex1>stack references, 28</p>\r
-\r
-<p class=MsoIndex1>standard error, 74</p>\r
-\r
-<p class=MsoIndex1>standard libraries, 66</p>\r
-\r
-<p class=MsoIndex1>standard library, 26</p>\r
-\r
-<p class=MsoIndex1>standard output, 74</p>\r
-\r
-<p class=MsoIndex1>static, 65</p>\r
-\r
-<p class=MsoIndex1>static variables, 37</p>\r
-\r
-<p class=MsoIndex1>stderr, 67</p>\r
-\r
-<p class=MsoIndex1>stdin, 67</p>\r
-\r
-<p class=MsoIndex1>stdout, 67</p>\r
-\r
-<p class=MsoIndex1>storage model, 25</p>\r
-\r
-<p class=MsoIndex1>strchr, 67</p>\r
-\r
-<p class=MsoIndex1>string literals, <b>33</b>, 83, 94</p>\r
-\r
-<p class=MsoIndex1>strrchr, 67</p>\r
-\r
-<p class=MsoIndex1>structure fields, 94</p>\r
-\r
-<p class=MsoIndex1>suppressing warnings, 97</p>\r
-\r
-<p class=MsoIndex1>switch, 101</p>\r
-\r
-<p class=MsoIndex1>switch statements, 45, 46</p>\r
-\r
-<p class=MsoIndex1>syntactic comment, 95</p>\r
-\r
-<p class=MsoIndex1>syntax, 12</p>\r
-\r
-<p class=MsoIndex1>tolower, 67</p>\r
-\r
-<p class=MsoIndex1>toupper, 67</p>\r
-\r
-<p class=MsoIndex1>type, 9, 13, 21, 77, 78</p>\r
-\r
-<p class=MsoIndex1>type access, 99</p>\r
-\r
-<p class=MsoIndex1>type checking, <b>19</b></p>\r
-\r
-<p class=MsoIndex1>type equivalence, 78</p>\r
-\r
-<p class=MsoIndex1>types, 102</p>\r
-\r
-<p class=MsoIndex1>undefined, 44</p>\r
-\r
-<p class=MsoIndex1>undefined behavior, 31, 33, 36, 37, <b>44</b>, 55, 90</p>\r
-\r
-<p class=MsoIndex1>undefined values, 9, <b>17</b>, 38, 76, 84, 100</p>\r
-\r
-<p class=MsoIndex1>ungetc, 67</p>\r
-\r
-<p class=MsoIndex1>unreachable, 9</p>\r
-\r
-<p class=MsoIndex1>unreachable code, 92, 101, 102</p>\r
-\r
-<p class=MsoIndex1>unrecognized identifiers, 93</p>\r
-\r
-<p class=MsoIndex1>unused declarations, 9, 65, 92</p>\r
-\r
-<p class=MsoIndex1>use warnings, 101</p>\r
-\r
-<p class=MsoIndex1>use-before-definition, 9, <b>17</b>, 38, 76, 91</p>\r
-\r
-<p class=MsoIndex1>van der Linden, Peter, 46, 63</p>\r
-\r
-<p class=MsoIndex1>varargs, 93</p>\r
-\r
-<p class=MsoIndex1>void, 48</p>\r
-\r
-</div>\r
-\r
-<span style='font-size:11.0pt;font-family:"Times New Roman"'><br clear=all\r
-style='page-break-before:auto'>\r
-</span>\r
-\r
-<div class=Section8>\r
-\r
-<p class=IndentText>&nbsp;</p>\r
-\r
-</div>\r
-\r
-<div><br clear=all>\r
-\r
-<hr align=left size=1 width="33%">\r
-\r
-<div id=ftn1>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref1" name="_ftn1" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[1]</span></span></span></a>\r
-Lint is a common programming tool for detecting anomalies in C programs.  S. C.\r
-Johnson developed the original lint in the late seventies, mainly because early\r
-versions of C did not support function prototypes.  Splint was originally named\r
-LCLint because it was originally intended to check for inconsistencies between\r
-LCL specifications and C implementations.  To reflect divergence from LCL and\r
-increased focus on detecting security vulnerabilities, the name was changed to Splint, short for \93Specification Lint\94 and \93Secure Programming Lint\94.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn2>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref2" name="_ftn2" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[2]</span></span></span></a>\r
-The meta-notation, <span class=Annot>item,<sup>+</sup></span> is used to denote\r
-a comma separated list of items.  For example,                               <span\r
-class=Annot>/*@access mstring, intSet@*/</span> </p>\r
-\r
-<p class=MsoFootnoteText>allows access to the representations of both <span\r
-class=CodeText>mstring</span> and <span class=CodeText>intSet</span>.)   </p>\r
-\r
-</div>\r
-\r
-<div id=ftn3>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref3" name="_ftn3" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[3]</span></span></span></a>\r
-This section is largely based on [Evans96].  It semi-formally defines some of\r
-the terms needed to describe memory management checking; if you are satisfied\r
-with an intuitive understanding of these terms, this section may be skipped.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn4>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref4" name="_ftn4" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[4]</span></span></span></a>\r
-This is similar to the LISP storage model, except that objects are typed.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn5>\r
-\r
-<p class=TextFontCX><a href="#_ftnref5"\r
-name="_ftn5" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[5]</span></span></span></a>\r
-<span style='font-size:10.0pt'>Except </span><span class=CodeText><span\r
-style='font-size:10.0pt'>sizeof</span></span><span style='font-size:10.0pt'>,\r
-which does not need the value of its argument.</span></p>\r
-\r
-</div>\r
-\r
-<div id=ftn6>\r
-\r
-<p class=TextFontCX><a href="#_ftnref6"\r
-name="_ftn6" title=""><span class=MsoFootnoteReference><span\r
-class=MsoFootnoteReference><span style='font-size:11.0pt;font-family:"Times New Roman"'>[6]</span></span></span></a>\r
-If the storage is not assigned to a reference, an internal reference is created\r
-to track the storage.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn7>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref7" name="_ftn7" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[7]</span></span></span></a>\r
-The declaration of <span class=CodeText>free</span> has a <span class=Annot>null</span> annotation on the parameter to indicate that the argument may be <span\r
-class=CodeText>NULL</span>.  According to [ISO, 7.20.3.2], <span\r
-class=CodeText>NULL</span> may be passed to <span class=CodeText>free</span>\r
-without no action.  On some UNIX platforms, passing <span class=CodeText>NULL</span>\r
-to free causes a program crash so the UNIX version of the standard library\r
-specifies <span class=CodeText>free</span> without the <span class=Annot>null</span>\r
-annotation on its parameter. To check that allocated objects are completely\r
-destroyed (e.g., all unshared objects inside a structure are deallocated before\r
-the structure is deallocated), Splint checks that any parameter passed as an <span\r
-class=CodeText>out only void *</span> does not contain references to live,\r
-unshared objects.  This makes sense, since such a parameter could not be used sensibly\r
-in any way other than deallocating its storage.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn8>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref8" name="_ftn8" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[8]</span></span></span></a>\r
-In versions of Splint before 3.0, the <span class=Annot>noreturn</span>\r
-annotation was named <span class=Annot>exits</span>.  The <span class=Annot>noreturn</span>\r
-annotation means the same thing, but is a more appropriate name.  For legacy\r
-code, Splint still supports the <span class=Annot>exits</span> annotations. \r
-Similarly, <span class=Annot>maynotreturn</span> replaces <span class=Annot>mayexit</span>,\r
-<span class=Annot>noreturnwhentrue</span> replaces <span class=Annot>truexit</span>\r
-and <span class=Annot>noreturnwhenfalse</span> replaces <span class=Annot>falseexit</span>.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn9>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref9" name="_ftn9" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[9]</span></span></span></a>The\r
-<span class=Annot>sef</span> annotation denotes a parameter as side effect free\r
-(see Section 11.2.1).  We use <span\r
-class=CodeText>bool /*@alt int@*/</span></a></span> as\r
-the type of the parameter, to indicate that it may be either a Boolean or an\r
-integer.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn10>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref10" name="_ftn10" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[10]</span></span></span></a>\r
-Peter van der Linden estimates that default fall through is the wrong behavior\r
-97% of the time.  [vdL95, p. 37]</p>\r
-\r
-</div>\r
-\r
-<div id=ftn11>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref11" name="_ftn11" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[11]</span></span></span></a>\r
-\93Software Glitch Cripples AT&amp;T Network\94, Telephony, 22 January 1990.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn12>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref12" name="_ftn12" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[12]</span></span></span></a>\r
-See [Larochelle01] for information on internal aspects of the checking.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn13>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref13" name="_ftn13" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[13]</span></span></span></a>\r
-This section is largely based on [Evans02].</p>\r
-\r
-</div>\r
-\r
-<div id=ftn14>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref14" name="_ftn14" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[14]</span></span></span></a>\r
-C. Cowan et al., <i>FormatGuard: Automatic Protection from printf Format String\r
-Vulnerabilities</i>.  10th Usenix Security Symposium, 2001.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn15>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref15" name="_ftn15" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[15]</span></span></span></a>\r
-To be completely correct, all the macro parameters should be evaluated before\r
-the macro has any side effects.  Splint does not check this.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn16>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref16" name="_ftn16" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[16]</span></span></span></a>\r
-Functions that do not produce to the same result each time they are called with\r
-the same arguments should be declared to modify <span class=Annot>internalState</span> so they will lead to errors if they are passed as <span class=Annot>sef</span>\r
-parameters.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn17>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref17" name="_ftn17" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[17]</span></span></span></a>\r
-The most renowned C naming convention is the Hungarian naming convention,\r
-introduced by Charles Simonyi [Simonyi, Charles, and Martin Heller.  \93The\r
-Hungarian Revolution.\94  <i>BYTE</i>, August 1991, p. 131-38].  The names for\r
-Splint naming conventions follow the tradition of using Central European\r
-nationalities as mnemonics for naming conventions.  The Splint conventions are\r
-similar to the Hungarian naming convention in that they encode type information\r
-in names, except that the Splint conventions encode the names of accessible\r
-abstract types instead of the type of the declaration of return value. \r
-Prefixes used in the Hungarian naming convention are not supported by Splint.</p>\r
-\r
-<p class=MsoFootnoteText>&nbsp;</p>\r
-\r
-</div>\r
-\r
-<div id=ftn18>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref18" name="_ftn18" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[18]</span></span></span></a>\r
-Of course, namespace prefixes should really be described by regular\r
-expressions.  If there is sufficient interest (that is, someone volunteers to\r
-program it), regular expressions will be supported in a future version of\r
-Splint.</p>\r
-\r
-</div>\r
-\r
-<div id=ftn19>\r
-\r
-<p class=MsoFootnoteText><a href="#_ftnref19" name="_ftn19" title=""><span\r
-class=MsoFootnoteReference><span class=MsoFootnoteReference><span\r
-style='font-size:10.0pt;font-family:"Times New Roman"'>[19]</span></span></span></a>\r
-POSIX library was contributed by Jens Schweikhardt.</p>\r
-\r
-</div>\r
-\r
-</div>\r
-\r
-<!--#include virtual="footer.html"-->\r